Security procedures

Security policies have named owners, are version controlled and are reviewed on a defined schedule.

A defined response process documents roles, communications and escalation paths for security incidents.

Security risks are identified, assessed, treated and tracked using a repeatable methodology.

Recovery objectives and procedures support the restoration of critical services following disruption.

Changes are assessed, approved and recorded to support stable and auditable production operations.

Suppliers are security assessed before onboarding and reviewed periodically thereafter.

A defined process supports assessment, containment and required notification following a data breach.