This document provides information about the technical and organisational measures and controls implemented to ensure an appropriate level of security.
1. Overview
We have implemented a risk-based approach to our technical and organisational measures in accordance with the principles of integrity, availability and confidentiality to ensure the security of personal data.
Lead Forensics runs an ISO 27001-accredited information security management system.
2. The Lead Forensics Product
Lead Forensics offers a SaaS solution that identifies website visitors and provides actionable leads within a business-to-business environment.
3. Information Security Management System (ISMS) Framework
Lead Forensics runs an ISMS which implements a risk-based approach to information security, selecting appropriate security controls and processes based on a risk assessment that is regularly reviewed and updated.
ISO 27001 is the international standard that provides the specification for a best-practice ISMS and covers compliance requirements. The Lead Forensics ISMS is certified to ISO27001 by independent UKAS accredited auditors.
Access to ISMS Documentation
We can share our ISO27001 Statement of Applicability and Information Security Policy freely with customers, prospective customers and other relevant parties. Detailed policies, external audit reports and technical procedures can be shared as part of a due diligence procedure once the requesting party has agreed to an NDA.
The details of our risk assessment and some technical design details and procedures are confidential and unable to be shared. In these cases, we will share the policies that define the security standards that Lead Forensics will adhere to, even if we cannot reveal the technical detail.
Security documentation requests should be emailed to [email protected]
4. Physical Security
-
-
- Locked doors on all entrances/exits (e.g., electronic locks, physical locks)
- Access control systems (biometric security, access card security)
- 24/7 Reception/security personnel
- CCTV systems
- Additional physical security measures to protect IT equipment (partitioned server room, fireproof safe, etc.)
- Secure disposal bins for confidential paper waste (shredded on-site)
- Certified waste disposal for electronic waste
-
5. Control of Access to IT Systems and Physical Environments
-
-
- Access permission to physical IT areas restricted to staff who specifically require it
- Multi-Factor Authentication required for all remote access to systems
- IT security systems have individual user login and unique usernames
- Role-based access control with least privilege and need to know basis
- We require the use of strong/complex passwords
- We encrypt all data in transit on public networks
- We use encryption at rest for our application data wherever we process data using cloud-hosted services. Our on-premise databases are not encrypted at rest, but they have other mitigating controls to ensure the physical security of our data
- Multi-authentical layers on internal applications
- Automatic locking of IT terminals and devices after periods of inactivity, with passwords required to re-access
- Password databases are subject to strong encryption/hashing
- Audits of security procedures conducted annually, as a minimum
- Specialised training for employees
-
6. Protect Personal Data Against Cyber-Attack
-
-
- Multi-factor authentication for all remote access to systems
- Firewalls maintained with the least access rulebase
- Hardware Asset Register maintained
- Software\Firmware records maintained
- Vulnerability management process ensures systems are patched/updated according to industry best practices
- Regular Software Security Update Processes and Procedures
- All Cloud Management Platforms require MFA Authentication
- Anti-Virus\Anti-Malware Installed on systems
- EDR solution deployed
- Data backups encrypted with Private keys
- Regular Backup restore testing
- All offsite backups are stored encrypted in offline archives
- Annual 3rd Party Penetration testing
- Monthly internal Penetration testing
- All staff subject to automated anti-phishing training/simulations
- All laptops encrypted
-
7. Processors and the Supply Chain
We conduct due diligence on any prospective processor or supplier processing data. We require them to commit to commercial and Data Processing Agreements (where personal data is processed) that meet the necessary regulatory conditions. We conduct an annual audit to review our supply chain.
8. Storage Limitation
We have backup retention implemented with automatic lifecycle policies (archive and expiry).
At least annually, we review the retention periods for personal data and apply the storage limitation principles to our data deletion/retention policy.
9. Detecting Security Events
-
-
- Advanced Threat Analytics actively deployed
- Automated security event alarms
- User risky sign-in detection and alerting
-
10. Detecting Security Events
-
-
- Centralised un-editable Logging Systems
- SIEM deployed to automatically analyse security logs and raise alerts
-
11. Minimising Impact
-
-
- Availability management molicy.
- Resilient IT services with Minimised Single Points of Failure
-
12. Encryption
Data at rest
We use encryption at rest for our application data whenever we process data using cloud-hosted services. Our on-premise databases are not encrypted at rest, but they have other mitigating controls to ensure the physical security of data.
Data in transit
All data is encrypted in transit over public networks. We regularly review and update the encryption standards to stay aligned with current best practices.
13. Response and Recovery Planning
We have implemented Incident Management processes and procedures, including pre-approved incident response plans for:
-
-
- Ransomware
- A security incident triggering a personal data breach
- Denial of service
-
Business Continuity Processes (BCP) and Procedures are in place and are reviewed and tested annually.
14. Data by Design and Default
We consider appropriate data protection principles and the integration of the necessary safeguards into conceptual product and process innovation to meet the requirements of the Regulation and the rights of data subjects.
15. Data Controller and Data Processor Workflows and Agreements
-
-
- We consider our technical and procedural workflows to align with the responsibility of personal data, and document ROPA (Records of Processing Activities)
- Binding agreements appropriate to the personal data being shared or processed are required between data controllers and data processors
- We regularly review the technical and organisational workflows and controls in place and have a formal annual audit
-
16. Training and Awareness
-
-
- All new employees complete IT security training
- All new employees are required to complete Data Compliance training
- Existing employees receive periodic compliance, IT security and policy awareness training
- Hybrid/home workers must comply with IT/HR policies
- Data Compliance is tasked with developing a culture of data protection awareness
-
17. Committed to Improvement
We are committed to reviewing our processes, policies, and documentation as follows:
-
-
- ISMS system with regular process reviews and audits
- Incident Review Processes to identify improvement opportunities
- Companywide annual audit conducted by Data Compliance
- External auditors conduct quarterly audits
-
18. Certification
-
-
- ISO 27001 Certification
- PCI DSS Certification
- Registered with the ICO
-
| V2 | Last modified February 2025 |
