User policy.

It is BREE Construction’s policy to protect its Information and Information Systems from theft, corruption, misuse, and loss; preserving:

• Confidentiality. Information is only accessible to authorised individuals.
• Integrity. The accuracy is only accessible to authorised individuals.
• Availability. Information is accessible to authorised employees and processes, when required.

This requires that all employees, and third parties are aware of, and comply the security expectations set out within this Information Security User Policy.

Information that is processed, stored, and transmitted is at risk from theft, corruption, misuse, and loss, if directed actions are not taken to ensure its security.

This suite of user security policies sets the direction for maturing the resilience of BREE Construction’s Information and Information Systems, through consideration of key security resilience control areas, aligned to the Information Security Management System (ISMS): ISO 27001.

This Information Security User Policy applies to:

• BREE Construction’s Information (regardless of format) and Information Systems, utilised in its creation, processing, sharing and storage.
• BREE Construction’s physical sites, which includes all locations information. See the Physical Security Policy.
• All colleagues and third parties, who are responsible for identifying, implementing, operating, monitoring and maintaining IT Security controls.
• The acquisition, development and maintenance of Information Systems.

The following terms are used throughout the policy:

• Shall is used to state a mandatory requirement of this policy.
• Should is used to state a recommended requirement of this policy.

The following definitions are used through this policy:

• Information or Information Asset. The definition of information is very broad and includes all written, spoken or electronic information collected, held, processed or transferred by BREE Construction or on its behalf by a third party. This can be any data or other knowledge that has value to an organisation.
• Information Owner. A BREE Construction member of staff who is responsible for the ownership, management and upkeep of information stored within an Information System. It could be that the Information System Owner is the Information Owner.
• Information System. A set of applications, services, information technology assets, or other information-handling components. Information systems include but are not limited to physical or virtual servers, networks, cloud services or software applications.
• Information System Owner. A BREE Construction member of staff who is responsible for the ownership, maintenance, and upkeep of an Information System (whether that system is hosted by the BREE Construction IT Team or by a third-party system provider) or a hardware provider/manufacturer.
• User Device. A device used by an individual to access information or an information system. A device includes, but is not limited to: desktop PCs, laptops, tablets (iPads and so on), mobile phones and smartphones. These could be devices owned and issued by BREE Construction’s IT Team, a non-BREE Construction device, or a personal device used to connect to BREE Construction information or information systems.
• User. A colleague, contractor or third party who is authorised by the IT team to access information and/or information systems.

BREE Construction defines, implements and operates a governance, risk and compliance structure suitable to Information Security Management. This includes the assignment of security roles and responsibilities to direct, control, operate, and monitor the performance of the IT Security Policies and Procedures Framework.

The following roles and responsibilities are crucial to the success of Information Security and the IT Security Policies and Procedures Framework.

• Head of IT Security. Overall ownership of the IT Security Policies and Procedures Framework. Provision of appropriate resources, tools and controls to mitigate any associated risks.
• IT Security Analyst. Management and continuous improvement of the IT Security Policies and Procedures Framework. Review the suitability of this policy and update it as and when required. Conduct regular audits to review the applicability of this policy against the IT Security Policies and Procedures Framework.
• Department Leads. Ensure that staff are aware of this policy, and challenge and manage any deviation appropriately.
• Users. Keep informed of the requirements of this policy, including any updates or amendments from time to time. Adhere to the requirements of this and any associated policies at all times, or seek Senior Management and IT Security Team approval for any extreme circumstantial exceptions. Immediately report any instances of non-adherence to this and any associated policies to the IT Security Team. Immediately report any actual or suspected malicious activity to the IT Security Team.

Incident and data breach reporting

A security incident is defined as an event which could impact the confidentiality, integrity or availability of BREE Construction’s information and/or information systems. A data breach is an event which could impact the confidentiality or integrity of BREE Construction information.

Any actual or suspected security incident or data breach should be reported to the IT Service Desk immediately.

IT will maintain accurate records of any IT security incidents. For further information see the Incident Response and Data Breach Policy.

BREE Construction issued laptops

• BREE Construction laptops are issued to users whose role requires one in order to allow them to carry out relevant duties.
• BREE Construction laptops may only be used by the User to whom they have been issued, and with limited personal use as long as it is not to the detriment of their duties.
• Users should not install or store personal files such as music, videos or photographs on a company laptop or shared storage device.
• Users shall not install any games or applications on a company laptop or shared storage device.
• Users shall not install any unauthorised SaaS (software as a service) products on a company laptop or shared storage device.
• Users shall only use software recorded on the approved software list and should not attempt to download and install any other software. Only the IT department can download and install software onto a BREE Construction device.
• It is not acceptable for anyone to knowingly bypass security controls without the express permission of a member of the IT team.
• Users shall not copy recordings or written material, except where permitted by copyright law or applicable licences.

