In-person
courses
Masterclass
online
Book a 1:1
session
School
partners
Impact
stories
About us
Contact us

Role Models IT Security Policy

1. Introduction

This document sets out the measures to be taken by all employees of Role Models (the “Company”) and by the Company as a whole in order to protect the Company’s computer systems, devices, infrastructure, computing environment and any and all other relevant equipment (collectively, “IT Systems”) from damage and threats whether internal, external, deliberate, or accidental.

2. Key Principles

  • All IT Systems are to be protected against unauthorised access.
  • All IT Systems are to be used only in compliance with relevant Company Policies.
  • All employees of the Company and any and all third parties authorised to use the IT Systems including, but not limited to, contractors and sub-contractors (collectively, “Users”), must ensure that they are familiar with this Policy and must adhere to and comply with it at all times.
  • All line managers must ensure that all Users under their control and direction must adhere to and comply with this Policy at all times
  • All data stored on IT Systems are to be managed securely in compliance with all relevant parts of EU Regulation 2016/679 General Data Protection Regulation (“GDPR”) and all other laws governing data protection whether now or in the future in force.
  • All data stored on IT Systems shall be available only to those Users with a legitimate need for access.
  • All data stored on IT Systems shall be protected against unauthorised access and/or processing.
  • All data stored on IT Systems shall be protected against loss and/or corruption.
  • All IT Systems are to be installed, maintained, serviced, repaired, and upgraded by 'iatech' (the “IT Department”) or by such third party/parties as the IT Department may from time to time authorise.
  • The responsibility for the security and integrity of all IT Systems and the data stored thereon (including, but not limited to, the security, integrity, and confidentiality of that data) lies with the IT Department unless expressly stated otherwise.
  • All breaches of security pertaining to the IT Systems or any data stored thereon shall be reported and subsequently investigated by the IT Department.
  • All Users must report any and all security concerns relating to the IT Systems or to the data stored thereon immediately to the IT Department.
  • Our Data Protection Officer is John Reed.

3. IT Department Responsibilities

  • The IT Department Manager, Jonathan Reed, shall be responsible for the following:
    1. ensuring that all IT Systems are assessed and deemed suitable for compliance with the Company’s security requirements;
    2. ensuring that IT security standards within the Company are effectively implemented and regularly reviewed, working in consultation with the Company’s senior management and reporting the outcome of such reviews to the Company’s senior management;
    3. ensuring that all Users are kept aware of the requirements of this Policy and of all related legislation, regulations, and other relevant rules whether now or in the future in force including, but not limited to, the GDPR and the Computer Misuse Act 1990.
  • The IT Department Staff shall be responsible for the following:
    1. assisting all Users in understanding and complying with this Policy;
    2. providing all Users with appropriate support and training in IT security matters and use of IT Systems;
    3. ensuring that all Users are granted levels of access to IT Systems that are appropriate for each User, taking into account their job role, responsibilities, and any special security requirements;
    4. receiving and handling all reports relating to IT security matters and taking appropriate action in response.
    5. taking proactive action, where possible, to establish and implement IT security procedures and raise User awareness;
    6. assisting the IT Manager in monitoring all IT security within the Company and taking all necessary action to implement this Policy and any changes made to this Policy in the future; and

4. Users’ Responsibilities

  • All Users must comply with all relevant parts of this Policy at all times when using the IT Systems.
  • All Users must use the IT Systems only within the bounds of UK law and must not use the IT Systems for any purpose or activity which is likely to contravene any UK law whether now or in the future in force.
  • Users must immediately inform the IT Department of any and all security concerns relating to the IT Systems.
  • Users must immediately inform the IT Department of any other technical problems (including, but not limited to, hardware failures and software errors) which may occur on the IT Systems.
  • Any and all deliberate or negligent breaches of this Policy by Users will be handled as appropriate under the Company’s disciplinary procedures.

