Policy 08
Information Security
“Clients trust us with work that isn’t public yet. We protect it accordingly.”
Scripts, films, designs, product information, passwords and data all pass through our studio. These are proportionate security controls for a small creative studio working across office, remote and production workflows.
At a glance
The short version.
Locked-down accounts
Unique passwords, multi-factor authentication and least-privilege access.
Careful with files
Approved transfer services, encrypted archives and passwords sent separately.
Ready to recover
Backups that don’t depend on the original device, tested to make sure they actually restore.
In practice
What we commit to.
- Keep operating systems and software supported and updated
- Never install untrusted software or cracked plugins
- Verify any request to change bank details or urgently move money
- Configure cloud tools to avoid accidental public sharing
- Label especially sensitive projects Restricted, with tighter controls
- Grant access by role and remove it promptly when people leave
- Report lost devices and suspicious activity immediately
Step by step
If there’s a security incident
-
1
Report
Raise it immediately.
-
2
Contain
Without destroying evidence.
-
3
Secure
Change credentials or isolate devices.
-
4
Assess
Identify affected systems, client information and personal data.
-
5
Notify
Clients, insurers, providers or authorities where required.
-
6
Learn
Record lessons and put corrective action in place.
The detail
Everything else.
The key parts of the policy, in plain English. The downloadable PDF is the full, controlled version.
Responsibilities
Cyber security is everyone’s job. The Technical Lead coordinates controls, Operations handles joiners, movers and leavers, project owners control project access, and everyone reports suspicious activity.
Restricted projects
Particularly sensitive work can have named access lists, no personal cloud accounts, no generative AI uploads, encrypted transfer or limited remote work.
Physical security
Visitors don’t get unsupervised access to sensitive production areas, screens with confidential work are positioned or locked appropriately, and sensitive paper is disposed of securely.
Training and review
Staff receive guidance on phishing, passwords, secure sharing and incident reporting. The policy is reviewed every year and after any significant incident or major systems change.
Laws and guidance this policy follows
- NCSC Small organisations guide to cyber security (April 2026, reviewed July 2026)
- NCSC guidance on backups, account security, device security and spotting attacks
- UK GDPR security requirements where personal data is involved
The full document
Information Security Policy
Version 1.0 · Effective October 2026 · Owner: Managing Directors / Technical Lead
Questions about this policy?
Received something suspicious that looks like it came from us? Let us know straight away.