Resources

Resources

Trust Centre

  • P3 Audit Business Continuity Plan

    P3 Audit Business Continuity Plan


    Section I: Introduction


    1.1 How to Use This Plan


    This plan is intended to guide P3 Audit’s response in the event of a disaster that impacts our ability to deliver services. The responsible individuals will use this plan to coordinate the recovery of business functions across departments. It contains or references all necessary information for business recovery.


    1.2 Objectives


    The objective of the Business Continuity Plan (BCP) is to restore and recover critical business functions following a service disruption or disaster, including natural and man-made incidents. These may include fires, floods, power outages, chemical spills, and other threats. The primary goals in a disaster situation are to:

    • Minimise threats and mitigate damage.
    • Ensure the continuation of critical business functions through advanced preparation.
    • Execute documented recovery procedures swiftly and effectively.

    The BCP ensures the protection of sensitive information, such as ePHI (electronic protected health information) and credit card data, in line with legal regulations.


    1.3 Scope


    This plan focuses on the recovery and continuation of P3 Audit’s critical services during severe disruptions. It encompasses procedures for all phases of recovery, as outlined in the Business Continuity Strategy. Temporary disruptions lasting less than critical timeframes are not within this scope.


    1.4 Areas of Responsibility

    • CISO: Reviews and updates the Business Continuity Strategy twice a year, keeping personnel assignments and recovery teams up to date and communicating any plan changes.
    • Management and CISO: Jointly responsible for maintaining the BCP and ensuring its ongoing viability.
    • Plan Testing: Management is responsible for verifying the effectiveness of the BCP through active or passive testing at least semi-annually and ensuring personnel are familiar with the plan via training, awareness programmes, and exercises.

    Section II: Business Continuity Strategy


    2.1 Introduction


    This section outlines the strategy P3 Audit employs to maintain business operations in the event of a service disruption.


    2.2 High Availability Strategy


    P3 Audit utilises cloud-based infrastructure to ensure high availability and business continuity:

    • Data is backed up in multiple locations and hosted in secure cloud environments.
    • Employees have the ability to work remotely or from alternative offices to maintain business continuity during a disaster.

    2.3 RTO/RPO

    • RTO (Recovery Time Objective): 2 hours
    • RPO (Recovery Point Objective): 2 hours

    These parameters guide our recovery processes to ensure minimal disruption to critical services.


    2.4 Recovery Plan Phases


    The recovery process is divided into three phases, executed sequentially:


    1. Disaster Occurrence:


    This phase starts when the disaster occurs and continues until a decision is made to activate the recovery plan. Activities include emergency response, management notification, damage assessment, and disaster declaration.


    2. Plan Activation:


    The BCP is activated, and recovery procedures are put into effect until critical functions are restored. This involves assembling recovery personnel, implementing interim procedures, and re-establishing data communications.


    3. Alternate Environment:


    Once secondary systems are operational, the focus shifts to maintaining business functions until the primary environment is restored.


    Section III: Recovery Procedures


    3.1 Purpose and Objectives


    This section outlines the detailed activities and tasks necessary for recovering business operations, following the strategy in Section II. Recovery is organised by phases, with each phase detailing specific tasks.


    3.2 Recovery Activities and Tasks


    Phase I: Disaster Occurrence


    Activity: Notification of Management


    Responsibility: Senior Management

    Tasks:

    • Notify P3 Audit’s management team of the disaster.
    • Determine next steps for personnel depending on the timing and severity of the disaster.

    Activity: Declaration of Disaster


    Responsibility: Senior Management

    Tasks:

    • Formally declare a disaster if necessary.
    • Gather all relevant facts and assess the impact before declaring a disaster to ensure it is the correct course of action.

    Phase II: Plan Activation


    Activity: Data Backup Plan


    Responsibility: IT Team

    Tasks:

    • Implement necessary procedures to ensure secure backups of sensitive data, including ePHI and credit card information.
    • Periodically test backup processes to ensure up-to-date recovery capability.

    Activity: Emergency Mode Operation Plan


    Responsibility: Senior Management

    Tasks:

    • Implement procedures to maintain critical business operations and protect sensitive data during an emergency mode of operation.
    • Conduct testing to verify the effectiveness of disaster recovery measures and schedules.

    Activity: Working from an Alternate Site


    Responsibility: Senior Management

    Tasks:

    • Enable employees to work from home or another designated office location if required.
    • Employees must notify the CISO and IT Manager of their work location during the disruption.

