Information Security Policy

1. Purpose

This policy sets out how Unolabs Limited protects its own information and the information clients trust us with. It explains who is responsible, the rules to follow, and the steps we still plan to take.

We aim to keep information confidential, accurate and available to the right people.

2. Scope

This policy applies to:

• our employees;
• contractors who work for us through their own companies;
• partners and suppliers who access our systems or our clients' information.

It covers all information we handle, in any form. It covers our Microsoft 365 tenant, our devices, and any other system we use for work. Where a client sets its own security rules, we follow those as well. If the two conflict, the stricter rule applies.

3. Roles and responsibilities

• Director: approves this policy.
• Chief Technology Officer: owns this policy. Runs our technical controls, manages incidents and keeps our Cyber Essentials certification current.
• Data protection lead: handles personal data breaches, as set out in our Data Protection Policy.
• Everyone in scope: follows this policy, protects their accounts and devices, and reports any concern at once.

4. Certification and where data is held

Unolabs Limited holds Cyber Essentials certification, issued through IASME on 6 November 2026. It covers the whole organisation. We will renew it by 6 November 2027, and every year after that.

Our email and files are held in our Microsoft 365 tenant. Its data is held in the UK.

We do not hold ISO/IEC 27001, Cyber Essentials Plus or SOC 2 for Unolabs Limited. We will consider Cyber Essentials Plus by 30 June 2027. We do not hold any HMG security accreditation.

5. Information classification

We use three levels. They line up with the UK Government's OFFICIAL tier.

Client information marked OFFICIAL or OFFICIAL-SENSITIVE is treated as Confidential. We follow any extra handling rules the client sets. We do not handle information classified above OFFICIAL.

We will keep a register of our information assets and their owners by 31 March 2027.

6. Access control

• Everyone has a named account. We do not share accounts.
• Multi-factor authentication is required for our cloud services, as Cyber Essentials requires.
• People get only the access their role needs.
• Admin accounts are separate from day-to-day accounts and are used only for admin tasks.
• We remove access on the day someone leaves, or leaves a client engagement.

People who need access to client or government data are screened first, under our Personnel Screening Policy.

We will review access rights every quarter, and record each review, from 31 March 2027.

7. Device security

Our Cyber Essentials certification covers the five technical controls. In practice:

1. Firewalls. Every device and internet connection in scope has a firewall switched on.
2. Secure configuration. We remove unused software and accounts, change default passwords, and turn off auto-run.
3. User access control. As set out in section 6.
4. Malware protection. Anti-malware is switched on and kept up to date.
5. Security updates. High and critical updates are installed within 14 days of release. Unsupported software is removed.

All company devices have their storage encrypted (BitLocker on Windows, FileVault on Mac).

8. Email, cloud services and data location

• Use only approved company services for work. Do not use personal email or personal cloud storage.
• Keep client data in our Microsoft 365 tenant, or in a workspace the client provides.
• Do not move client data outside the UK unless the client agrees in writing. Our Data Protection Policy sets out the safeguards.
• Check before you open unexpected links or attachments. Report suspected phishing.
• Do not use removable media, such as USB drives, for client data.

9. Suppliers, contractors and partners

Contractors and partners must follow this policy, or a client's stricter rules, when they work for us.

By 31 March 2027, we will:

• add security and confidentiality terms to our standard contractor and partner agreements;
• keep a register of suppliers that handle our data, with a short security check for each one;
• require Cyber Essentials, or an equal standard, from any supplier that handles client personal data.

10. Secure development and AI tools

When we build or change software, we:

• keep code in access-controlled repositories;
• never store passwords, keys or other secrets in code;
• use test data, not live personal data, in development wherever we can.

AI tools. Do not put client data, personal data or Confidential information into a public AI tool. This applies unless the Chief Technology Officer has approved the tool in writing for that use, and the client agrees. Internal and Public information may be used with approved tools. We will publish a list of approved AI tools by 31 January 2027.

11. Logging and monitoring

We will keep sign-in and admin audit logs for our Microsoft 365 tenant for at least 90 days. We will review alerts for unusual sign-ins every week from 31 January 2027.

12. Incident management

Report within 1 hour. If you spot an actual or suspected security incident, report it to the Chief Technology Officer within 1 hour. This includes lost devices, phishing clicks, wrong recipients and near misses. Do not investigate on your own.

What we do next. We contain the incident, assess it, fix the cause, and record what we learned. Where a client contract sets a shorter notice period, we follow it.

Personal data breaches. The data protection lead assesses every breach involving personal data. We report it to the Information Commissioner's Office within 72 hours of becoming aware of it, unless it is unlikely to put people at risk. Our Data Protection Policy sets out the full process.

We will write a one-page incident runbook, including out-of-hours contacts, by 31 December 2026.

13. Backups

Microsoft 365 keeps our data replicated within the UK. Version history lets us recover from accidental deletion. We also keep a separate backup of our Microsoft 365 data with a third-party backup service. We will test a restore by 31 March 2027, and at least once a year after that.

14. Acceptable use

• Use company systems for work. Limited personal use is fine if it does not put information at risk.
• Lock your screen when you step away.
• Never try to get round a security control.
• Report anything that looks wrong.

Breaking this policy may lead to disciplinary action, or to the end of a contract.

15. Training

Everyone will complete security awareness training before they get access, and once a year after that. We will put this in place by 31 March 2027. The training will cover phishing, passwords and MFA, handling client data, AI tools, and reporting incidents.

16. Review

The Chief Technology Officer reviews this policy every 12 months. We also review it after a major incident, or a significant change to our systems or the law.

17. Contact