Information Security Policy

Purpose

This policy sets out how Towerblock Radio CIC protects information assets from unauthorised access, disclosure, alteration, loss or destruction.

Scope

This policy applies to all directors, staff, volunteers, contractors and anyone who accesses Towerblock Radio CIC information systems or data.

Definitions

• Information asset means any data, document, system or digital resource owned or controlled by Towerblock Radio CIC.
• Personal data means information relating to an identifiable person under UK GDPR.
• Data breach means a security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Responsibilities

The board approves the information security policy. The Data Protection Contact is responsible for day-to-day compliance. All users follow security procedures.

Policy Statement

Towerblock Radio CIC protects all information assets with appropriate technical, organisational and physical security measures, proportionate to the sensitivity of the data and the risk of compromise.

Detailed Procedures

Access control

Access to systems and data is granted on a need-to-know basis. Each user has a unique account. Strong passwords are required (minimum 12 characters). Two-factor authentication is enabled where available. Access is revoked when a person leaves or changes role.

Device security

Devices used for Towerblock Radio CIC activity must have screen lock enabled and be updated with security patches promptly. Anti-malware software is installed on all computers. Lost or stolen devices must be reported within 24 hours.

Data security

Personal data is stored only in approved systems. Special category data is encrypted at rest. Data is transmitted over encrypted connections (HTTPS/TLS).

Network security

Wi-Fi networks are password-protected and use WPA2 or WPA3 encryption. Guest networks are segregated from internal networks. Firewalls are enabled on all systems.

Incident management

Suspected security incidents must be reported to the Data Protection Contact within 24 hours. The Data Protection Contact assesses whether the incident is a personal data breach. Personal data breaches are reported to the ICO within 72 hours if they pose a risk to individuals.

Staff training

All staff and volunteers receive information security briefing on induction and annually thereafter.

Reporting Process

Security incidents are reported to the Data Protection Contact. Data breaches are reported to the ICO within 72 hours where required.

Compliance Requirements

• UK GDPR and Data Protection Act 2018.
• Computer Misuse Act 1990.

Monitoring

Access logs are reviewed monthly. Security incidents are reported to the board.

Review Cycle

This policy shall be reviewed annually and after any security incident.

Version Number

Version 1.0

Approval Section

Approved by: Towerblock Radio CIC Board Date: July 2026 Next review: July 2027

Related Policies

• Cyber Security Policy
• Privacy Policy
• Document Retention Policy
• Disaster Recovery Policy

Website URL slug

/policies/information-security-policy

Meta Title

Information Security Policy | Towerblock Radio

Meta Description

Towerblock Radio CIC's information security policy covering access control, device security, data protection, incident management and compliance with UK GDPR.

Suggested menu category

Governance

Suggested search keywords

information security, UK GDPR, data protection, access control, encryption, data breach, ICO