    Activity: Application and Data Criticality Analysis


    Responsibility: IT Team

    Tasks:

    • Evaluate which applications are necessary to support other contingency plans and ensure their recovery is prioritised.


    Authorised by C Els on 06 November 2024


  • P3 Audit Human Resources Security Policy

    1.0 Purpose


    This policy outlines the procedures for managing a user’s access to information and systems at P3


    Audit across three key stages:


    1. Prior to employment – Ensuring employees and contractors understand their responsibilities and are suitable for the roles they are considered for. Appropriate checks are conducted to verify suitability for access to P3 Audit’s information systems.

    2. During employment – Ensuring employees and contractors are aware of and adhere to information security responsibilities. Regular reviews ensure access levels remain appropriate.

    3. End of employment/role change – Ensuring a user’s access to information systems is terminated or adjusted in a controlled manner when no longer required due to termination of employment or a role change.


    This policy also governs third-party access to P3 Audit’s information systems (e.g., contractors, service providers, and partners).


    2.0 Scope


    This policy applies to all employees of P3 Audit, including contractors and third parties with access to P3 Audit’s information systems. To mitigate risks of theft, fraud, or misuse, anyone with access to P3 Audit’s systems must:


    • Be suitable for their role.
    • Fully understand their information security responsibilities.
    • Only have access to information necessary for their duties.
    • Request access removal as soon as it is no longer required.

    This policy is applied before, during, and after system access is granted. Access to P3 Audit’s information systems will not be permitted until all requirements of this policy are met.


    3.0 Laws and Regulations Guidance


    This policy follows industry standards and legal requirements, including:


    • ISO 27001: 2013
    • HIPAA Sections A.7 (A.7.1, A.7.2, A.7.3)
    • Relevant data protection regulations

    4.0 Policy Governance


    The table below identifies responsibilities for the policy within P3 Audit:


    • Role: Responsible |Responsibility: Head of Human Resources
    • Role: Accountable |Responsibility: Compliance, CISO, Management
    • Role: Consulted |Responsibility: Security Team
    • Role: Informed |Responsibility: All employees, contractors, relevant third parties

    4.1 Review and Revision


    This policy will be reviewed at least annually or whenever significant changes occur. The Compliance team will conduct this review to ensure ongoing relevance and effectiveness.


    5.0 Prior to Employment


    All prospective employees and contractors must undergo background checks in accordance with legal requirements, including:


    • Identity verification
    • Education, skills, and experience validation
    • Employment history review
    • Character references
    • Criminal record checks (where permissible)

    Contractual agreements with employees and contractors will clearly outline responsibilities for information security, including:


    • Confidentiality or non-disclosure agreements
    • Legal responsibilities and rights
    • Handling of classified information and management of assets
    • Handling of personal information

    5.1 Applicant Tracking System


    P3 Audit uses an Applicant Tracking System (ATS) to streamline the recruitment process. This system organises and filters applicants based on pre-defined criteria such as required skills and experience. The ATS ensures the recruitment process, including background checks, follows established procedures. The Head of HR monitors this process, with Compliance ensuring adherence to guidelines.


    6.0 During Employment


    The CISO is responsible for ensuring all users understand information security threats, their responsibilities, and how they can support organisational security. This includes:


    • Ensuring role or business environment changes are managed to maintain the security of information systems.
    • Management must promptly notify relevant departments of changes to a user’s role or business environment to adjust access accordingly.
    • Processes must allow for the timely modification of user access as required by new role requirements or the removal of unnecessary access.

    Management must ensure employees and contractors are aware of key policies, including:


    • Information Security Policy
    • Physical Security Policy
    • User Access Management Policy

    All employees and contractors receive information security awareness training and regular updates. Managers are responsible for ensuring their staff are adequately trained, while the Compliance department enforces adherence to these requirements.


    7.0 End of Employment/Role Changes


    When employment is terminated or a role changes, managers must remind individuals of their ongoing security responsibilities, which include:


    • Not disclosing sensitive information post-employment.
    • Adhering to confidentiality or non-disclosure agreements, including non-compete clauses.
    • Following any applicable policy standards or contractual obligations.

    This process includes:


    • Conducting exit interviews.
    • Collecting and removing P3 Audit’s documents and materials from the individual.
    • Ensuring all access rights to P3 Audit’s systems are revoked in a timely manner.
    • Returning hardware and securely wiping all sensitive data.

    If a user’s access presents a security risk, emergency procedures allow for immediate suspension of access, in accordance with the Information Security and User Access Management policies.


