Cyber Security Policy

Purpose

This policy sets out how Towerblock Radio CIC protects its digital systems, networks and data from cyber threats, ensuring operational continuity and data protection.

Scope

This policy applies to all digital systems, networks, devices and online services used by Towerblock Radio CIC, and to all users of those systems.

Definitions

• Cyber security means the protection of systems, networks and data from digital attack.
• Malware means malicious software designed to damage or gain unauthorised access to systems.
• Phishing means fraudulent attempts to obtain sensitive information by impersonating a trusted entity.
• Ransomware means malware that encrypts data and demands payment for decryption.

Responsibilities

The board approves the cyber security policy. The Operations Lead implements technical controls. All users follow security procedures and report threats.

Policy Statement

Towerblock Radio CIC protects its digital infrastructure from cyber threats through a combination of technical controls, staff awareness and incident response procedures, aligned with Cyber Essentials and NCSC guidance.

Detailed Procedures

Technical controls

Firewalls are enabled on all systems and networks. Anti-malware software is installed and updated. Automatic security updates are enabled. Default passwords are changed. Two-factor authentication is enabled on all accounts where available.

Password management

Passwords must be at least 12 characters and not reused across services. Password manager use is encouraged. Passwords are never shared by email or messaging.

Phishing prevention

Staff and volunteers receive phishing awareness training. Suspicious emails are reported to the Operations Lead. Links and attachments from unknown senders are not opened.

Ransomware protection

Daily backups are maintained and tested. Backups are stored offline or in a separate network. Systems can be rebuilt from clean backups. Payment of ransoms is not permitted.

Incident response

1. Isolate affected systems from the network.
2. Report to the Operations Lead and board chair immediately.
3. Assess the scope of the breach.
4. Preserve evidence.
5. Report data breaches to the ICO within 72 hours if applicable.
6. Restore systems from clean backups.
7. Conduct a post-incident review.

Third-party security

Suppliers and platforms are assessed for security before use. Data processing agreements are in place with all processors. Third-party access is limited and revoked when no longer needed.

Reporting Process

Cyber security incidents must be reported to the Operations Lead within 24 hours.

Compliance Requirements

• UK GDPR and Data Protection Act 2018.
• Computer Misuse Act 1990.
• Cyber Essentials framework (best practice).

Monitoring

Security logs are reviewed monthly. A cyber security review is conducted annually.

Review Cycle

This policy shall be reviewed annually and after any significant incident.

Version Number

Version 1.0

Approval Section

Approved by: Towerblock Radio CIC Board Date: July 2026 Next review: July 2027

Related Policies

• Information Security Policy
• Business Continuity Plan
• Disaster Recovery Policy

Website URL slug

/policies/cyber-security-policy

Meta Title

Cyber Security Policy | Towerblock Radio

Meta Description

Towerblock Radio CIC's cyber security policy covering technical controls, password management, phishing prevention, ransomware protection and incident response aligned with Cyber Essentials.

Suggested menu category

Governance

Suggested search keywords

cyber security, Cyber Essentials, NCSC, phishing, ransomware, malware, data breach