Information Security Policy

1. Policy statement

[TeamTalk Ltd] holds personal data belonging to other organisations' workforces, including names, mobile numbers and records of what each person was told and when. Those records are relied on as evidence. The company protects the confidentiality, integrity and availability of that information, and holds itself to the technical standard set by Cyber Essentials and to the requirement in Article 32 of the UK GDPR to implement measures appropriate to the risk.

Cyber Essentials: not currently held. Assessment booked with [body], target [date]. The company holds itself to the technical standard of the scheme in the meantime, and the gap analysis and remediation list are available on request. It is not certified to ISO/IEC 27001 and does not claim to be; a written roadmap is available on request. The company does not claim certification it does not hold.

2. Scope

This policy applies to all information the company holds, in any form, and to every employee, director and contractor, and to every device and cloud service used for company work, wherever located. Compliance with it is a condition of engagement.

3. The five controls

1. Firewalls. Every internet-facing system is behind a correctly configured firewall that blocks unauthenticated inbound connections by default. Inbound rules are documented with a business need, approved by a named person, and removed when no longer needed. Devices used outside the office rely on a software firewall on the device, because home routers are outside the company's control.
2. Secure configuration. Default and guessable passwords are changed. Unnecessary accounts, software and services are removed or disabled. Devices lock automatically. Users are authenticated before reaching any company data.
3. Security update management. All software is licensed and supported; unsupported software is removed or upgraded before end of support. Automatic updates are enabled. Updates for vulnerabilities rated critical or high, or scoring 7 or above on CVSS v3, are applied within 14 days of release.
4. User access control. Access is granted on least privilege, through individual named accounts, on a documented approval, and is reviewed [quarterly] and removed on a person's last working day. Multi-factor authentication is enabled on every cloud service account. Administration is done from accounts used only for administration, never for email or browsing.
5. Malware protection. Every device runs malware protection that is kept updated, or is restricted to signed, allow-listed applications.

4. Protecting customer data specifically

• Encryption. TLS 1.2 or above in transit; AES-256 at rest, including backups.
• Tenant isolation. Every record carries a tenant identifier and every query is scoped to the tenant resolved from the request domain, enforced globally rather than left to individual queries.
• Support access. Impersonation of a user for support is restricted to named personnel and is logged in full, with the log available to the customer.
• Data minimisation. Post text, comment text, direct message text and hazard report text are sent for translation. No names, phone numbers or identifiers accompany the text. All data at rest stays in the United Kingdom (AWS London, eu-west-2).
• Backups. Encrypted, held in the same UK region, retained [30] days, and restore-tested [quarterly] with the result recorded.
• Secure development. Changes go through source control and deploy from a protected branch. Framework protections against injection and cross-site attacks are not disabled. Production personal data is not copied into development or staging environments.

5. People

The company has one director and no employees as at [date], so the following applies to the director today and to each person engaged from the day they are engaged: a right to work check before starting; written confidentiality obligations that survive the end of their engagement; a security and data protection briefing on joining and at least annually; and removal of all access on their last working day. Deliberate misuse of company or customer information is gross misconduct, and unauthorised access to a computer system is a criminal offence under the Computer Misuse Act 1990.

6. Incidents

Everyone must report a suspected security incident or data breach immediately to [name, email, mobile], however minor it appears and however it arose. Nobody will be criticised for reporting an incident, including one they caused. The company follows a written incident response procedure and notifies an affected customer without undue delay and in any event within 24 hours where personal data is involved, so the customer can meet its own duty to the Information Commissioner under Article 33.

7. Responsibility and review

[Name, Director] owns this policy and information security generally. It is reviewed at least annually, on any material change to the service or the estate, before the Cyber Essentials assessment and each renewal after it, and after any incident.