    8.0 Non-Compliance


    In cases where employees, contractors, or third parties violate P3 Audit’s policies or procedures, corrective measures will be taken. These may include restricting access, disciplinary action (up to and including dismissal), or termination of contracts for contractors and third parties.



    Authorised by C Els on 06 November 2024

  • P3 Audit Information Security Policy

    1.0 Executive Summary


    P3 Audit is committed to maintaining a secure and resilient information security framework. This policy outlines the guidelines for complying with various security laws, regulations, and standards, including ISO 27001, GDPR, and PCI-DSS. P3 Audit does not store customers' Personally Identifiable Information (PII) or Payment Card Information (PCI) directly but may access or process such data through operational activities.


    The goal of this policy is to ensure that P3 Audit aligns with all relevant legal and regulatory requirements concerning data management and cybersecurity, including service level agreements (SLAs) and best business practices.


    2.0 Empowerment


    The Chief Information Security Officer (CISO) has the authority to make decisions on all matters related to information security. For issues that span other departments, such as legal or compliance, the CISO will collaborate with the relevant teams.


    3.0 Laws and Regulations


    P3 Audit complies with all applicable laws and regulations governing data privacy and security, including ISO 27001, GDPR, and PCI-DSS. These regulations impact the management and retention of data, especially employee and client information. The Legal Department is responsible for identifying new laws or updates, while the CISO monitors technological developments and emerging security risks.


    4.0 Principles


    This policy establishes the principles that P3 Audit follows to ensure the security of data and information systems. These are based on the core principles of Confidentiality, Integrity, and Availability (CIA).


    4.1 Confidentiality


    Data should be accessible only to authorised individuals. Access to data must be logged to enable identification of who made changes, ensuring transparency and security.


    4.2 Integrity


    Data must be protected from unauthorised changes. Any alterations should be traceable, and mechanisms like backups and reconciliation should be in place to ensure data accuracy.


    4.3 Availability


    P3 Audit ensures that systems and data remain accessible as required by the business, using redundancy and backup measures to prevent disruptions.


    5.0 Purpose and Scope


    This policy commits P3 Audit to:

    1. Managing the risks to confidentiality, integrity, and availability of its information systems.
    2. Protecting its reputation and corporate image through robust information security practices.
    3. Meeting the security needs of employees, partners, and customers.
    4. Complying with standards like ISO 27001, GDPR, and PCI-DSS to protect sensitive data.

    6.0 Dimensions


    P3 Audit’s information security extends to:

    • Networks: Routers, firewalls, and proxies.
    • Systems: Applications, databases, and file servers.
    • Media: Including portable devices and physical backups.

    Security controls at each level must consider the principles of CIA and implement the "need-to-know, need-to-do" rule.


    7.0 Risk Assessments


    P3 Audit will conduct an annual risk assessment to evaluate potential vulnerabilities in its systems and processes. These assessments will cover:


    • External access (e.g., firewalls).
    • Internal security (e.g., user access control).
    • Data integrity and system availability.
    • Service delivery risks, including customer reporting.

    8.0 Data Protection Impact Assessments


    When acting as a data processor, P3 Audit will assist clients with Data Protection Impact Assessments (DPIAs) to ensure compliance with relevant data protection laws and standards.


    9.0 User Access Management


    Access to sensitive data will be based on the "need-to-know, need-to-do" principle. User access will be logged, centralised, and monitored for unusual activity. Access rights will be periodically reviewed and adjusted as needed.


    10.0 Security Awareness and Training


    P3 Audit ensures that all employees, particularly newcomers, receive comprehensive security training, including guidance on handling sensitive data such as PII and PCI.


    11.0 Training and Awareness Monitoring Tools


    P3 Audit utilises a Learning Management System (LMS) to deliver role-specific security training courses. Employees must complete critical security training within their first week of employment and undergo periodic retraining. Compliance with training requirements is closely monitored.


    12.0 Physical Security


    Physical assets critical to service delivery must be secured to prevent theft, vandalism, or unauthorised access. Office space access is restricted through swipe cards or similar controls.


    13.0 Business Continuity and Disaster Recovery


    P3 Audit maintains business continuity and disaster recovery plans to protect and restore systems processing sensitive data. These plans include maintaining regular backups, ensuring system availability, and minimising service disruptions.


    14.0 Data Classification and Data Protection


    P3 Audit classifies its data based on sensitivity and implements appropriate protection measures. This includes:


    • Duplicating and backing up mission-critical data to secure locations.
    • Compartmentalising personal data and using encryption to safeguard it from unauthorised access.

