Protection from Malware Policy

Protection from Malware Policy

Document Name: Protection from Malware Policy
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change

Purpose

Immercial Limited applies proportionate technical and user controls to protect business devices, information and cloud services from malware and exploitation of technical vulnerabilities.

Requirements

Immercial will:

• use supported operating systems, software and cloud services;
• maintain built-in or approved anti-malware protections where supported;
• apply security updates and patches automatically or promptly;
• install only authorised software and services;
• restrict administrative privileges to authorised users;
• maintain appropriate browser, email and operating-system security controls;
• avoid opening suspicious links, attachments or downloads;
• not bypass or disable security or malware-protection controls without authorised reason;
• use approved business systems for storage and exchange of information;
• report suspected malware, phishing, compromise or unusual device behaviour promptly.

Potentially compromised devices or accounts must be isolated or access restricted where appropriate until assessed.

Vulnerability Management

Known vulnerabilities are addressed proportionately according to their severity, relevance and available remediation.

Unsupported or materially vulnerable software should be updated, replaced, removed or otherwise risk-treated.

Relevant security weaknesses identified through suppliers, system notifications, incidents or reviews are assessed and acted upon where appropriate.

Incidents

Suspected malware infection or exploitation is treated as an information-security incident and managed under Immercial’s Information Security Incident Procedure.

Responsibility and Review

The Directors approve and oversee this policy.

It is communicated to relevant personnel and reviewed annually and following significant changes to systems, threats, vulnerabilities or operating arrangements.