Information security policy

1. Purpose

The purpose of this Information Security Policy is to establish guidelines and procedures to ensure the confidentiality, integrity, and availability of Squirrel Learning Ltd’s information assets. This policy aims to protect the organisation from data breaches, cyber threats, and ensure compliance with relevant legal and regulatory requirements, including the General Data Protection Regulation (GDPR), the Data Protection Act 2018, and other applicable laws.

2. Scope

This policy applies to all employees, contractors, consultants, temporary workers, and other personnel at Squirrel Learning Ltd, including all personnel affiliated with third parties. It covers all data, systems, networks, and devices that are owned, leased, or managed by Squirrel Learning Ltd, whether they are on-site or accessed remotely.

3. Information Security Objectives

• Confidentiality: Protect sensitive data from unauthorised access and disclosure.
• Integrity: Ensure the accuracy and reliability of the company’s information and IT systems.
• Availability: Ensure that information and vital services are available when needed.
• Compliance: Comply with relevant UK and international laws and regulations.
• Education: Educate employees on their responsibilities regarding information security.
• Incident Response: Establish mechanisms for responding to security incidents and breaches.

4. Roles and Responsibilities

• Management:
  • Ensure the implementation and enforcement of the information security policy.
  • Provide necessary resources and support for information security initiatives.
  • Review and approve information security policies and procedures.
• IT Department:
  • Maintain and manage the IT infrastructure, enforce technical security measures, and monitor compliance.
  • Conduct regular security assessments and audits.
  • Implement and manage access controls, firewalls, and encryption mechanisms.
• Employees:
  • Adhere to the information security policies and report any security incidents to the IT department.
  • Participate in mandatory information security training programs.
• Security Officer:
  • Oversee the development and implementation of security policies and procedures.
  • Conduct regular risk assessments and vulnerability scans.
  • Coordinate incident response efforts and manage security investigations.

5. Data Classification

All data must be classified based on its sensitivity and criticality:

• Public: Information that can be freely shared with the public (e.g., marketing materials, press releases).
• Internal: Information intended for internal use only, not to be disclosed outside the organisation (e.g., internal memos, standard operating procedures).
• Confidential: Sensitive information that could cause harm if disclosed (e.g., customer data, financial records).
• Restricted: Highly sensitive information requiring strict access controls (e.g., proprietary algorithms, source code).

6. Access Control

• Access to information systems and data will be granted based on the principle of least privilege.
• User access must be reviewed regularly to ensure appropriate permissions. This includes:
  • Quarterly access reviews by department heads.
  • Immediate revocation of access upon termination or role change.
• Multi-factor authentication (MFA) is required for accessing critical systems and sensitive data.
• Access to restricted data must be logged and monitored. Logs should be reviewed weekly by the IT department for any unauthorized access attempts.

7. Data Protection

• Encryption: Sensitive data must be encrypted both in transit and at rest using industry-standard encryption protocols.
• Backups: Regular backups must be performed daily, with weekly full backups stored securely off-site.
• Data Loss Prevention (DLP): Implement DLP measures to prevent unauthorised data exfiltration, including monitoring and controlling the transfer of sensitive data.
• Personal Data Handling: Personal data must be handled in compliance with the GDPR. This includes obtaining explicit consent for data collection, ensuring data minimization, and providing individuals with access to their data upon request.

8. Network Security

• Firewalls: Firewalls must be deployed at network boundaries to filter traffic and prevent unauthorized access.
• Intrusion Detection/Prevention Systems (IDS/IPS): IDS/IPS must be implemented to detect and respond to potential threats in real-time.
• Anti-Malware: Anti-malware tools must be deployed on all endpoints and servers, with automatic updates enabled.
• Wireless Networks: Wireless networks must be secured using strong encryption and segmented to separate guest and corporate traffic.
• Remote Access: Remote access to the company’s network must be secured via VPN and MFA, with access restricted to authorized personnel.

9. Incident Response

• Incident Response Plan: A documented incident response plan must be in place, outlining the steps to be taken in the event of a security incident.
• Reporting: Employees must report suspected security incidents immediately to the IT department through the incident reporting system.
• Classification: Incidents will be classified based on their severity (e.g., low, medium, high, critical) and managed accordingly.
• Response: The IT department will coordinate the response, including containment, eradication, recovery, and communication with affected parties.
• Post-Incident Review: Post-incident reviews must be conducted to identify lessons learned and improve future response efforts.

10. Employee Training and Awareness

• Annual Training: All employees must undergo annual information security training, covering topics such as phishing, password security, data protection, and incident reporting.
• Onboarding Training: New employees must receive information security training during their onboarding process.
• Regular Updates: Regular security awareness updates must be communicated to all staff via email, intranet, or company meetings.
• Phishing Simulations: Conduct periodic phishing simulations to test and reinforce employee awareness and response.

11. Physical Security

• Access Controls: Physical access to sensitive areas (e.g., server rooms) must be restricted to authorised personnel using access cards.
• Surveillance: Security measures such as CCTV (provided by the University of Wolverhampton) are implemented to monitor and record access to sensitive areas.
• Visitor Management: Visitors must sign in and be escorted at all times in sensitive areas. Visitor access logs must be maintained for audit purposes.
• Environmental Controls: Ensure appropriate environmental controls (e.g., temperature, humidity) in server rooms to protect equipment from damage.

12. Compliance and Monitoring

• Audits: Regular audits must be conducted to ensure compliance with this policy, including internal and external audits.
• Non-Compliance: Non-compliance with the policy may result in disciplinary action, up to and including termination of employment.
• Monitoring: Security metrics and logs must be reviewed regularly to detect and address potential security issues. This includes:
  • Daily log reviews for critical systems.
  • Weekly vulnerability scans.
  • Quarterly penetration testing.

13. Policy Review

This policy must be reviewed annually or whenever significant changes occur in the organization or its environment. Changes to the policy must be approved by senior management and communicated to all employees.

Approved by:

Name: Gavin Hawkins
Title: CEO
Date: 6th August 2024

This policy may be updated as required to address emerging threats and changes in regulatory requirements. All employees are expected to familiarise themselves with this policy and adhere strictly to its guidelines.

For questions or additional information regarding this policy, please contact the IT Department at Squirrel Learning Ltd.