Information Security Policy

 1. Purpose

The purpose of this policy is to define the approach taken by Core GRC Solutions to protect the confidentiality, integrity and availability of information, in line with ISO/IEC 27001 principles and baseline cyber security good practice. The policy provides the foundation for managing information security and data protection risk and supporting audit, regulatory and contractual obligations.

2. Scope

This policy applies to all information processed, stored or transmitted by Core GRC Solutions, including client information, business records and personal data, whether handled electronically or in physical form.

3. Information Security Principles

Core GRC Solutions manages information security risk in line with the following principles:

• protection of confidentiality, integrity and availability
• proportionality of controls to risk
• alignment with recognised standards and good practice
• continual improvement
   

4. Governance, Roles and Responsibilities

Overall responsibility for information security and data protection rests with the Principal Consultant of Core GRC Solutions. The Principal Consultant is responsible for:

• establishing and maintaining information security and data protection arrangements
• identifying and managing information security and privacy risks
• ensuring compliance with applicable legal, regulatory and contractual requirements
• acting as the organisation’s Data Protection Officer (DPO).  Where required, external advice is sought to ensure appropriate independence and objectivity.
• serving as the primary contact point for the Information Commissioner’s Office (ICO)
• reviewing the effectiveness of information security and data protection controls
• The DPO role is carried out independently and with due regard to confidentiality, proportionality and regulatory expectations.

5. Risk Management

Information security risks are identified, assessed and managed on a proportionate basis. Appropriate controls are selected and implemented to reduce risk to an acceptable level, taking account of business context, legal requirements and stakeholder expectations.

6. Use of Technology and Cyber Security Controls

Core GRC Solutions applies proportionate technical and organisational controls to protect information and systems. This includes alignment with Cyber Essentials requirements, covering:

• secure configuration of devices and cloud services
• use of supported and up-to-date software
• access control and authentication management
• protection against malware
• boundary protection for systems and services

Cyber security controls are implemented in a manner appropriate to the size, scope and risk profile of the organisation and are reviewed periodically.

The Core GRC website is protected using industry-standard controls including Cloudflare for traffic filtering, denial-of-service protection, TLS encryption, and secure content delivery.

7. Incident Management

Information security and personal data incidents, including suspected breaches or weaknesses, are reported, assessed and managed promptly. This includes:

• recording incidents and near misses
• assessing impact and regulatory implications
• determining whether ICO notification is required
• implementing corrective and preventive actions
• reviewing lessons learned

8. Data Protection and Privacy Compliance

Core GRC Solutions processes personal data in accordance with applicable data protection legislation, including UK GDPR.

Data protection is treated as an integral part of information security governance. Personal data risks are identified and managed alongside information security risks, and appropriate safeguards are applied to protect individuals’ rights and freedoms.

9. Information Security Objectives

For the period October 2025 to September 2026, Core GRC Solutions has set the following information security objectives:

1. Maintain an ISO/IEC 27001-aligned information security management approach - Ensure information security and data protection policies, risk assessments and controls remain current and appropriate.
2. Achieve and maintain Cyber Essentials certification - Implement and sustain baseline cyber security controls aligned to Cyber Essentials requirements.
3. Protect client, business and personal data through effective access control and secure cloud usage - Maintain controlled access to systems and ensure secure configuration of collaboration and record-keeping platforms.
4. Strengthen audit readiness and evidence quality - Maintain clear, proportionate records demonstrating risk management, control operation and incident handling.
5. Maintain effective incident and data breach management - Ensure incidents are recorded, assessed and used to drive continual improvement.

Progress against these objectives will be reviewed periodically and as part of management review activities.

10. ICO Registration

• ICO Registration Number - ZC067305
• Data Protection Officer (DPO) - Shaun Wilde
• DPO Contact - info@core-grc.co.uk 

11. Review and Approval

This policy is reviewed at least annually, or following significant changes to business operations, technology, regulatory requirements or risk profile.

Approved by:

Shaun Wilde

Core GRC Solutions

Effective date: September 2026

Next review: September 2027