    15.0 Incident Management


    Any suspected security incident must be reported to the CISO immediately. P3 Audit has protocols for responding to incidents, including those involving sensitive data such as PII and PCI.


    16.0 Policy Maintenance


    P3 Audit will update this policy annually or as required. Changes to information security policies and procedures will be documented and preserved for at least six years. Regular security reviews, including penetration testing, will be conducted to identify and address vulnerabilities. All staff must comply with information security standards and may face disciplinary action for violations.



    Authorised by C Els on 06 November 2024

  • P3 Audit Cyber Resilience Policy

    Formal training or communication around cyber threats must be executed monthly to ensure that expertise around and responsibility for cyber is shared by people across the organisation.


    The appropriate Cyber Insurance must be in place to cover costs associated with a cyber-attack and to find support before, during, and after an incident.


    SeeAssociation of British Insurers (ABI) guidanceabout cyber insurance which includes information on what risks a cyber insurance policy covers, common exclusions, examples of cyber insurance in action and how to buy it.


    Planning for an incident


    Develop and regularly test plans specific to P3 AUDIT, that prioritise our core business and looks at the threats.


    This can help deal with and recover more quickly from a cyber-attack and avoid becoming a victim once more. There are three kinds of plans:


    • A disaster recovery plan supports your business during an attack
    • A business continuity plan supports after an incident
    • An incident response plan is to outline how you would respond to specific threats.

    Use the government’sExercise in a Boxis a free tool to help you plan.


    Backing up your data


    Having a backup of all your important data will help your business recover more quickly from a cyber-attack. This might include files, databases, applications, configurations, and settings.


    When it comes to ransomware for example, offline back-ups can be invaluable when it comes to restoring networks / databases.


    Some top tips for backing up your data are to:


    • Have multiple backup solutions, including offline backups and cloud
    • Take weekly backups of the full IT system
    • Back up all your important work data
    • Turn on automatic backups
    • Have a backup strategy and test your processes and backups periodically.

    For many businesses, this will be documents, photos, emails, contacts and calendars. Most of these files are kept in just a few common folders on your computer, phone, tablet or network. But you should consider whether there is other information stored elsewhere that is also important to you.


    The government’sSmall Business Guide: Backing up your dataprovides further information.


    Software that’s up to date


    Enable the security features on all your work devices and install the latest updates on all your work devices.


    It’s important to check new devices or those that have not been reviewed for some time. And installing security updates on all your work devices as soon as they’re available makes you a harder target for cyber criminals. Updates fix security weaknesses, and can also improve performance and provide new features.


    For even more tips and guidance, see the government’s advice onKeeping devices and software up to date.


    Putting more free simple controls in place


    Enable features to track, lock, and wipe company devices and get employee permission for this.


    You and your employees should make sure features to track, lock, and wipe devices are enabled across the board.



    There is more guidance from the governmentSmall Business Guide: Keeping your smartphones (and tablets) safe.


    Only download apps using Google Play or the Apple Store for mobile phones and tablets (or other approved sites)


    You should only download software and apps from official stores, like Google Play or Apple App Store. They scan software for viruses before making it available, giving you more reassurance that what you’re downloading is safe.


    There is more guidance from the governmentSmall Business Guide: Protecting your organisation from malware.


    Only allow authorised personnel to plug in USBs and other removable drives


    When drives and cards are openly shared, it becomes hard to track what they contain, where they've been, and who has used them and they could be infected with malware. You can reduce the likelihood of infection by blocking access to physical ports for most users, using antivirus tools and only allowing approved drives and cards to be used within your organisation - and nowhere else.


    There is more guidance from the governmentSmall Business Guide: Protecting your organisation from malware.


    Avoid using unknown or public Wi-Fi hotspots


    When you use public Wi-Fi hotspots (for example in hotels or coffee shops), there is no way to easily find out who controls the hotspot, or to prove that it belongs to who you think it does. If you connect to these hotspots, somebody else could access what you're working on whilst connected, including your private login details that many apps and web services maintain whilst you're logged on.


    The simplest precaution is not to connect to the Internet using unknown hotspots, and instead use your mobile network connection, which will have built-in security. This means you can also use 'tethering' (where your other devices such as laptops share your internet connection), or a wireless 'dongle' provided by your mobile network. You can also use Virtual Private Networks (VPNs), a technique that encrypts your data before it is sent across the Internet. If you're using third party VPNs, you'll need the technical ability to configure it yourself, and should only use VPNs provided by reputable service providers.


