Remote Working Policy

Remote Working Policy

Document Name: Remote Working Policy
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change

Purpose

Immercial Limited operates primarily through cloud-based systems and supports remote and flexible working. Appropriate security controls must be maintained whenever Immercial or client information is accessed, processed or stored away from Immercial’s normal working locations.

Remote Working Requirements

Personnel working remotely must:

• use authorised devices, accounts, software and cloud services;
• use MFA where supported and keep credentials secure;
• lock devices when unattended and prevent unauthorised viewing or access;
• keep devices physically secure, including when travelling or working in shared locations;
• store business information within approved Immercial systems rather than personal accounts or unauthorised storage;
• handle Confidential and Restricted information in accordance with Immercial’s Information Classification, Labelling & Handling Policy;
• avoid discussing or displaying sensitive information where it may be overheard or viewed by unauthorised persons;
• use appropriately secured internet connections and take additional care when using public or shared networks;
• keep operating systems, software and security protections current;
• minimise physical papers and removable media and keep any such material secure;
• comply with applicable client-specific security requirements when working on client information or premises.

Loss, Incident or Compromise

Loss, theft, suspected compromise, unauthorised access or accidental disclosure involving remote working must be reported promptly and managed under Immercial’s Information Security Incident Procedure.

Working Environment

Immercial does not require a dedicated home office. The working environment must, however, provide a reasonable level of privacy and physical security appropriate to the information being handled.

Responsibility and Review

The Directors approve and oversee this policy.

It is communicated to relevant personnel and interested parties where applicable and reviewed annually and following significant changes to working arrangements, systems, locations or information-security risks.