Information Security & Acceptable Use Policy

1. Purpose and intent

Protects information assets, accounts, devices, networks and systems through responsible use and proportionate security controls. This policy is intended to provide a consistent reference for decisions, conduct and controls. It should be read alongside applicable laws, contractual obligations and relevant internal procedures. Where requirements differ, the applicable legal requirement and formally approved internal control take precedence.

2. Scope and application

Applies to employees, contractors and authorised third parties using or accessing organisational information, devices, networks, applications or services.

Business partners are expected to observe equivalent standards where these are relevant to the services they provide or the activities they undertake on the organisation’s behalf. Application should be proportionate to role, activity, risk and applicable legal requirements.

3. Core principles

• Least privilege: access should be limited to what a role requires.
• Authentication: credentials and authentication factors must be protected.
• Secure use: approved systems and software should be used for business information.
• Confidentiality: information must be classified and shared appropriately.
• Resilience: backups, updates and recovery arrangements should be maintained according to risk.

4. Minimum standards and controls

The following controls describe the expected minimum approach. Specific procedures, approval limits, forms and technical controls may be established separately and updated through controlled internal documents.

• Never share passwords or authentication codes or approve unexpected authentication prompts.
• Use approved devices, applications, storage and communication channels.
• Lock devices when unattended and protect them from loss or unauthorised use.
• Report phishing, malware, lost devices, suspicious access and data exposure immediately.
• Do not install unauthorised software or bypass security controls.
• Return devices and remove access promptly when duties end or change.

5. Roles and accountability

IT and system owners are responsible for technical safeguards and access administration. Managers approve access based on business need. Users are responsible for secure behaviour and prompt reporting.

Any person who is uncertain about the application of this policy should seek guidance before taking action. No individual may override a legal obligation or approved control without appropriate authority and documented justification.

6. Reporting and escalation

Concerns, suspected breaches, control weaknesses and incidents should be raised promptly through the relevant management or designated reporting channel. Urgent threats to health, safety, the environment or the security of information must be escalated immediately. Reports should be handled fairly, sensitively and in accordance with applicable privacy and records requirements.

7. Monitoring, assurance and review

Access reviews, vulnerability remediation, backup tests, incident response, security awareness and control exceptions should be monitored and documented.

Where improvement actions are identified, they should be assigned to an accountable owner, given a proportionate target date and monitored to closure. Material changes in law, risk, organisational context or operating arrangements should trigger an earlier review.

8. Non-compliance

Failure to follow applicable requirements may result in corrective action, additional training, restricted authority, disciplinary measures, contractual remedies or referral to relevant authorities, depending on the circumstances and applicable law. Any response should be proportionate and follow fair process.

9. Related policies and standards

Data Protection; Records Management; Business Continuity; Acceptable Use; Incident Response.

Additional policy requirements

The following provisions expand the practical expectations set out in this policy. They should be applied in conjunction with applicable law, approved internal procedures, contractual obligations and the circumstances of each activity.

Identity and access management

Access should be individually assigned, role-appropriate and based on least privilege. Shared accounts should be avoided unless formally approved and controlled. Authentication credentials must remain confidential; multi-factor authentication should be used where available and appropriate.

Asset and configuration control

Information assets, endpoints, applications and material data stores should be identified and assigned accountable ownership. Systems should be configured securely, maintained, patched and protected against unauthorised software or configuration changes.

Data handling

Information should be classified according to sensitivity and handled using approved storage, transmission, backup and disposal methods. Removable media, personal devices and external sharing require suitable safeguards and authorisation.

Threat and vulnerability management

Security weaknesses should be identified through proportionate monitoring, assessment, patching and testing. Critical vulnerabilities and exposed services should be prioritised according to exploitability, business impact and available mitigations.

Incident response

Suspected compromise, phishing, malware, credential theft, data loss or service disruption must be reported immediately through the designated IT/security channel. Response should contain the incident, preserve evidence, assess impact, restore services safely and document lessons learned.

Third-party and cloud security

External providers and cloud services should be assessed for data location, access controls, resilience, incident notification, subcontracting and exit arrangements proportionate to the information and service involved.

10. Document governance

This web page is a public policy statement. The controlled internal version, where formally approved, is maintained through the organisation’s document-control process. Approval status, document owner, effective date, review cycle and revision history must be confirmed in the controlled document register before this text is represented as a formally issued internal policy.