Information and Cyber Security Policy

Participating Businesses implement, where relevant:

1. named responsibility for security;
2. individual accounts and least-privilege access;
3. multi-factor authentication for supported important services;
4. strong credential management and secure recovery;
5. supported software, security updates and malware protection;
6. encryption and secure configuration appropriate to the device and data;
7. controlled backups and proportionate restoration checks;
8. secure sharing, storage and disposal;
9. supplier and cloud-service assessment;
10. logging or monitoring proportionate to risk; and
11. prompt incident reporting and response.

Users protect credentials, verify unusual requests, avoid unauthorised software or sharing, secure devices and report suspected phishing, loss or compromise immediately.

Suppliers with access to systems or information must meet appropriate security requirements and report incidents without undue delay. Access is limited to the authorised purpose and removed when no longer required.

The Black & White business applying this policy contains the incident, preserves evidence, assesses operational and privacy impact, restores services safely and meets notification duties. Lessons learned are converted into corrective action.

Access is granted on least-privilege and need-to-know principles, approved by an accountable person and removed promptly when no longer required. Unique accounts, strong authentication and multi-factor authentication are used where supported and proportionate. Privileged activity, shared access and service accounts receive additional control.

Supported software, secure configuration, timely security updates, malware protection, encryption, backups and recovery testing are applied according to risk. Business information is classified sufficiently to determine sharing, storage and disposal. Portable devices and removable media are restricted and protected. Sensitive information is not placed in unapproved personal accounts or consumer services.

Suppliers with system or data access are assessed before appointment and governed by written security and incident duties. Changes, integrations and automations are tested before production. Logs and alerts are retained proportionately to detect misuse and investigate incidents, without excessive monitoring.

People receive practical awareness covering phishing, payment diversion, password safety, suspicious links, device security and rapid reporting. Changes to bank details or payment instructions are verified through an independent trusted channel.

Incidents are contained, evidence preserved, affected credentials and systems protected, recovery prioritised and required notifications coordinated with privacy, contractual, insurance and legal duties. Lessons and corrective actions are tracked to closure.

Sensitive technical configurations, credentials, recovery material and security weaknesses are not published. This policy states the control standard without exposing protective arrangements.

Approved by David Swaddle, Founder, on 30 August 2026.