Cyber Security (Electronic Information And Communications Systems) Policy

Policy statement

1. Our electronic communications systems and equipment are intended to promote effective communication and working practices within the ComponentSource Group, and are critical to the success of our business. Cyber crimes and data theft can negatively impact our reputation and business development and leave data such as financial information, sensitive commercial documents, employee data and customer information unprotected. This policy outlines the standards we require users of these systems to observe, the circumstances in which we will monitor use of these systems and the action we will take in respect of breaches of these standards.
2. We expect all of our electronic and computer facilities to be used in an effective and professional manner and encourage all employees to develop the skills necessary to do so. These facilities are provided by the Company at its own expense for its own business purposes to assist its employees in carrying out their duties effectively. It is the responsibility of each employee to ensure that this technology is used for proper business purposes and in a manner that does not compromise the Company or its employees in any way.
3. This policy applies to the use of Company technology whilst at work, including remote working, and also when using Company technology from outside work e.g. when dialling in from home, using a Company laptop when away on business and when using smartphones or personal digital assistants (PDAs). This policy document is to be read in conjunction with the Disciplinary Rules and the Disciplinary Procedure. If you have any questions about the application of this policy, please contact either the Chief Technology Officer or the Financial Director.
4. Misuse of the Internet or email can expose both you and the Company to legal or financial liability. For example, you may enter into unintended contracts, breach copyright or licensing arrangements, incur liability for defamation or harassment or introduce viruses into the system. This policy is designed to safeguard both you and the Company from such liabilities. It is important that you read it carefully and ensure that any use of the Internet or email is in accordance with its terms.
5. This policy applies to your personal use of email or the Internet where you identify yourself as associated with ComponentSource. We may modify this policy from time to time to take account of changes in technology, law and best practice.
6. The Chief Technology Officer is responsible for the monitoring and implementation of this policy. If you have any questions about the content of this policy or other comments you should contact the Chief Technology Officer.
7. This policy does not form part of any employee's contract of employment and it may be amended at any time.

Who is covered by the policy?

1. This policy covers all individuals working at all levels, including senior Managers, officers, Directors, employees, consultants, contractors, trainees, homeworkers, part-time and fixed- term employees, casual and agency staff (collectively referred to as employees in this policy).
2. Third parties who have access to our electronic communication systems and equipment are also required to comply with this policy.

The scope and purpose of the policy

1. The purpose of this policy is to protect ComponentSource data and infrastructure, outline the protocols and guidelines that govern our cyber security measures, define the rules for Company and personal use and the disciplinary consequences of non-compliance.
2. This policy deals mainly with the use (and misuse) of computer equipment (directly, or via remote access), e-mail, the internet (including excessive personal use of Internet searching and use of social media, except in connection with authorised ComponentSource PR activities), telephones, smartphones, USB sticks, personal digital assistants (PDAs) and voicemail, but it applies equally to the use of fax machines, copiers, scanners, CCTV, and electronic key fobs and cards.
3. All employees are expected to comply with this policy at all times to protect our electronic communications systems and equipment from unauthorised access and harm. Breach of this policy may be dealt with under our Disciplinary Procedure and, in serious cases, may be treated as gross misconduct leading to summary dismissal.

Personnel responsible for implementation of the policy

1. The ComponentSource board of directors (the board) has overall responsibility for the effective operation of this policy, but has delegated day-to-day responsibility for its operation to the Chief Technology Officer. Responsibility for monitoring and reviewing the operation of this policy and making any recommendations for change to minimise risks to our operations also lies with The Chief Technology Officer.
2. The IT Department will deal with requests for permission or assistance under any provisions of this policy, subject to their primary tasks of maintaining our core systems, and may specify certain standards of equipment or procedures to ensure security and compatibility.
3. All Managers have a specific responsibility to operate within the boundaries of this policy, ensure that all employees understand the standards of behaviour expected of them and to take action when behaviour falls below its requirements.
4. All employees are responsible for the success of this policy and should ensure that they take the time to read and understand it. Any misuse of our electronic communications systems or equipment should be reported to the Chief Technology Officer or to the Financial Director. Questions regarding the content or application of this policy should be directed to the Chief Technology Officer.

