1. Purpose & scope
The purpose of this Information & Security Policy is to ensure the confidentiality, integrity and availability of all data and systems at emu24 Limited. emu24 operates the OrderWise ERP system hosted via AWS cloud-based data centres and uses Microsoft 365 for communication and collaboration.
This policy applies to all employees, directors, contractors, agency workers, and third-party service providers who have access to emu24's information systems and data, regardless of the device used or location of access.
2. Objectives
- Protect the confidentiality, integrity and availability of all emu24 data and systems
- Comply with UK GDPR, the Data Protection Act 2018 and all applicable legal requirements
- Identify, assess and manage information security risks on an ongoing basis
- Ensure that notifiable personal data breaches are reported to the ICO within 72 hours
- Promote a security-aware culture across all employees and third parties
- Manage the risks associated with emerging technologies, including artificial intelligence tools
3. Roles & responsibilities
Managing Director
Overall accountability for information security. Approves this policy and receives immediate notification of any Level 2 or Level 3 security incidents.
IT Lead / System Administrator
Day-to-day implementation and monitoring of security controls, including access management, patch management, system monitoring and incident response.
All employees
Every employee is responsible for protecting the information they access, following the procedures in this policy, and promptly reporting any security concerns or incidents.
Third-party providers
All suppliers and third parties with access to emu24 systems or data must comply with emu24's security requirements as a condition of their engagement.
4. Data protection & classification
4.1 Data classification
| Level | Examples | Controls |
|---|---|---|
| Confidential | Customer personal data, payment data, employee records, commercially sensitive information | Encrypted at rest and in transit. Access restricted to authorised individuals only. |
| Internal | Internal business data, operational data, supplier information | Access restricted to emu24 employees and authorised contractors. |
| Public | Information intended for external publication | No restrictions. Must not contain confidential or internal data. |
4.2 Data encryption
- All Confidential data must be encrypted in transit (TLS 1.2 or higher) and at rest
- Laptops and portable storage devices containing Confidential data must be encrypted
4.3 Data minimisation & retention
- emu24 collects and retains only the data necessary for legitimate business purposes
- Data retention periods are defined in the emu24 Privacy Policy and must be adhered to
5. System security
5.1 Secure configuration
- All systems configured in accordance with security best practices
- Default system passwords changed immediately upon installation
- Unnecessary services and ports disabled on all systems
5.2 Patch management
- Critical patches applied within 48 hours of release, others within 14 days
- IT Lead maintains a patch log and monitors vendor security advisories
5.3 Firewalls, antivirus & endpoint protection
- Firewalls maintained on all network entry points and reviewed quarterly
- EDR software deployed on all company devices
- Anti-virus definitions updated automatically and at minimum daily
5.4 Network security
- All remote access via approved VPN
- Wi-Fi networks secured with WPA3 or WPA2; guest Wi-Fi segregated from business networks
6. User security
6.1 Passwords & authentication
- All accounts must use a strong, unique password of at least 14 characters
- Multi-Factor Authentication (MFA) is mandatory for all system access, including OrderWise, Microsoft 365 and AWS
- Passwords must never be shared; shared or generic accounts are not permitted
6.2 Account management
- User access rights granted on a least-privilege basis
- Access rights reviewed at least every six months by the IT Lead
- Accounts disabled or removed immediately upon an employee leaving or changing role
6.3 Security awareness training
- All employees complete security awareness training as part of their induction
- Refresher training at least annually and following any significant security incident
- Phishing simulation exercises conducted periodically
7. Acceptable use
emu24 systems must be used for legitimate business purposes only. The following are not permitted:
- Accessing, storing or transmitting material that is illegal, offensive or discriminatory
- Installing unauthorised software on emu24 devices
- Using personal email or cloud storage to send or store emu24 Confidential data
- Attempting to access systems beyond an employee's authorised access level
Use of Artificial Intelligence (AI) tools
Employees wishing to use AI tools (including generative AI such as ChatGPT, Microsoft Copilot or similar) must:
- Obtain prior approval from the Managing Director before using any AI tool for business purposes
- Never input Confidential data into any external AI tool or service
- Be aware that content entered into AI tools may be retained by the AI provider; treat all AI tools as public channels
- Report any suspected data exposure involving AI tools to the IT Lead immediately
8. Physical security
- Access to sensitive areas restricted using key cards or equivalent controls
- All visitors must sign in, state their purpose and be accompanied by an authorised employee
- Screens must be locked when unattended and devices must not be left unattended in public places
- Physical documents containing Confidential data must be stored securely and shredded when disposed of
9. Incident management
9.1 Incident classification
| Level | Examples | Response |
|---|---|---|
| Level 1 — Low | Unsuccessful phishing attempt, minor policy breach, no data exposure | IT Lead notified within 24 hours |
| Level 2 — Medium | Malware detected, unauthorised access attempt, potential data exposure | IT Lead and MD notified immediately. Incident log opened. |
| Level 3 — High / Breach | Confirmed data breach, ransomware, significant system compromise | MD notified immediately. ICO notified within 72 hours if personal data affected. |
9.2 Reporting & response
- All employees must report suspected security incidents immediately to the IT Lead or Managing Director
- All incidents are logged, investigated and a root cause analysis conducted
- Where a personal data breach is confirmed or cannot be ruled out, the 72-hour ICO notification assessment is initiated immediately
- All incidents and responses documented in the emu24 Security Incident Register
10. Supplier & third-party security
- All third parties with access to emu24 systems or Confidential data must sign a Data Processing Agreement (DPA) before access is granted
- Third-party security practices reviewed during onboarding and at least annually
- Third parties must notify emu24 immediately of any security incident affecting emu24 data
11. Business continuity & disaster recovery
Key information security controls supporting business continuity include daily automated backups via AWS, quarterly backup restoration tests, AWS failover mechanisms for OrderWise ERP, and documented disaster recovery procedures reviewed annually alongside the BCP.
12. Compliance, monitoring & review
- emu24 complies with UK GDPR, the Data Protection Act 2018 and PCI-DSS requirements
- Systems are continuously monitored for unusual activity and potential threats
- Security audits and vulnerability assessments conducted at least annually
- Penetration testing of externally facing systems conducted at least annually
- This policy is reviewed at least annually and updated following any significant incident
Approval
This policy has been reviewed and approved by:
Linked policies
This document should be read alongside:
Questions about this policy?
Our team is here 24 hours a day, 7 days a week.