Information security and data protection policy

Who it applies to

The policy applies to everyone who uses Accenti information, systems, email, cloud services, phones, laptops, radios and storage media, in the office, on site and remotely.

Key requirements

• Access control

  Access is granted on a need-to-know basis, with unique accounts, strong passwords and multi-factor authentication, and removed promptly when roles change.

• Classification and handling

  Information is handled according to its sensitivity. Client-sensitive information, such as site layouts, movement plans and personnel data, stays with authorized recipients.

• Devices

  Company devices are encrypted, screen-locked and kept up to date. Personal devices reach company email only when enrolled under company controls.

• Email and internet

  Staff stay alert to phishing, verify unusual payment or bank-detail requests by phone, and do not install unapproved software.

• Personal data

  Personal data is collected for a defined purpose, kept accurate and protected, retained no longer than necessary and shared only lawfully.

• Backup and incidents

  Business-critical data is backed up and restores are tested. Lost devices, suspected breaches and phishing are reported to ICT immediately.

Reference framework

• ISO/IEC 27001
• Applicable data protection law