    Check what information is out there about the company on websites and social media


    Check if your publicly available IP address has any common security issues that could allow cyber criminals to attack your systems and get access to your data.


    Check your Cyber Securityis a free government service that carries out some simple online checks to identify common vulnerabilities in your public-facing IP. If any issues are found, the NCSC will provide step-by-step guidance on what you should do to help protect your data.This NCSC videoexplains what an IP address is.


    Guidance on Cyber Insurance


    Cyber insurance is one way to manage the costs associated with a cyber-attack and find support before, during, and after an incident. It covers the losses up to the limit in the policy, relating to damage to, or loss of information from, IT systems and networks, that includes data breach, whether on an IT network or not.


    It covers a direct (or first party) financial loss to you or your business arising from a cyber event. A cyber event is simply any actual or suspected unauthorised IT system access, electronic attack, or privacy breach. The vast majority of financial losses are first party loss and include theft of funds, theft of data and or damage to digital assets.


    Cyber insurance covers the liability claims (third party loss) that might be brought against you, arising out of a cyber event, such as investigation and defence costs, civil damages, compensation payments to affected parties.


    Cyber insurance also generally includes significant assistance with and management of cyber incidents both before and after an incident has occurred.


    As with any insurance policy, it is crucial to review not only what is covered by your insurer but also what is excluded. You should be looking at exclusions and also definitions and conditions when examining your policy. Many exclusions in cyber insurance are the same as those in other insurance policies such as war and terrorism but there are also some that are specific to cyber insurance. Cyber insurance will also not cover criminal, civil or regulatory fines, penalties or sanctions that your business is legally obliged to pay unless these are legally insurable.


    There is freeAssociation of British Insurers (ABI) guidance about cyber insurancewhich includes information on what risks a cyber insurance policy covers, common exclusions, examples of cyber insurance in action and how to buy it. You can also speak directly to your insurer or to your broker about the options that might be right for your business.



    Authorised by C Els on 06 November 2024

Checklists & Insights

From expert insights to the latest research reports — get advice, guidance and more to help your business and your third-party service providers work smarter and safer.

  • The Uyghur Forced Labour Prevention Act

    The Uyghur Forced Labour Prevention Act (“UFLPA”) went into effect on June 21, 2022. The United States has long prohibited the importation of goods made with forced labour. The UFLPA both strengthens and changes the way that the United States enforces this prohibition.


    The Act has a presumption of forced labour rebuttal, meaning, it is presumed unless clear and convincing evidence is provided to the contrary. In pursuit of enforcement the U.S. Customs and Border Protection (“CBP”) may detain, seize, or exclude goods from importation into the US, and may issue civil penalties for companies found to be wilfully non-compliant with the UFLPA


    It is critical that companies have their supply chains well documented to ensure there are no supply chain links relating to the UFLPA. Download and use this checklist to help implement your response to UFLPA

    Download Checklist

  • Cyber Risk Assessment

    How secure is your business? 


    Download our comprehensive risk assessment to evaluate how safe your organisation is within the cyber space.


    Our experts will be able to score your security status and offer solutions to help safeguard your organisation. 

  • Data Risk in the Third-Party Ecosystem

    Data Risk in the Third-Party Ecosystem: Third Annual Study independently conducted by Ponemon Institute LLC and sponsored by Opus.


    Understand the challenges companies face in protecting sensitive and confidential information shared with third parties and their third parties (Nth party risk). The mitigation of third-party risk has become even more important because of the EU’s General Data Protection Regulation that went into effect May 25, 2018 and the recently updated California Privacy Act.


    The Ponemon Institute define the third-party ecosystem as the many direct and indirect relationships companies have with third parties and Nth parties. These relationships are important to fulfilling business

    functions or operations. However, the research underscores the difficulty companies have in detecting, mitigating and minimizing risks associated with third parties that have access to their sensitive or confidential information.


    The results of the study are based on a survey of more than 1,000 IT and IT security practitioners in the US and UK who are directly familiar with their organizations’ approach to managing data risks created through outsourcing and who are involved in managing these risks. Unless otherwise noted, the report presents the combined the US and UK findings.

    Download

  • Business Continuity Audit Checklist

    Paying employees worldwide will mean compliance with the European Union’s General Data Protection Regulation (GDPR) is a legally-mandated must. Managing Third-Party Vendors and the increased risk to your business continuity will mean you not only need to, but will want to be on top of external risks to give you peace of mind.


