Version date: January 1, 2024
1. Purpose
The purpose of this Policy is to safeguard information belonging to R:BASE Technologies and its
stakeholders (customers, clients, and general public), within a secure environment.
This Policy informs the R:BASE Technologies' staff of the principles governing the holding, use, and
disposal of information.
It is the goal of R:BASE Technologies that:
- Information will be protected against unauthorised access or misuse.
- Confidentiality of information will be secured.
- Integrity of information will be maintained.
- Availability of information is maintained for service delivery.
- Business continuity planning processes will be maintained.
- Regulatory, contractual and legal requirements will be complied with.
- Physical, logical, environmental and communications security will be maintained.
- Infringement of this Policy may result in disciplinary action or criminal prosecution.
- When information is no longer of use, it is disposed of in a suitable manner.
- All information security incidents will be reported and investigated through the appropriate
management channel.
Information relates to:
- Electronic information systems (software, computers, and peripherals) owned by R:BASE
Technologies whether deployed or accessed on or off site.
- The R:BASE Technologies internal networks used either directly or indirectly.
- Hardware, software, and data owned by R:BASE Technologies.
- Paper-based materials.
- Electronic recording devices (video, audio).
2. The Policy
The R:BASE Technologies requires all users to exercise a duty of care in relation to the operation
and use of its information systems.
2.1 - Authorised users of information systems
With the exception of information published for public consumption, all users of R:BASE Technologies
information systems must be formally authorised by appointment as a member of staff. Authorised
users will be in possession of a unique user identity. Any password associated with a user identity
must not be disclosed to any other person. The Network password policy describes these principles in
greater detail.
Authorised users will pay due care and attention to protect R:BASE Technologies information in their
personal possession. Confidential, personal or private information must not be copied or transported
without consideration of:
- permission of the information owner
- the risks associated with loss or falling into the wrong hands
- how the information will be secured during transport and at its destination.
2.2 - Acceptable use of information systems
Use of the R:BASE Technologies' information systems by authorised users will be lawful, honest and
decent and shall have regard to the rights and sensitivities of other people. The detail of
acceptable use in specific areas may be found in the list of subsidiary policies detailed in the
Appendix.
2.3 - Information System Owners
R:BASE Technologies staff who are responsible for information systems are required to ensure that:
- Systems are adequately protected from unauthorised access.
- Systems are secured against theft and damage to a level that is cost-effective.
- Adequate steps are taken to ensure the availability of the information system, commensurate with
its importance (Business Continuity).
- Electronic data can be recovered in the event of loss of the primary source, i.e. failure or
loss of a computer system. It is incumbent on all system owners to backup data and to be able to
restore data to a level commensurate with its importance (Disaster Recovery).
- Data is maintained with a high degree of accuracy.
- Systems are used for their intended purpose and that procedures are in place to rectify
discovered or notified misuse.
- Any electronic access logs are only retained for a justifiable period to ensure compliance with
the data protection, investigatory powers and freedom of information acts.
2.4 - Personal Information
Authorised users of information systems are not given rights of privacy in relation to their use of
R:BASE Technologies' information systems. Authorised R:BASE Technologies staff may access or monitor
personal data contained in any information system (email, web access logs, file-store, etc).
Individuals in breach of this policy are subject to disciplinary procedures at the discretion of
management, including referral to the Police where appropriate.
R:BASE Technologies will take legal action to ensure that its information systems are not used by
unauthorised persons.
3. Ownership
The Director of Information Systems has direct responsibility for maintaining this policy and
providing guidance and advice on its implementation.
Information system owners are responsible for the implementation of this Policy within their area,
and to ensure adherence.
If you have any inqueries regarding this security policy, you can contact R:BASE Technologies at
services@rbase.com.
