Information Security Policy.

Journi Limited is committed to protecting the confidentiality, integrity and availability of the information entrusted to us. Information security supports our delivery of bespoke software development, digital transformation consultancy and related technology services, and the trust of our clients, colleagues and partners.

This policy establishes the framework for implementing, maintaining and continually improving our Information Security Management System (ISMS).

Scope

This policy applies to Journi’s activities, information assets and systems across all locations where work is performed, including remote working environments. It applies to employees, contractors and relevant third parties who access or handle information or systems under Journi’s control.

It covers client data, source code, intellectual property, operational records and the technology used to develop, deliver and support our services.

Our commitments

We are committed to:

• Protecting information against unauthorised access, disclosure, alteration, loss and destruction.
• Maintaining the availability and resilience of systems and services in line with business needs and contractual commitments.
• Identifying, assessing and treating information security risks using proportionate organisational, technical and human controls.
• Satisfying applicable legal, regulatory, contractual and client-specific information security requirements.
• Providing appropriate resources, training and awareness so that people understand and fulfil their security responsibilities.
• Continually improving the suitability, adequacy and effectiveness of our ISMS.

Information security objectives

This policy provides the framework for setting and reviewing our information security objectives. These address client data protection, regulatory compliance, operational resilience, security awareness and risk management.

Objectives take account of business needs, relevant interested parties’ requirements and risk assessments. They are documented, measurable where practicable, assigned to responsible owners and supported by plans identifying actions, resources and timescales. Progress is monitored and reviewed through our management review process.

Security principles

Our approach is based on:

• Risk-based protection: selecting and reviewing safeguards according to the sensitivity of information and the risks involved.
• Shared responsibility: requiring everyone who handles Journi information to follow applicable security policies and procedures.
• Defence in depth: combining complementary safeguards to reduce the likelihood and impact of security incidents.
• Least privilege: limiting access to legitimate business needs, reviewing permissions and removing access when it is no longer required.
• Appropriate information handling: classifying information and protecting it throughout its creation, use, sharing, storage and disposal.
• Secure service delivery: incorporating security into the design, development, operation and support of our services.
• Prompt reporting: requiring suspected security events, vulnerabilities and incidents to be reported promptly through established channels.

Remote working and asset protection

Company information must be protected wherever work takes place. Our requirements address device encryption, endpoint protection, authentication, secure connections, physical security and the prevention of unauthorised viewing or access.

Personnel must use approved equipment and services, protect credentials, secure unattended devices and follow applicable acceptable-use requirements. Personal equipment used for authorised work must meet Journi’s security requirements.

Lost, stolen or potentially compromised devices and information must be reported immediately. Our response may include restricting access, revoking credentials and remotely securing or wiping devices where appropriate and technically available. Equipment must be returned, and access removed, when no longer authorised.

Responsibilities

Top Management approves this policy, provides appropriate resources and ensures that information security supports Journi’s strategic direction.

The Management System Manager coordinates the ISMS, maintains this policy and reports its performance to Top Management. Technology and operational leaders implement the relevant safeguards within their areas of responsibility. Those responsible for people management support security awareness throughout recruitment, onboarding, role changes and departure.

All personnel and relevant third parties are responsible for following the requirements that apply to their work and reporting security concerns.

Communication and review

This policy is communicated to relevant personnel and made available to interested parties as appropriate. Supporting policies and procedures provide the detailed requirements for its implementation.

The Management System Manager coordinates a review at least annually and following significant organisational, technological, regulatory or security changes. Revisions require Top Management approval and are communicated to affected personnel.

We use risk assessments, monitoring, audits, incidents, corrective actions and management reviews to improve our information security arrangements.