5. Software Security Measures

  • All software in use on the IT Systems (including, but not limited to, operating systems, individual software applications, and firmware) will be kept up-to-date and any and all relevant software updates, patches, fixes, and other intermediate releases will be applied at the sole discretion of the IT Department. This provision does not extend to upgrading software to new ‘major releases’ (e.g. from version 1.0 to version 2.0), only to updates within a particular major release (e.g. from version 1.0 to version 1.0.1 etc.). Unless a software update is available free of charge it will be classed as a major release, falling within the remit of new software procurement and outside the scope of this provision.
  • Where any security flaw is identified in any software that flaw will be either fixed immediately or the software may be withdrawn from the IT Systems until such time as the security flaw can be effectively remedied.
  • No Users may install any software of their own, whether that software is supplied on physical media or whether it is downloaded, without the approval of the IT Manager. Any software belonging to Users must be approved by the IT Manager and may only be installed where that installation poses no security risk to the IT Systems and where the installation would not breach any licence agreements to which that software may be subject.
  • All software will be installed onto the IT Systems by the IT Department unless an individual User is given written permission to do so by the IT Manager. Such written permission must clearly state which software may be installed and onto which computer(s) or device(s) it may be installed.

6. Anti-Virus Security Measures

  • Most IT Systems (including all computers and servers) will be protected with suitable anti-virus, firewall, and other suitable internet security software. All such software will be kept up-to-date with the latest software updates and definitions.
  • All IT Systems protected by anti-virus software will be subject to a full system scan at least once a year.
  • All physical media (e.g. USB memory sticks or disks of any kind) used by Users for transferring files must be virus-scanned before any files may be transferred. Such virus scans shall be performed [automatically upon connection / insertion of media]
  • Users shall be permitted to transfer files using cloud storage systems only with the approval of the IT Manager. [All files downloaded from any cloud storage system must be scanned for viruses during the download process.]
  • Any files being sent to third parties outside the Company, whether by email, on physical media, or by other means (e.g. shared cloud storage) must be scanned for viruses before being sent or as part of the sending process, as appropriate. [All email attachments are scanned automatically upon sending.]
  • Where any virus is detected by a User this must be reported immediately to the IT Department (this rule shall apply even where the anti-virus software automatically fixes the problem). The IT Department shall promptly take any and all necessary action to remedy the problem. In limited circumstances this may involve the temporary removal of the affected computer or device. Wherever possible a suitable replacement computer or device will be provided within 1 week to limit disruption to the User.
  • Where any User deliberately introduces any malicious software or virus to the IT Systems this will constitute a criminal offence under the Computer Misuse Act 1990 and will be handled as appropriate under the Company’s disciplinary procedures.

7, Hardware Security Measures

  • Wherever practical, IT Systems will be located in rooms which may be securely locked when not in use or, in appropriate cases, at all times whether in use or not (with authorised Users being granted access by means of a key, smart card, door code or similar). Where access to such locations is restricted, Users must not allow any unauthorised access to such locations for any reason.
  • All IT Systems not intended for normal use by Users (including, but not limited to, servers, networking equipment, and network infrastructure) shall be located, wherever possible and practical, in secured, climate-controlled rooms and/or in locked cabinets which may be accessed only by designated members of the IT Department.
  • No Users shall have access to any IT Systems not intended for normal use by Users (including such devices mentioned above) without the express permission of the IT Manager. Under normal circumstances, whenever a problem with such IT Systems is identified by a User, that problem must be reported to the IT Department. Under no circumstances should a User attempt to rectify any such problems without the express permission (and, in most cases, instruction and/or supervision) of the IT Manager.
  • All non-mobile devices (including, but not limited to, desktop computers, workstations, and monitors) shall, wherever possible and practical, be physically secured in place with a suitable locking mechanism. Where the design of the hardware allows, computer cases shall be locked to prevent tampering with or theft of internal components.
  • All mobile devices (including, but not limited to, laptops, tablets, and smartphones) provided by the Company should always be transported securely and handled with care. In circumstances where such mobile devices are to be left unattended they should be placed inside a lockable case or other suitable container. Users should make all reasonable efforts to avoid such mobile devices from being left unattended at any location [other than their private homes or Company premises]. If any such mobile device is to be left in a vehicle it must be stored out of sight and, where possible, in a locked compartment.
  • The IT Department shall maintain a complete asset register of all IT Systems. All IT Systems shall be labelled, and the corresponding data shall be kept on the asset register.

