Configuration Management Policy

Configuration Management Policy

Document Name: Configuration Management Policy
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change

Immercial Limited maintains proportionate configuration controls for hardware, software, cloud services and networks used to support its business activities.

Immercial will:

• use supported and appropriately configured business devices, software and cloud services;
• apply secure default settings and enable security features such as MFA, screen locking, encryption and automatic security updates where supported;
• restrict administrative privileges and configuration changes to authorised users;
• install only authorised software and services;
• record significant assets and systems within the Information Asset Register;
• assess significant configuration or system changes for information-security and operational impact before implementation;
• apply updates and security patches automatically or promptly where appropriate;
• review significant configuration changes and resolve identified weaknesses;
• Where a change produces an unintended or adverse effect, the impact will be assessed and appropriate corrective, rollback or risk-treatment action taken.
• retain relevant evidence of material changes where proportionate to the risk.

Immercial operates primarily through managed cloud and SaaS services. Where configuration is controlled by a service provider, Immercial relies on the provider’s managed controls while retaining responsibility for configuration options available to Immercial.

Software Installation and Management
Software may only be installed on Immercial operational systems where it is authorised, supported and required for a legitimate business purpose. Installation requiring administrative privileges is restricted to authorised users. Software must be obtained from trusted sources, maintained with appropriate security updates, and removed when unsupported, no longer required or considered unsuitable. Material new software or services are considered for information-security and operational risk before use.

The Directors approve and oversee this policy. It is communicated to relevant personnel and reviewed annually and following significant technological, security or operational change.