    P3 appreciate that managing third-party risk (TPRM) can be both a grind and costly if not managed expertly to be effective and efficient.


    P3 offers free guidelines and checklists for those who want to manage the process themselves. We also offer a support desk for those who simply need guidance, and a fully managed service for those organisations that need it.


    An organisation’s continuity capability cannot be considered reliable or effective until it has been tested. No matter how well designed a business continuity solution or plan appears to be, realistic exercises should be used to help identify issues and validate assumptions that may require attention. The goal of exercising and testing is the continuous improvement of business continuity management capabilities and readiness by ensuring lessons learns are integrated into prevention, mitigation, planning, training, and future exercising and testing activities.

    Download

  • Testing Business Continuity Plans

    Validation / Testing is the Professional Practice within the business continuity management lifecycle that confirms that the business continuity programme meets the objectives set in the policy and that the plans and procedures in place are effective​


    The purpose of Testing / Validation is to ensure that the business continuity solutions and response structure reflects the size, complexity, and type of the organisation and that the plans are current, accurate, effective, and complete. There should be a process in place to continuedly improve the overall level of organisational resilience.


    An organisation’s continuity capability cannot be considered reliable or effective until it has been tested. No matter how well designed a business continuity solution or plan appears to be, realistic exercises should be used to help identify issues and validate assumptions that may require attention. The goal of exercising and testing is the continuous improvement of business continuity management capabilities and readiness by ensuring lessons learns are integrated into prevention, mitigation, planning, training, and future exercising and testing activities.

    Download

  • Data Risk in the Third-Party Ecosystem Infographic

    A easy to understand presentation of the findings of the survey  Data Risk in the Third-Party Ecosystem: Third Annual Study, sponsored by Opus, which helps understand the challenges companies face in protecting sensitive and confidential information shared with third parties and their third parties (Nth party risk). ​


    ​The mitigation of third-party risk has become even more important because of the EU’s General Data Protection Regulation that went into effect May 25, 2018 and the California Privacy Act. ​


    ​The third-party ecosystem is defined as the many direct and indirect relationships companies have with third parties and Nth parties. These relationships are important to fulfilling business functions or operations. ​


    However, the research underscores the difficulty companies have in detecting, mitigating and minimizing risks associated with third parties that have access to their sensitive or confidential information.  The results of the study are based on a survey of more than 1,000 IT and IT security practitioners in the US and UK who are directly familiar with their organizations’ approach to managing data risks created through outsourcing and who are involved in managing these risks..

    Download

  • A Summary of a Business Continuity Plan

    The Business Continuity Plan, or BCP, is the document by which you manage your organisation after a critical loss of functions, resources or personnel. You hope you don’t need it, but without it, your organisation may never recover from disaster. ​


    ​P3 Audit do not analyse, design or implement Business Continuity Plans, but test each element of these plans critical to building business resilience. P3 Audit partner with the most trusted professional consultancies.

    Download Infographic

  • 10 Stages of Auditing a Business Continuity Plan

    Auditing is designed to verify that the business continuity process has been followed correctly, not that the solutions adopted are necessarily correct. ​


    ​Audits should be conducted at planned intervals to confirm that the organisation is conforming with its own business continuity policy and as a third party service provider does not compromise the business continuity programs of their key stake holders including customers.

  • Cyber Security Breaches Survey 2021

    The Cyber Security Breaches Survey 2021 conducted by the UK Government in collaboration with Ipsos MORI.


    In an annual survey conducted by the UK Government, the survey aims to measure how UK organisations approach Cyber Security, and the influence of breaches and attacks. Over the course of 3 months, more than 1,419 businesses were contacted with 654 identifying a breach or attack had taken place in past year.


    In summary, respondents displayed a variety of responses to the challenges of maintaining cyber security post-Covid, from those that have attempted to bury their heads in the sand to cyber-mature organisations that have maintained their commitment and experimented with new ways to increase security.


    Of the organisations surveyed, only 15% carried out cybersecurity vulnerability audits and 12% proactively review cybersecurity risk posed by third-party service providers (suppliers).


    Technology is enabling far greater and affordable protection and this is true to testing process and certification compliance.

    Download

  • iTracker System Administrator ​Technical User Guide

    This guide aims to inform the accountable solution/system administrator in setting up the various record functions, company and process structures, and managing the ongoing addition, amendment and completion/deletion of all functions and vendor relationships

P3 Audit

Contact us for more information

Book a meeting
Share by: