Threat Intelligence Policy

Threat Intelligence Policy

Document Name: Threat Intelligence Policy
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change

Purpose

Immercial Limited maintains proportionate awareness of developing information-security threats relevant to its business, systems, suppliers and services.

Threat intelligence is used to support risk assessment, vulnerability management, incident response, supplier oversight and security improvement.

Threat Intelligence Sources

Immercial obtains relevant threat information from proportionate and authoritative sources, including:

• the UK National Cyber Security Centre (NCSC);
• security advisories and service notifications from key technology and cloud suppliers;
• relevant professional, industry and security communities or associations;
• publicly available vulnerability and security information;
• relevant platform and ecosystem sources, including Algorand security and protocol developments where applicable to IMME Verified and associated services.

The NCSC specifically recommends using authoritative sources such as national authorities, vendors and industry groups when assessing threats. National Cyber Security Centre

Authorities and Specialist Contacts

Immercial maintains awareness of appropriate reporting and advisory routes, including the NCSC and other relevant authorities or regulators where applicable.

Relevant professional bodies, supplier communities and specialist security forums may also be used where proportionate to the risk and service involved.

Collection and Review

Relevant threat information is reviewed proportionately by a Director.

Priority is given to threats affecting:

• Microsoft 365 and cloud services;
• business devices and accounts;
• website, hosting and domain services;
• client and personal information;
• AI and API services;
• cryptographic credentials and IMME Verified;
• Algorand MainNet and associated blockchain tooling;
• critical suppliers and software dependencies.

NCSC guidance also encourages organisations to remain informed through defender communities and intelligence-sharing sources. National Cyber Security Centre

Assessment and Action

Where a relevant threat is identified, Immercial considers:

• whether the threat applies to its systems or services;
• likelihood and potential impact;
• existing controls;
• whether configuration, patching or access changes are required;
• whether the Information Security Risk Register should be updated;
• whether supplier, incident-response or continuity action is required.

Material findings and actions are recorded proportionately within existing IMS records.

Incident and Threat Reporting

Significant cyber incidents or relevant threat information may be reported to the NCSC or other appropriate authorities where necessary. The NCSC provides a dedicated cyber-incident reporting route and uses submitted information to improve wider UK threat understanding. NCSC Report

Responsibility and Review

The Directors approve and oversee this policy.

It is reviewed annually and following significant changes to threats, technology, suppliers, services or business operations.