Internal security procedures

How the programme is run, measured and improved.

• Continuous control monitoring

  Controls are monitored continuously, and a failing control opens a tracked issue.

  Monitored
• Incident response plan

  A tested plan with defined roles, and notification within 72 hours of a confirmed breach.

  Monitored
• Risk assessment

  Risks are assessed annually and when the business or the platform changes materially.

  Monitored
• Vendor management

  Vendors are assessed for security before onboarding and reviewed annually.

  Monitored
• Change management

  Production changes are reviewed, tested and deployed through an audited pipeline.

  Monitored
• Business continuity

  Recovery objectives are defined and verified by restore drills.

  Monitored