Equipment security and passwords

1. Employees are responsible for the security of the equipment allocated to or used by them, and must not allow it to be used by anyone other than in accordance with this policy.
2. When given access to the e-mail system or to the internet, employees are responsible for the security of their terminals. If leaving a terminal unattended or on leaving the office they should ensure that they lock their terminal or log off to prevent unauthorised users accessing the system in their absence.
3. Desktop PCs and cabling for telephones or computer equipment should not be moved or tampered with without first consulting the IT Department.
4. Passwords are unique to each user and must be changed regularly to ensure confidentiality. Passwords must be kept confidential and must not be made available to anyone else. Good practice requires choosing passwords with a minimum 8 characters and a combination of upper and lower case letters, numbers, and (ideally) symbols. Passwords should be remembered and not written down, but if they must be written somewhere that document must be kept confidential and destroyed when no longer required. For the avoidance of doubt, on the termination of your employment (for any reason) you must provide details of your passwords to the Chief Technology Officer or to the Financial Director and return any equipment, key fobs or cards.
5. If you have been issued with a laptop or smartphone you must ensure that it is kept secure at all times, especially when travelling. Passwords must be used to secure access to data kept on such equipment to ensure that confidential data is protected in the event of loss or theft. You should also be aware of the possibility that when using equipment away from ComponentSource premises, documents may be read by third parties, for example, passengers on public transport, and you must take all necessary steps to avoid this.

Systems and data security

1. You must not delete, destroy or modify existing systems, programs, information or data which could have the effect of harming our business or exposing it to risk.
2. You must not download or install software from external sources without authorisation from the Chief Technology Officer. This includes software programs, instant messaging programs, screensavers, photos, video clips and music files. Incoming files and data will be virus- checked by the IT Department before they can be downloaded. And you must not access any of the following or similar from the network: online radio, audio and video streaming, instant messaging and webmail (such as Hotmail, WhatsApp or Yahoo) or social networking sites (such as Facebook, Instagram, YouTube, Twitter).
3. Confidential data includes, but is not limited to:
   • Unreleased financial information
   • Customer, supplier, partner and shareholder information
   • Employee information
   • Customer lists, sales leads and related data
   • Passwords
   • Contracts
   • Legal and business records

   The transferring of data, whether internally or to external recipients, carries additional security risks. Employees must therefore:

   1. Refrain from transferring confidential information to unauthorized employees or to outside parties;
   2. Only transfer confidential data over the ComponentSource network;
   3. Ensure all necessary authorisations for data transfer have been obtained;
   4. Verify that any recipient outside the Company itself has appropriate security measures in place;
   5. Comply with the ComponentSource Data Protection Policy;
   6. Immediately alert the Chief Technology Officer to any actual or suspected privacy breaches, hacking attempts, malicious software and/or scams.
4. No device or equipment should be attached to our systems without the prior approval of the IT Department. This includes any USB flash drive, MP3 or similar device, PDA or telephone. It also includes use of the USB port, infra-red connection port or any other port. Similarly, employees should not seek to access ComponentSource systems and accounts from devices owned by others, or lend their own Company devices to anyone else without the prior approval of the Chief Technology Officer.
5. We monitor all e-mails passing through our system for viruses. Employees must exercise caution when opening e-mails from unknown external sources or where, for any reason, an e- mail appears suspicious (for example, if its name ends in .exe or .ran). The IT Department should be informed immediately if a suspected virus is received. We reserve the right to block access to attachments to e-mails for the purpose of effective use of the system and for compliance with this policy. We also reserve the right not to transmit any e-mail message.
6. You should not attempt to gain access to restricted areas of the network, or to any password- protected information, unless specifically authorised.
7. 7. Employees using laptops or wi-fi enabled equipment must be particularly vigilant about its use outside the office and take any precautions required by the IT Department from time to time against importing viruses or compromising the security of the system. The system contains information which is confidential to our business and/or which is subject to data protection legislation. Such information must be treated with extreme care and in accordance with our Data Protection Policy.

E-mail etiquette and content

1. E-mail is a vital business tool, but an informal means of communication, and should be used with great care and discipline. You should always consider if e-mail is the appropriate means for a particular communication and correspondence sent by e-mail should be written as professionally as a letter or fax. Our standard disclaimer should always be included. Hard copies of any e-mails containing contractual terms or amendments, or containing dispute- related correspondence (in or out) should be kept on the appropriate file.
2. E-mail, just like any other form of communication, should reflect the highest professional standards at all times. You should keep messages brief and to the point, ensure that an appropriate heading is inserted in the subject field and that the spelling and grammar are carefully checked before sending. You should also double check the recipient before pressing the send button – not only can it be embarrassing if a message is sent to the wrong person, it can also result in the unintentional disclosure of confidential information about the Company.
3. You should ensure that you access your e-mails at least once every working day, stay in touch by remote access when travelling and use an out of office response when away from the office for more than a day. You should endeavour to respond to e-mails marked "high priority" within one working day.
4. You must not send abusive, obscene, discriminatory, racist, harassing, derogatory or defamatory e-mails. If you feel that you have been harassed or bullied, or are offended by material received from a colleague via e-mail you should inform your line Manager or the Financial Director.
5. E-mails leave a retrievable record and you should always take care with the content of e-mail messages. You must assume that e-mail messages may be read by others and not include anything which would offend or embarrass any reader, or yourself, if it found its way into the public domain.
6. E-mail messages may be disclosed in legal proceedings in the same way as paper documents. Incorrect or improper statements can give rise to claims for discrimination, harassment, defamation, breach of confidentiality or breach of contract. Deletion from a user's inbox or archives does not mean that an e-mail cannot be recovered for the purposes of disclosure and all e-mail messages should be treated as potentially retrievable, either from the main server or using specialist software.
7. In general, you should not:
   • send or forward private e-mails at work which you would not want a third party to read;
   • send or forward chain mail, junk mail, cartoons, jokes or gossip;
   • contribute to system congestion by sending trivial messages or unnecessarily copying or forwarding e-mails to those who do not have a real need to receive them;
   • sell or advertise using our communication systems or broadcast messages about lost property, sponsorship or charitable appeals without the approval of the Financial Director;
   • agree to terms, enter into contractual commitments or make representations by e- mail unless you have, or you have obtained, the appropriate authority. A name typed at the end of an e-mail is a signature in the same way as a name written at the end of a letter;
   • download or e-mail text, music and other content on the internet subject to copyright protection, unless it is clear that the owner of such works allows this;
   • send messages from another employee's computer or under an assumed name or via a virtual private network (VPN) unless specifically authorised; or
   • use e-mails or the internet or any other means of external communication which are known not to be secure to send highly confidential or sensitive or personal content.

   You should never assume that internal or external messages are necessarily private and confidential, even if marked as such. The Internet is not a secure means of communication and third parties may be able to access or alter messages that have been sent or received. So do not send any information in an email which you would not be happy being publicly available. The confidentiality of internal communications can only be ensured if they are sent by internal post or delivered personally by hand or included in a password protected online document.

8. If you receive a wrongly-delivered e-mail you should return it to the sender at the first opportunity and not retain, copy or disclose it in any way, except that if the e-mail contains inappropriate material (as described above) you should report this to the Chief Technology Officer.

Use of the internet

1. When a website is visited, devices such as cookies, tags or web beacons may be employed to enable the site owner to identify and monitor visitors. If the website is of a kind described in paragraph 10.11.2 below, such a marker could be a source of embarrassment to the visitor and us, especially if inappropriate material has been accessed, downloaded, stored or forwarded from the website. Such actions may also, in certain circumstances, amount to a criminal offence if, for example, the material is pornographic in nature. This is further considered under Inappropriate use of equipment and systems at paragraph 10.11 below.
2. You should therefore not access any web page or any files (whether documents, images or other) downloaded from the internet which could, in any way, be regarded as illegal, offensive, in bad taste or immoral. While content may be legal in the UK, it may be in sufficient bad taste to fall within this prohibition. As a general rule, if any person (whether intended to view the page or not) might be offended by the contents of a page, or if the fact that our software has accessed the page or file might be a source of embarrassment if made public, then viewing it will be a breach of this policy.
3. You must not under any circumstances use ComponentSource systems to participate in any internet chat room, post messages on any internet message board or set up or log text or information on a blog or wiki, even in your own time. Exceptionally, specific permissions may be granted to relevant employees to access and post on social media in connection with and solely for the purposes of promoting ComponentSource and its business.

