Organisational security

The people with access and how they are held to it.

• Multi-factor authentication

  Staff sign in to production and every business system through SSO with hardware-backed MFA.

  Monitored
• Background checks

  Everyone with production access is background-checked before they start.

  Monitored
• Confidentiality agreements

  Staff and contractors sign confidentiality agreements before any access is granted.

  Monitored
• Security awareness training

  Training at onboarding and annually, including phishing and data-handling.

  Monitored
• Acceptable use policy

  Every member of staff acknowledges it at onboarding and on every revision.

  Monitored
• Managed devices

  Company devices enforce full-disk encryption, screen lock and automatic updates.

  Monitored
• Access reviews

  Production and vendor access is reviewed quarterly and removed within a day of departure.

  Monitored