Information security policy

Signed 10 March 2025. Part of our ISO/IEC 27001:2022 certified information security management system (certificate 239491). This is the public statement of our policy; the full policy and its sub-policies are controlled documents within our management system.

Policy objective

To protect the information assets that PureNet handles, stores, exchanges, processes and has access to, and to ensure the ongoing maintenance of their confidentiality, integrity and availability.
To ensure controls are implemented that provide protection for information assets and are proportionate to their value and the threats to which they are exposed.
To ensure the organisation complies with all relevant legal, customer and other third-party requirements relating to information security.
To continually improve the organisation’s Information Security Management System (ISMS) and its ability to withstand threats that could potentially compromise information security.

Scope

This policy and its sub-policies apply to all people, processes, services, technology and assets within the scope of our management system. It also applies to all employees or subcontractors of information security critical suppliers who access or process any of the organisation’s information assets.

Core policy

The organisation believes that despite the presence of threats to the security of such information, all security incidents are preventable.

The Directors of PureNet are committed to achieving the objectives detailed in the policy through the following means:

The implementation and maintenance of an ISMS that is independently certified as compliant with ISO 27001:2022;
The systematic identification of security threats and the application of a risk assessment procedure that will identify and implement appropriate control measures;
Regular monitoring of security threats and the testing/auditing of the effectiveness of control measures;
The maintenance of a risk treatment plan that is focused on eliminating or reducing security threats;
The maintenance and regular testing of a Business Continuity Plan;
The clear definition of responsibilities for implementing the ISMS;
The provision of appropriate information, instruction and training so that all employees are aware of their responsibilities and legal duties, and can support the implementation of the ISMS;
The implementation and maintenance of the sub-policies detailed in this policy.

The appropriateness and effectiveness of this policy, and the means identified within it, for delivering the organisation’s commitments will be regularly reviewed by Top Management.

The implementation of this policy and the supporting sub-policies and procedures is fundamental to the success of the organisation’s business and must be supported by all employees and contractors who have an impact on information security as an integral part of their daily work.

Supporting policies

The policy is supported by sub-policies covering: acceptable use of assets; access control; backup; clear desk and clear screen; communication; cryptographic controls; information classification, labelling and handling; mobile devices; physical and environmental security; protection from malware; protection of personal information; suppliers; remote working; use of software; threat intelligence; cloud services security; data masking; data leakage prevention; secure development; web filtering; network security; monitoring activities; and ICT readiness for business continuity.

Reporting a security concern

Our staff report information security incidents internally. If you're outside PureNet and have found a security issue, see reporting a security issue.

Signed on behalf of PureNet’s Board of Directors:
Dr Paul M. Gibson, Group CEO
10 March 2025

Information security policy.

Policy objective

Scope

Core policy

Supporting policies

Reporting a security concern

Cookies