contracthire.tv Cyber Security Policy
Swiss Vans Ltd – Cyber Security Policy
Last updated: October 2025
Applies to: All employees, contractors, partners, and third-party suppliers of Swiss Vans Ltd
Contact: [email protected]
1. Purpose
Swiss Vans Ltd (“we”, “our”, “us”) is committed to protecting the confidentiality, integrity, and availability of all data, systems, and services under our control.
This Cyber Security Policy sets out our principles and responsibilities for safeguarding company information, customer data, and IT infrastructure against cyber threats, accidental loss, or unauthorised access.
2. Scope
This policy applies to:
- All information systems, computers, servers, networks, mobile devices, cloud platforms, and email accounts owned or operated by Swiss Vans Ltd;
- All employees, contractors, and third parties with access to company systems or data;
- All customer, supplier, and business data processed, stored, or transmitted by the company.
It covers both on-premise and remote working environments.
3. Objectives
Our cyber-security objectives are to:
- Protect sensitive information (business, employee, and customer data).
- Prevent unauthorised access, modification, or destruction of data.
- Ensure business continuity and rapid recovery from incidents.
- Maintain compliance with the UK GDPR, the Data Protection Act 2018, and other relevant legislation.
- Promote a culture of security awareness among all staff.
4. Key Principles
- Confidentiality – Access to data is restricted to authorised individuals.
- Integrity – Data must remain accurate and complete.
- Availability – Systems and information are accessible to authorised users when needed.
- Accountability – Every employee shares responsibility for protecting company and customer data.
5. Roles and Responsibilities
Role Responsibilities
Managing Director Overall accountability for cyber security governance.
IT Manager / Security Officer Maintains security infrastructure, policies, incident response, and audits.
Employees & Contractors Follow this policy, report incidents, protect passwords, and use systems responsibly.
Third-Party Suppliers Maintain security standards equal to or above Swiss Vans Ltd’s requirements.
6. Access Control
- User accounts are created on a need-to-know, least-privilege basis.
- Multi-factor authentication (MFA) is enabled wherever technically possible.
- Passwords must be unique, complex, and changed regularly.
- Shared accounts are prohibited except where specifically authorised.
- Access rights are reviewed quarterly and revoked immediately when employment or contracts end.
7. Device and Network Security
- All company devices must have up-to-date antivirus software, firewall protection, and automatic operating-system updates enabled.
- Personal devices (BYOD) may only connect to company resources if authorised and protected by security controls.
- USB drives and external storage must be encrypted and scanned before use.
- Wi-Fi networks are protected by strong encryption (WPA3 or equivalent).
- Remote access uses secure VPN connections only.
8. Data Protection & Encryption
- Confidential data (including customer and finance information) must be encrypted in transit and at rest.
- Sensitive files must not be stored locally on personal or unencrypted devices.
- Cloud storage (e.g. Google Drive, Microsoft 365) must have enforced MFA and access logging.
- Emails containing personal or financial data should be encrypted or sent via secure portals.
- Regular data backups are maintained and tested for restoration integrity.
9. Software & Patch Management
- Only approved software may be installed on company devices.
- Automatic patching must be enabled for all systems and applications.
- Unsupported or end-of-life software is removed immediately.
- The IT Manager monitors vendor advisories and ensures timely updates.
10. Email & Internet Use
- Company email accounts are for authorised business purposes only.
- Do not open suspicious links or attachments.
- Verify sender details on unexpected requests for information or payments.
- Internet use must comply with company acceptable-use rules; illegal or inappropriate sites are prohibited.
- Phishing awareness training is mandatory for all staff.
11. Incident Detection & Response
- All employees must report suspected cyber incidents immediately to the Security Officer at [email protected].
- Incidents include: phishing emails, data loss, malware infection, unauthorised access, or system compromise.
- The IT Manager will:
- Contain and investigate the incident;
- Record findings in the incident log;
- Notify management and the DPO (if personal data affected);
- Report breaches to the Information Commissioner’s Office (ICO) within 72 hours if legally required;
- Communicate with affected parties where necessary.
12. Physical & Environmental Security
- Office IT equipment is protected by controlled access, CCTV, and secure locks.
- Portable devices must not be left unattended in public or unlocked vehicles.
- Server and networking rooms are accessible only to authorised personnel.
13. Supplier & Third-Party Security
- All third-party suppliers with access to company data or systems must sign a Data Processing Agreement and meet Swiss Vans’ security standards.
- Vendor access is logged, monitored, and reviewed regularly.
- Suppliers must notify us immediately of any security incidents affecting our data.
14. Training & Awareness
- All staff receive annual cyber-security awareness training, including phishing, password hygiene, and secure remote working.
- New employees complete mandatory induction training within their first 30 days.
- Periodic simulated phishing campaigns are conducted to measure awareness.
15. Business Continuity & Backup
- Regular data backups are performed daily and stored securely offsite or in a certified cloud environment.
- Disaster-recovery testing is conducted annually to verify backup integrity.
- Key business systems have redundancy and failover procedures.
16. Monitoring & Auditing
- System activity, network logs, and access events are monitored for suspicious behaviour.
- Annual audits are carried out by the IT Manager and reviewed by senior management.
- Findings and actions are documented in a Cyber Security Report.
17. Policy Compliance
Failure to comply with this policy may result in disciplinary action, suspension of access rights, or legal action where appropriate.
Serious or repeated breaches will be reported to senior management and may lead to termination of employment or contracts.
18. Review & Updates
This policy is reviewed annually or when significant business, technological, or regulatory changes occur.
The next review date: October 2026
Contact
Cyber Security Team
Swiss Vans Ltd
Bridgend, Wales CF31 3TP