BREE Construction issued mobile devices

• BREE Construction issued mobile devices, such as phones and tablets, may only be used by the User to whom they have been issued.
• Users issued with a company telephone number, mobile number or tablet should solely use these for business purposes. Personal calls and texts are not permitted unless authorised by the IT team.
• Where a protective case has been issued this shall not be removed from the device unless authorised by the IT team.

Cloud services and software, including apps

• Users shall only use cloud services and software on BREE Construction issued devices that have been authorised by the BREE Construction IT Team. This includes any in-house or third-party developed software applications and/or mobile applications which can be downloaded from the internet or an app store.
• An approved cloud service and software list can be requested from IT.
• Any request for a cloud service or software not included on the approved list shall be placed via the IT Service Desk.
• Free or open-source cloud services shall be avoided.
• BREE Construction reserves the right to remove a cloud service or software from the approved list should it be found to contain known vulnerabilities or its security controls are inadequate.

Use of artificial intelligence

• Users shall not make any use of unapproved AI or machine learning websites. Access to unapproved AI sites has been restricted by the IT Team, but please always check first before using any AI tools.
• Where you are permitted to use AI tools, please do not upload any company confidential, client confidential or any data that is personal data restricted or protected under GDPR regulations. If you are unsure then please contact the Data Protection Officer for guidance.
• AI must not be used to analyse confidential rates, costs, personal data, or to summarise confidential or restricted meetings.
• You must not use AI to manipulate or change the appearance of a person in any way without their permission.

Data encryption

• BREE Construction information systems and user devices containing confidential data are encrypted in case of loss or theft.
• Any confidential information sent outside of the BREE Construction network by any electronic means, for example by email, shall be encrypted before being sent. See Information classification and handling below for the handling requirements. For further guidance and support please contact the IT Service Desk.
• Portable media devices such as memory sticks are not authorised for use, and by default restrictions are in place to prevent the use of such devices.

Legitimate data use

Any users that have access to information shall ensure that they only use this for legitimate business purposes. Searching for information relating to friends, family or neighbours is strictly prohibited.

IT issued equipment

Where IT equipment is issued, such as headsets, chargers, monitors or USB cables, care should be taken to avoid damage or loss of these.

BREE Construction email

• Where required, users are provided with a BREE Construction email address which is for business use only. Limited personal use is permitted as long as it is not to the detriment of their duties.
• BREE Construction email should not be used for personal financial gain, including online trading (for example selling on eBay or Amazon) or running a personal business.
• BREE Construction email should not be used for malicious or illegal purposes, or for any other activity that could bring BREE Construction into disrepute.
• Users issued with an email address should exercise caution in disclosing their email address to unknown third parties such as surveys and special offer sites.

Internet access, usage and web filtering

• Users may access the internet for business purposes so long as the content accessed does not contain material deemed to be pornographic or offensive, relate to gambling, or relate to activities prohibited by UK law.
• Users shall not use any BREE Construction Information Systems or User Devices to create or transmit material that might be defamatory, offensive, harassing or reflect negatively towards BREE Construction.
• Limited personal web browsing use is permitted so long as it is not to the detriment of their duties. Personal web browsing is not permitted on BREE Construction issued mobile phones or tablets unless these are connected to secure Wi-Fi, to prevent excess data charges.

Telephone communication

The telephone is not a secure means of communication, therefore caution shall be exercised when discussing sensitive matters. In addition, users shall avoid releasing sensitive information to unknown callers. Care shall be taken to authenticate the identity of the caller before information is imparted. If there is any possibility that BREE Construction’s position could be compromised, requests for information shall be refused. Similar care should be taken with voice messaging services.

Remote working and travelling with your corporate device

• When working remotely, users should take all reasonable steps to ensure the working environment is secure, ensuring information in both physical and electronic media form is kept secure.
• When working remotely, users should not connect any corporate devices to public Wi-Fi networks. Users have been provided with mobile phones with the option to tether their laptop for 4G/5G connectivity.
• If travelling outside of the UK with any BREE Construction issued user device, a request shall be placed with the IT Service Desk in advance of the travel to allow for the necessary access to be granted.

Loss of, theft of, or damage to IT equipment

• Users should take all reasonable steps and care to ensure that BREE Construction devices are not lost, stolen or damaged. There is an acceptance of general wear and tear, and that occasionally accidents do happen.
• Repeated loss or damage to BREE Construction User Devices, or negligent behaviour that leads to the loss or damage of User Devices, may be considered as a disciplinary matter.
• Any loss of a BREE Construction issued User Device shall be immediately reported to the IT Service Desk.

Equipment return

All BREE Construction user devices and information shall be immediately returned to the hiring manager or IT team when a user leaves BREE Construction, and/or when their contract has ended. They may not be retained or reused for any purpose.

Awareness training

All users shall complete a mandatory annual electronic learning course covering cyber security and related risks via the BREE Construction online learning portal upon joining BREE Construction, and complete any ad-hoc awareness training as and when required.

Monitoring

• Tools and systems are in place to monitor a range of activities undertaken, including email, internet, telephones and building access controls.
• By agreeing to this policy, users accept that their use of BREE Construction information systems and buildings may be monitored to ensure a safe, secure and legally compliant environment.

Password creation

The following rules should be applied in relation to the creation of any password which is used to access a BREE Construction information system or user device:

• Generate a password with a minimum of 12 characters by utilising the three random words technique (passphrases) to construct a password with a combination of both upper and lowercase letters. For example, combining three random words such as JumpingWheelSwallow.
• Supplement the three random words with at least two numbers and at least one special character to further strengthen a password. For example, JumpingWheelSwallow11£.
• Where available, biometric security controls such as a fingerprint reader may also be used to unlock a device.
• PINs shall be 6 characters or greater on mobile devices and 15 characters on all other devices. PINs shall not be a commonly used or easy to guess combination or series such as 123456.

The appendix demonstrates how to set a password which meets the required complexity. Users shall ensure the following when referring to it:

• Do not use any of the examples for your password.
• Do not use personal details or personal interests such as sports team names.
• Do not re-use passwords between system accounts, especially between work and personal accounts.
• Do not re-use old passwords or add additional numbers or characters to an old password. For example, changing JumpingWheelSwallow11£ to JumpingWheelSwallow12£ to JumpingWheelSwallow13£.

Password protection

The following rules shall be applied in relation to the protection of any password:

• Passwords shall not be shared with anyone, written down, or recorded somewhere that is easily accessible to others.
• Passwords shall be accompanied with multi-factor authentication (MFA).
• If a service does not support MFA, the IT team must approve it for use.
• If there is a need to share a document or file password, never share the password using the same communication method as the document, file or link. Always share the password using an alternative communication method. For example, share the file or document via email, and then call the recipient to share the password over the phone.

Password changes

The following rules shall be applied in relation to the changing of any password:

• Any default passwords generated during the initial on-boarding process shall be changed immediately.
• Should a password become compromised, or you suspect a password has been compromised, the password shall be changed immediately and reported to the IT Service Desk, as set out under Incident and data breach reporting above.

Data security

• BREE Construction does permit the storage of information on personal devices; however the device should have encryption (for instance passwords) enabled at all times. Any information which is stored locally to the device should not be included in any personal cloud backups (for example personal OneDrive, Dropbox or iCloud).
• Personal devices shall only connect to the Guest Wi-Fi network. Access to other BREE Construction networks is strictly prohibited.

Access controls

• The password controls defined under Passwords above should also be applied to personal devices used for work purposes.
• Where achievable, an auto lock setting should be configured to activate after 5 minutes of inactivity to protect the device from unauthorised access. If the device does not offer an auto lock setting, the device should be manually locked before leaving it unattended.
• In the event a user suspects that their password may have been disclosed, they should change it and contact the IT Service Desk immediately in order that any potential unauthorised Information System access can be investigated.
• Where possible, biometrics should be used to access BYOD devices.

Anti-malware

• In order to protect the personal device from malicious activity and applications, the device should have anti-malware software installed.
• Anti-malware software is available for devices running the macOS, Windows, Linux, Unix and Android operating systems, such as laptops and desktop computers. Free or paid-for anti-malware applications can be used providing it is set to update daily, set to scan files automatically upon access, scan all web pages that are accessed, and warn device users about accessing malicious websites.
• Care should be taken to only install applications and/or software from trusted sources.

Secure configuration

• To protect the personal device against external threats, the software firewall included in the operating system should be enabled at all times. Please note this is not possible on tablets or smartphones.
• The device should always be running the latest secure operating system with all available security patches applied to both the operating system and any installed applications.
• The device should be configured to install all operating system and application security patches automatically. If the device operating system or application does not allow for this, any updates which the vendor classifies as “critical” or “high” risk should be applied within 14 days of release.

Device owner responsibilities

• Users wishing to use their personal device to access BREE Construction Information Systems or Information should make best efforts to physically secure the device against theft, loss or use by unauthorised persons. Users should be vigilant when using the device in a public space to ensure the device is secure at all times and that others are unable to view any confidential company data or private information displayed on the screen.
• Users should avoid connecting the device to open public Wi-Fi connections when accessing BREE Construction Information Systems and/or Information, to reduce the likelihood of any information being maliciously intercepted.
• On the last day of work, or the last day before commencing a period of gardening leave, or if the device owner intends to sell or transfer a device that has been used to access or store BREE Construction Information, all BREE Construction Information, including work emails and any software applications provided by BREE Construction for business purposes, should be removed from the personal device by the device owner.
• Should the personal device be stolen or lost, the device owner should report it to the IT Service Desk immediately.

• Line Managers have a responsibility to notify the Talent Team and HR Team of new starters, persons leaving the company, or persons moving between teams. Managers will be asked to complete a new starter form for the required User Information System access and User Devices.
• Line Managers will inform the HR Team of any User who is absent from the company due to long term sickness, maternity leave or disciplinary action, so that their access can be secured appropriately.
• Line Managers are also responsible for ensuring that all BREE Construction Information and User Devices are recovered prior to the User leaving the organisation. A list of equipment issued to a User can be obtained from the IT Service Desk. Equipment should be returned to the leaver’s Line Manager or IT no later than 10 working days after the User has left BREE Construction.

Purpose

Information classification ensures that individuals have the knowledge and awareness of the type of information they are working with, along with their obligations and responsibilities for protecting it. The business of BREE Construction requires the storing, transferring and processing of sensitive data. It is of great importance that this data is always protected.

Principles

• All Information requires an information owner.
• Information owners are responsible for ensuring that the information is appropriately classified, in line with applicable legislation.
• Access to information shall be made available on a “need-to-know” basis.
• It is the responsibility of all BREE Construction’s parties to appropriately handle any information to which they have access.

Scope limitations

All information generated prior to the original publication of this policy, and in an archived state, shall be exempt from the policy’s classification labelling requirement. Instead, information of this type shall be logically organised by information classification and handled according to the remainder of the policy.

Information classification categories

With the exception of Public Use information, all other information, regardless of format, shall be classified and labelled by the information owner into one of the following categories:

• Public Use. Non-sensitive BREE Construction information, of which the unauthorised disclosure, modification, or loss would result in zero impact to BREE Construction.
• Internal Use Only. Information not intended for a public audience, of which the unauthorised disclosure, modification or loss would result in minimal impact to the interests of BREE Construction.
• Confidential. Private information, of which the unauthorised disclosure, modification or loss would cause a detrimental impact to the interests of BREE Construction.
• Strictly Confidential. Sensitive information, of which the unauthorised disclosure, modification, or loss would cause a significant impact to the interests of BREE Construction.

These are not exhaustive lists. Please use this as a guideline and always check with the DPO if you are unsure how to classify data. Please note that Strictly Confidential and Confidential categories may have additional restrictions on who they can be shared with externally, should such information need to be shared or is being sourced from a client organisation, supplier, public authority or business partner.

• Personal data includes any information that can uniquely identify an individual, such as a name, address, postcode, or date of birth if combined with other information.
• Special categories of personal data include information pertaining to health, religious beliefs, sexuality, criminal records, and similar.
• Refer to BREE Construction’s Data Protection Policy for complete definitions of personal data.
• The handling of all information shall be carried out in strict adherence to the requirements set out in the Data classification and handling matrix below.
• Where there are multiple pieces of information held together, the highest classification will be used.

Classification labelling

• Information, regardless of format (for example documents, emails or video media), shall be overtly marked with the corresponding classification, so that end users of the information are clear of its sensitivity when handling.
• All documents should, where deemed appropriate, contain a distribution list of authorised recipients, and a version history of information.
• Archived data can be grouped, and classification labels used to designate the highest classification that can be stored in each group.

Digital assets and all of the information stored within them are classified as follows:

• Entra ID / Service Desk Ticket Management System. Strictly Confidential.
• HR and payroll systems. Strictly Confidential.
• Network file shares. Strictly Confidential.
• Legal file system. Strictly Confidential.
• Finance systems. Confidential.
• Business development. Confidential.
• Works management. Confidential.
• Plant and vehicle systems. Confidential.
• Customer system (CRM). Confidential.
• Business standards. Confidential.
• Intranet. Internal.
• Email. Internal.

Any assets outside of the above list that are unlabelled are automatically classified as Internal Use Only.

Information asset handling

• Information assets shall only be handled by individuals that hold the appropriate authorisation from the Information Owner and have a valid business requirement for doing so.
• The requirements for transfer, access, storage, and disposal of all categories of information are described in the Data classification and handling matrix below. All information shall be handled at all times according to these requirements.
• Portable and storage media, along with document storage, shall be transported, received, and stored on the basis of the highest classification item recorded.

Where information may be stored

✗*Not permitted, special cases acceptable Special cases are acceptable. See the Data classification and handling matrix below.

Data classification and handling matrix

Each aspect of handling below is given for all four classifications. Where an aspect is not stated for a classification, no specific restriction applies.

Any exemption to this policy shall be documented with business reasoning and signed off by the Head of IT Security before being taken forward.

The following examples demonstrate how to set a password which meets the required complexity. Do not use any of them.