Information Security Policy
1. Introduction
CAN Solutions Ltd is committed to protecting the confidentiality, integrity and availability of information entrusted to us by our customers, employees, suppliers and business partners.
As a provider of business telecommunications, connectivity and IT solutions, we recognise the importance of maintaining appropriate information security standards and protecting the systems and information used to deliver our services.
This policy outlines our approach to information security and the measures we take to minimise risks associated with unauthorised access, data loss, cyber threats and service disruption.
2. Scope
This policy applies to all employees, Directors, contractors and third parties who access or process information on behalf of CAN Solutions Ltd.
It covers information held electronically or physically, including customer records, employee information, commercial data, communications and business systems.
3. Information Security Management
CAN Solutions Ltd maintains a risk-based approach to information security, with responsibility and oversight retained by the company's management team.
Our internal IT infrastructure and security arrangements are managed with the support of our outsourced IT provider, Layer4, which provides technical expertise, system administration and security support.
Information security responsibilities are reviewed as part of our ongoing operational management, with appropriate action taken to address identified risks.
4. Access Control and Authentication
Access to company systems and confidential information is restricted to authorised individuals based on their roles and responsibilities.
We maintain appropriate access controls, including password protection, multi-factor authentication where implemented, and user account management.
Access permissions are reviewed when employees change roles or leave the business, and access is removed when no longer required.
Employees are responsible for maintaining the confidentiality of their login credentials and reporting suspected unauthorised access.
5. Data Protection and Confidentiality
CAN Solutions Ltd processes personal and confidential information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Customer and business information is handled securely and is only accessed, used or disclosed where there is a legitimate business requirement.
Employees and relevant third parties are expected to maintain confidentiality and comply with our data protection requirements.
Further information is available in our Data Protection & Privacy Policy.
6. IT Systems and Network Security
CAN Solutions Ltd works with Layer4 to maintain appropriate technical and organisational security measures across its internal IT environment.
These measures may include endpoint protection, firewalls, secure system configurations, software updates, access controls and security monitoring, as appropriate to the systems and risks involved.
Company devices and systems are managed to reduce exposure to malware, unauthorised access and other cyber security threats.
7. Cloud Services, Data Storage and Backups
CAN Solutions Ltd uses established cloud-based platforms and service providers to support its business operations and customer services.
Appropriate security controls are applied to the storage, transmission and processing of information, including encryption where supported and applicable.
Backup and recovery arrangements are maintained according to operational requirements and the capabilities of the relevant systems and service providers.
These arrangements are reviewed to support data availability and business continuity.
8. Third-Party and Supplier Security
CAN Solutions Ltd works with established technology providers, telecommunications networks, cloud platforms and specialist IT partners.
We recognise that information security is a shared responsibility and seek to ensure that suppliers handling business or customer information maintain appropriate security standards.
Where services rely on third-party infrastructure or platforms, relevant security responsibilities are managed through supplier relationships, contractual arrangements and operational procedures.
9. Security Awareness and Employee Responsibilities
Employees are expected to follow company security procedures and exercise appropriate care when handling business and customer information.
Security awareness includes recognising suspicious emails, protecting login credentials, handling confidential information appropriately and reporting potential security concerns.
Guidance and training are provided where appropriate to support a security-conscious working environment.
10. Security Incident Management
CAN Solutions Ltd maintains arrangements for identifying, reporting and responding to suspected information security incidents.
Employees are required to report suspected security breaches, data loss, unauthorised access or other security concerns promptly.
Incidents are assessed and managed with support from Layer4 and relevant technology providers where necessary.
Where an incident involves personal data, CAN Solutions Ltd will assess its legal and regulatory notification obligations and take appropriate action in accordance with applicable data protection legislation.
11. Business Continuity and Disaster Recovery
CAN Solutions Ltd recognises the importance of maintaining service availability and operational resilience.
Business continuity and recovery arrangements are considered for critical business systems and services, taking account of operational requirements and dependencies on third-party providers.
Where disruption occurs, CAN Solutions Ltd works with its internal teams and relevant technology partners to restore affected services and minimise the impact on customers and business operations.
12. Compliance and Policy Review
CAN Solutions Ltd is committed to complying with applicable information security, confidentiality and data protection obligations.
This policy is reviewed at least annually, or sooner where significant changes occur to our systems, operations, regulatory requirements or security risks.
The company's management team is responsible for ensuring that the policy remains appropriate and that relevant security measures are maintained.