Personal use of systems

1. We permit the incidental use of internet, e-mail and telephone systems to send personal e- mail, browse the internet and make personal telephone calls subject to certain conditions set out below. Personal use is a privilege and not a right. It must be neither abused nor overused and we reserve the right to withdraw our permission at any time.
2. The following conditions must be met for personal usage to continue:
   1. use must be minimal and take place substantially out of normal working hours (that is, during lunch hours, before 9 am or after 5.30 pm), except in cases of emergency;
   2. personal e-mails must be labelled "personal" in the subject header;
   3. use must not interfere with business or office commitments;
   4. use must not commit us to any marginal costs; and
   5. use must comply with our policies including the Equal Opportunities Policy, Anti- Harassment and Anti-Bullying Policy, Data Protection Policy and Disciplinary Procedure (see paragraph 10.7 above, E-mail etiquette and content, and paragraph 10.8 above, Use of the internet).
3. You should be aware that personal use of our systems may be monitored (see paragraph 10.9.10 below) and, where breaches of this policy are found, action may be taken under our Disciplinary Procedure. We reserve the right to restrict or prevent access to certain telephone numbers or internet sites if we consider personal use to be excessive.
4. You are not entitled to arrange for any personal mail to be addressed to you at ComponentSource. We have no way of knowing that particular mail may not relate to the Company’s business and all mail which comes in is opened as a matter of course. This applies even to mail which is marked ‘personal’ and/or ‘private and confidential’.
5. Mobile telephones: If you are provided with a mobile or car telephone, this is to be used principally for business telephone calls only. If the telephone is used for private telephone calls, we reserve the right to require you to reimburse the cost of these calls. You should take care of the telephone and ensure it is secure at all times. In the event that it is stolen you should notify your line Manager or the Financial Director immediately. In the absence of both of them you should take all reasonable steps to ensure that the telephone is disconnected by the service provider. The mobile telephone and any accessories should be returned immediately if this is requested by your line Manager or on the termination of your employment.

Monitoring of use of systems

1. Our systems enable us to monitor telephone, e-mail, voicemail, internet and other communications. For business reasons, and in order to carry out legal obligations in our role as an employer, use of our systems including the telephone and computer systems, and any personal use of them, is able to be continually monitored. Monitoring is only carried out to the extent permitted or as required by law and as necessary and justifiable for business purposes.
2. CCTV systems monitor the exteriors of our buildings 24 hours a day. This data is recorded.
3. We reserve the right to retrieve the contents of messages or check searches which have been made on the internet for the following purposes (this list is not exhaustive):
   • to monitor whether the use of the e-mail system or the internet is legitimate and in accordance with our policies;
   • to find lost messages or to retrieve messages lost due to computer failure;
   • to assist in the investigation of wrongful acts, or
   • to comply with any legal obligation.

