Network Controls Policy

Network Controls Policy

Document Name: Network Controls Policy
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change

Purpose

Immercial Limited applies proportionate controls to protect information, systems and services from compromise through networks.

Immercial operates primarily through managed cloud and SaaS services and does not operate its own corporate data centre or complex on-premises network infrastructure.

Network Security

Immercial will:

• use appropriately secured and supported network services;
• protect business accounts and cloud services using authentication controls, including MFA where supported;
• restrict administrative and privileged access to authorised users;
• use encryption for network communications where supported and appropriate;
• maintain supported devices, browsers and software with security updates applied automatically or promptly;
• prevent unauthorised network services, devices or configurations from being introduced;
• use appropriate firewall and network-security protections provided by operating systems, routers, cloud platforms and service providers;
• report suspected network compromise or unusual activity promptly.

Use of Network Services

Business information and systems must be accessed only through authorised services and accounts.

When using public or shared networks, users must take proportionate precautions and avoid exposing Confidential or Restricted information through insecure services.

Unauthorised attempts to bypass security, access restrictions or network controls are prohibited.

Network Segregation

Immercial applies segregation proportionately through logical separation rather than operating multiple physical networks.

This may include:

• separate user and administrative privileges;
• role-based access;
• separation of production, testing or development environments where applicable;
• restricted access to client, security and administrative information;
• separation provided by cloud and SaaS service providers.

Where segregation is managed by a third-party provider, Immercial relies on the provider’s managed infrastructure while retaining responsibility for access and configuration controls available to Immercial.

External and Cloud Services

Cloud, hosting, API, blockchain and other external network services are subject to proportionate supplier, access, configuration and information-security controls.

Only authorised endpoints, services and credentials may be used for Immercial business activities.

Responsibility and Review

The Directors approve and oversee this policy.

It is communicated to relevant personnel and reviewed annually and following significant changes to networks, cloud services, systems, suppliers, threats or business operations.