Information Security Policy
Purpose and scope
This policy sets out how RODMENA LIMITED protects the confidentiality, integrity and availability of its own information and of information customers entrust to it. It applies to everyone who works for or with the company and to all systems we operate. We run a small set of controls and check that they are followed.
Commitments
- Information is classified by sensitivity and handled to match. Customer data is always treated as confidential.
- Access to systems and data follows least privilege and is reviewed when roles or engagements change.
- Key accounts (code hosting, infrastructure, email) use multi-factor authentication and strong unique credentials in a password manager.
- Each account is named to one person, and its credentials are never shared.
- Anyone given administrator rights first signs an agreement to use them only for the work they were given for, to keep multi-factor authentication on every administrator account and to hold themselves to a higher standard of confidentiality.
- All services use encryption in transit (TLS), and portable devices use full-disk encryption.
- Operating systems and dependencies are patched in order of severity. Laptops and phones install updates automatically. Servers receive critical and high-risk security fixes within 14 days of their release, and other updates monthly.
- We hold the minimum personal data needed to operate (see our Privacy Policy) and follow UK GDPR.
- Security incidents are triaged immediately, contained and documented, and reported to affected parties without undue delay (see security whitepaper).
- Backups for engagement systems are scheduled, encrypted and tested against agreed recovery objectives.
Responsibilities
The Director owns this policy and is responsible for putting it into effect and reviewing it. Anyone engaged by the company must follow it, and must report a suspected weakness or incident to security@rodmena.co.uk at once. Nobody will ever be penalised for a report made in good faith.
Certification
RODMENA LIMITED holds Cyber Essentials certification for the whole organisation, and this policy keeps in place the controls that certification requires. The Trust Centre publishes the certificate number and dates, along with the status of our other certifications.