Inappropriate use of equipment and systems

1. Access is granted to the internet, telephones and other electronic systems for legitimate business purposes only. Incidental personal use is permissible provided it is in full compliance with our rules, policies and procedures (including this policy, the Equal Opportunities Policy, Anti-Harassment and Anti-Bullying Policy, Data Protection Policy and Disciplinary Procedure). See paragraph 9.9 above, Personal use of systems.
2. Misuse or excessive use or abuse of our telephone or e-mail system, or inappropriate use of the internet in breach of this policy will be dealt with under our Disciplinary Procedure. Misuse of the internet can, in certain circumstances, constitute a criminal offence. In particular, misuse of the e-mail system or inappropriate use of the internet by participating in online gambling or chain letters or by creating, viewing, accessing, transmitting or downloading any of the following material will amount to gross misconduct (this list is not exhaustive):
   • pornographic material (that is, writing, pictures, films and video clips of a sexually explicit or arousing nature);
   • offensive, obscene, or criminal material or material which is liable to cause embarrassment to us or to our customers;
   • a false and defamatory statement about any person or organisation;
   • material which is discriminatory, offensive, derogatory or may cause embarrassment to others;
   • confidential information about us or any of our employees or customers (which you do not have authority to access);
   • any other statement which is likely to create any liability (whether criminal or civil, and whether for you or us); or
   • material in breach of copyright.
3. Any such action will be treated very seriously and is likely to result in summary dismissal.
4. Where evidence of misuse is found we may undertake a more detailed investigation in accordance with our Disciplinary Procedure, involving the examination and disclosure of monitoring records to those nominated to undertake the investigation and any witnesses or Managers involved in the Disciplinary Procedure. If necessary such information may be handed to the police in connection with a criminal investigation.

Monitoring and review of this policy

1. The Chief Technology Officer, in conjunction with the Financial Director, is responsible for reviewing this policy periodically to ensure that it meets legal requirements and reflects best practice.
2. The Financial Director has responsibility for ensuring that any person who may be involved with administration or investigations carried out under this policy has or receives appropriate training and/or instruction to enable them to carry out these duties.
3. Employees are invited to comment on this policy and suggest ways in which it might be improved by contacting either the Chief Technology Officer or the Financial Director.

Disaster Recovery Plan

1. The Chief Technology Officer (CTO) is responsible for creating, implementing and maintaining an adequate Disaster Recovery Plan for the Company’s business, namely the ability to restore access and functionality to the Company’s IT infrastructure after a disaster event, whether natural or caused by human action or error, to ensure that critical business functions are operational as soon as possible after a disruptive event occurs.
2. Maintenance requires the proper replication and backing up of data and IT infrastructure to specific restore points in order to regain functionality and control over systems that become infected, breached, or rendered inoperable for any reason.
3. The CTO periodically conducts disaster recovery tests to help identify any weaknesses or gaps in the Company’s Disaster Recovery Plan and to ensure that the strategic processes in place will effectively restore critical systems and data in the event of an incident, enabling the Company to regain control over its IT systems.
4. Cybersecurity is an increasingly common area where disaster recovery is critical to handling threats. It can take many forms, including phishing, hacking, ransomware, malware, service interruption or denial and insider attacks. ComponentSource has developed a Cyberattack Response Procedure as an integral part of its Disaster Recovery Plan. This Procedure addresses the detection, assessment and response to cyberattacks that threaten the confidentiality, integrity or availability of its systems and data and aims to ensure that all such incidents are handled swiftly, lawfully and transparently, minimising harm to the business, its customers and data subjects.

Cyberattack Response Procedure

1. This Procedure applies to all employees, contractors and third parties with access to ComponentSource IT systems, networks, cloud platforms or data (including personal data).
2. As well as their operational and commercial impact, cyberattacks can also trigger duties under several applicable laws and regulations, including for example, EU and UK GDPRs, computer misuse legislation, money laundering legislation, California Consumer Privacy laws (CCPA) and the EU-US Data Privacy Framework including UK Extension to the DPF.
3. ComponentSource will maintain strong defence measures in order to minimise the risk of cyberattacks, including network firewalls, intrusion detection systems, patch and vulnerability management programmes, multi-factor authentication, regular penetration testing and staff awareness training.
4. Timely detection and accurate reporting of potential cyberattacks are essential to limiting harm and all employees, contractors or other parties working on behalf of the Company are required to remain alert to signs of unusual system, network or user behaviour and to report any suspected indicators immediately to the CIO. Indicators of a possible cyberattack include abnormal system and network behaviour, sudden or unexplained system shutdowns, crashes or reboots, unusually high network traffic (especially outside normal working hours), unauthorised configuration changes or disabled firewall settings, files becoming locked or inaccessible with unfamiliar extensions or unexplained deletion of alteration of logs or system configurations.