8. Access Security

  • Access privileges for all IT Systems shall be determined on the basis of Users’ levels of authority within the Company and the requirements of their job roles. Users shall not be granted access to any IT Systems or electronic data which are not reasonably required for the fulfilment of their job roles.
  • All IT Systems (and in particular mobile devices including, but not limited to, laptops, tablets, and smartphones) shall be protected with a secure password or passcode, or such other form of secure log-in system as the IT Department may deem appropriate and approve. Not all forms of biometric log-in are considered secure. Only those methods approved by the IT Department may be used.
  • All passwords must, where the software, computer, or device allows:
    1. be at least 8 characters long;
    2. contain a combination of upper and lower case letters / numbers / spaces / symbols;
    3. be different from the previous password;
    4. not be obvious or easily guessed (e.g. birthdays or other memorable dates, memorable names, events, or places etc.); and
    5. be created by the user.
  • Passwords should be kept stored in Onepassword. If a User has reason to believe that another individual has accessed their Onepassword account, they should change their master password immediately and report the suspected breach of security to the IT Department.
  • Users should not write down passwords and under no circumstances should passwords be left on display for others to see (e.g. by attaching a note to a computer display).
  • All IT Systems with displays and user input devices (e.g. mouse, keyboard, touchscreen etc.) shall be protected, where possible, with a password protected screensaver that will activate after 5 minutes of inactivity. This time period cannot be changed by Users and Users may not disable the screensaver. Activation of the screensaver will not interrupt or disrupt any other activities taking place on the computer (e.g. data processing).
  • All mobile devices (including, but not limited to, laptops, tablets, and smartphones) provided by the Company shall be set to lock, sleep, or similar, after 5 minutes of inactivity, requiring a password, passcode, or other form of log-in to unlock, wake, or similar. Users may not alter this time period.
  • Users may not use any software which may allow outside parties to access the IT Systems without the express consent of the IT Manager. Any such software must be reasonably required by the User for the performance of their job role and must be fully inspected and cleared by the IT Manager.
  • [Users may connect their own devices (including, but not limited to, laptops, tablets, and smartphones) to the Company network[s] subject to the approval of the IT Department. Any and all instructions and requirements provided by the IT Department governing the use of Users’ own devices when connected to the Company network must be followed at all times. Users’ use of their own devices shall be subject to, and governed by, all relevant Company Policies (including, but not limited to, this Policy) while those devices are connected to the Company network or to any other part of the IT Systems. The IT Department shall reserve the right to request the immediate disconnection of any such devices without notice.]

9, Data Storage Security

  • All data, and in particular personal data, should be stored securely using passwords and HTTPS data encryption, as implemented by Podio, the Companies CRM system.
  • Regular backups are taken of all data stored within the Podio at intervals no less than nightly and that such backups are stored at a suitable off-site location. All backups should be encrypted HTTPS data encryption.
  • All data stored electronically on physical media, and in particular personal data, should be stored securely in a locked box, drawer, cabinet, or similar.
  • No personal data should be stored on any mobile device (including, but not limited to, laptops, tablets, and smartphones), whether such device belongs to the Company or otherwise.
  • No data, and in particular personal data, should be transferred to any computer or device personally belonging to a User unless the User in question is a contractor or sub-contractor working on behalf of the Company and that User has agreed to comply fully with the Company’s Data Protection Policy and the GDPR.

10. Data Protection Policy

11. Internet and Email Use

12. Reporting IT Security Breaches

  • All concerns, questions, suspected breaches, or known breaches shall be referred immediately to the IT Department.
  • Upon receiving a question or notification of a breach, the IT Department shall, within 2 days, assess the issue including, but not limited to, the level of risk associated therewith, and shall take any and all such steps as the IT Department deems necessary to respond to the issue.
  • Under no circumstances should a User attempt to resolve an IT security breach on their own without first consulting the IT Department. Users may only attempt to resolve IT security breaches under the instruction of, and with the express permission of, the IT Department.
  • All IT security breaches, whether remedied by the IT Department or by a User under the IT Department’s direction, shall be fully documented.

We are committed to reviewing our policy and procedures annually. This policy was last reviewed in January 2024.