1. Introduction
Andrew Laws Associates Ltd, trading as Yeseo.io, is committed to protecting the confidentiality, integrity, and availability of all information assets. This policy outlines our approach to information security and the measures we take to safeguard our data and systems.
2. Purpose
The purpose of this policy is to:
- Protect our company’s information assets from unauthorized access, use, disclosure, disruption, modification, or destruction
- Ensure compliance with relevant UK laws and regulations, including the Data Protection Act 2018 and UK GDPR
- Maintain client trust and protect their confidential information
- Minimize the risk of security incidents and data breaches
3. Scope
This policy applies to all employees, contractors, and third parties who have access to Andrew Laws Associates Ltd’s information systems and data.
4. Information Classification
We classify our information into the following categories:
- Public: Information that can be freely shared (e.g., content on our public website)
- Internal: Information for internal use only (e.g., internal communications)
- Confidential: Sensitive information that requires protection (e.g., client data, SEO strategies)
- Restricted: Highly sensitive information with strict access controls (e.g., financial records)
5. Access Control
- Access to information systems and data is granted on a need-to-know basis
- All users must have unique login credentials
- Multi-factor authentication is required for accessing critical systems
- Regular access reviews will be conducted to ensure appropriate permissions
6. Data Protection
- Personal data must be processed in accordance with the UK GDPR and Data Protection Act 2018
- Data protection impact assessments (DPIAs) will be conducted for high-risk processing activities
- Data retention periods will be defined and enforced
- Secure disposal methods will be used for all confidential information
7. Physical Security
- Office access at 7 Bailey Close, Ipswich, Suffolk, IP2 0UD is restricted to authorized personnel only
- Visitors must sign in and be escorted at all times
- All devices containing sensitive information must be secured when unattended
8. Network Security
- Firewalls and intrusion detection systems will be implemented and maintained
- Regular vulnerability scans and penetration tests will be conducted
- All network traffic will be monitored and logged
9. Device and Software Security
- All devices must have up-to-date antivirus software installed
- Operating systems and applications must be kept current with security patches
- Only authorized software may be installed on company devices
10. Incident Response
- All security incidents must be reported immediately to Andrew Laws or the designated security officer
- An incident response plan will be maintained and regularly tested
- Lessons learned from incidents will be used to improve our security measures
11. Business Continuity and Disaster Recovery
- A business continuity plan will be maintained and regularly tested
- Critical data will be backed up regularly and stored securely off-site
12. Training and Awareness
- All employees will receive regular information security awareness training
- Security policies and procedures will be clearly communicated to all staff
13. Third-Party Management
- Third-party service providers must comply with our security requirements
- Regular security assessments of third parties will be conducted
14. Compliance and Auditing
- Regular internal audits will be conducted to ensure compliance with this policy
- External audits may be performed to validate our security controls
15. Website and Online Services
- Our website (https://yeseo.io) will adhere to security best practices
- Comments and user data will be protected as outlined in our Privacy Policy
- Embedded content will be monitored for potential security risks
- Cookies will be used in compliance with relevant regulations and our Privacy Policy
16. Policy Review
This policy will be reviewed annually or when significant changes occur to ensure its continued suitability, adequacy, and effectiveness.
17. Enforcement
Failure to comply with this policy may result in disciplinary action, up to and including termination of employment or contract.
Approved by: Andrew Laws, Director Date: March 25, 2025 Next review date: March 25, 2026