   Other indicators can include multiple failed login attempts, logins from unexpected geographic locations, creation of unexpected new accounts, unsolicited or suspicious emails, defaced or altered website content, customers reporting pop-ups or redirects, unexplained data deletions and persistent sluggish performance, overheating, resource spikes or connection of unauthorised devices to corporate systems.

5. If a cyberattack is suspected by an employee, contactor or other party working on behalf of the Company they must stop their use of Company systems and NOT seek to investigate independently without express prior authorisation and instructions from the CIO. Any evidence should be preserved and not deleted, with screenshots being taken where possible.

   
   Reports of suspected cyberattacks should include a clear description of what was observed, date and time of the occurrence, systems and/or applications and/or data affected, any recent actions performed by the user (e.g. downloads, emails opened, websites visited).

   If an incident is considered to pose an operational or regulatory risk, it should also be reported to the DPM.

6. The response procedure upon the identification of a confirmed or suspected cyberattack is:
   1. Classify the incident as low, medium, high or critical as follows:

      Classification	Description	Typical Examples
      Low	Minor or localised disruption, quickly contained with no data compromise	Localised malware, isolated phishing attempt
      Medium	Disruption with potential data exposure or operational impact; further analysis required	Compromised credentials, unauthorised access to non-personal data
      High	Confirmed or suspected data breach, ransomware infection, or significant operational disruption	System-wide malware outbreak, data infiltration, denial-of-service attack
      Critical	Major incident affecting essential systems, large-scale data loss, or national regulatory impact	Catastrophic service outage, confirmed personal data breach of high risk to individuals

   2. For incidents classified as Medium or above, the CIO will initiate containment measures, which may include isolating affected systems or devices from the network, revoking compromised credentials, blocking known malicious Ips or domains, disabling remote access or integrations if compromise is suspected, ensuring no evidence is destroyed during this containment phase.
   3. Conduct an initial investigation to determine things such as timeline, systems affected, nature and sensitivity of data involved, collecting evidence and copies of logs, images and artefacts for secure storage referenced under the incident’s unique reference number.
   4. Escalate to appropriate senior management including the CFO and the CEO, who will determine (with legal advice if necessary) whether external notifications are required, such as the UK Information Commissioner’s office, law enforcement authorities, and as required by contract. If a personal data breach has occurred the DPM will evaluate and document the incident in the Company’s Data Breach Register. If there is high risk to the rights of individual data subjects the DPM will inform affected data subjects without undue delay as required by the EU and UK GDPRs. All external reporting will be documented with reference numbers, submission dates and responsible personnel.
   5. Following containment and investigation the CIO will manage an Eradication phase to ensure that all malicious code, backdoors, or unauthorised accounts are removed.

      
      Recovery will restore normal operations through verification of system integrity and patching, restoration from clean verified backups, validation testing to confirm systems are secure before reconnecting to the network, and ongoing monitoring for recurrence for a defined post-incident period (e.g. 30 days).

   6. The CIO will conduct a post-incident Review, convening a Review meeting, to evaluate the response effectiveness and communication, identify procedural or technical gaps, agree improvement actions and assignment of responsibilities and update relevant policies and training as needed.
   7. Information relating to any cyberattack or investigation is strictly confidential, with disclosure limited to authorised personnel and, where required, regulatory and law-enforcement bodies. Unauthorised sharing of incident details, internally or externally, will be treated as a disciplinary matter.
   8. The following table describes the Record Keeping which should be established and maintained, as applicable to individual cybersecurity incidents:

      Record Type	Purpose/Description	Minimum Retention Period	Responsible Team/Role	Disposal or Review Method
      Incident Reports and Notifications	Initial and follow-up reports submitted via the Cyberattack Reporting Procedure, including internal alerts and external notifications to regulators, insurers, or law enforcement.	6 years from closure or final contact.	Eg CIO or DPM	Secure destruction or anonymisation post-retention; extend if proceedings continue.
      Incident Response Reports and Case Files	Full documentation of cyber or data security incidents.	6 years from date of incident or closure.	Eg DPM	Secure destruction or anonymisation post-retention period; retain longer if legal action is ongoing.
      Containment and Recovery Logs	Records of immediate containment, isolation, and recovery measures (e.g. network segmentation, credential resets, patching).	6 years from incident closure.	Eg CIO	Secure deletion after review; extend where analysis or follow-up required.
      Investigation and Analysis Notes	Forensic investigation materials, timelines, and analyst notes documenting attack vector, scope, and impact.	6 years	Eg CIO	Secure destruction or anonymisation after retention.
      Forensic Artefacts and Evidence Images	Disk images, packet captures, malware samples, and other evidential artefacts preserved for potential legal or regulatory use.	6 years or until all matters concluded (whichever longer).	Eg DPM	Cryptographic wipe under chain-of-custody supervision; destruction logged.
      Incident Register	Master log of all incidents, classifications, actions, decisions, and outcomes.	Permanent record (retain indefinitely or archive after 10 years).	Eg DPM	Secure archival storage; periodic review every 5 years.
      External Communications (Customers, Regulators, Insurers, Law Enforcement)	Official notices, correspondence, and press statements related to the incident.	6 years.	Eg DPM	Secure destruction post-retention; extend if proceedings ongoing.
      Third-Party Communications and Contracts	Supplier and partner correspondence, SLAs, and remediation or forensic vendor documentation.	6 years after incident resolution / contract termination.	Eg Legal Counsel	Secure deletion or anonymisation post-retention.
      Post-Incident Review Reports and Improvement Plans	Lessons-learned documentation, review minutes, and corrective-action tracking following incident closure.	6 years.	Eg DPM	Secure deletion or anonymisation after retention; archive summary for audit trail.
      Audit and Compliance Reports (Security, Technical, Governance)	Independent or internal audit reports confirming control effectiveness or remediation.	6 years from report date.	Eg DPM	Secure destruction or anonymisation after retention period.
      System and Network Logs	Logs evidencing system activity, intrusion detection, and forensic reconstruction.	12 months minimum (extend for investigations).	Eg CIO	Secure deletion or anonymisation following review and closure.
      Access Control and Authentication Logs	User log-ins, privilege changes, and access attempts for accountability verification.	12 months.	Eg CIO	Secure deletion or anonymisation; extend where required for analysis.
      Backup and Recovery Logs	Confirmation of backup success, integrity, and restoration testing.	6–12 months depending on system criticality.	Eg CIO	Secure deletion / overwrite after scheduled rotation.
      Cybersecurity Training and Awareness Records	Evidence of completion of training and awareness programmes for all staff and contractors.	Duration of employment + 6 years.	Eg CFO	Secure destruction post-retention; extend for legal / disciplinary cases.
      Disciplinary and Employee Investigation Records (Cybersecurity Related)	Employee investigations into misuse, negligence, or policy breach.	Duration of employment + 6 years.	Eg CFO	Secure destruction or anonymisation post-retention; extend if active case.
      Security Awareness Testing and Phishing Simulations	Results of staff testing to measure cyber awareness and resilience.	3 years.	Eg CFO, DPM, CIO	Secure deletion or anonymisation after retention.
      Simulation Results	Records from incident-response simulations or readiness exercises.	3 years.	Eg CIO	Secure deletion after retention; retain summaries for training records.
      Insurance Claims and Correspondence	Notifications, claim forms, and insurer communications arising from a cyber incident.	6 years from claim closure.	Eg Legal Counsel	Secure destruction post-retention; extend if dispute continues.
      Financial and Sanctions Checks (SAMLA 2018)	Evidence of sanctions and AML checks performed before authorising payments (e.g. ransomware or vendor fees).	6 years.	Eg Legal Counsel	Secure destruction after retention; retain audit confirmation.
      Terrorism Act 2000 / Proceeds of Crime Act 2002 Reports	Records of Suspicious Activity Reports or communications with NCA under terrorism or proceeds-of-crime legislation.	6 years from submission or closure.	Eg Legal Counsel	Secure archival storage; destruction after retention with NCA clearance.
      Legal Advice and Opinions	External or internal legal advice obtained during incident response.	6 years from closure.	Eg Legal Counsel	Secure destruction post-retention; retain privileged copies with secure access

CSCSP 10/2025