Harborview Accounting Ltd — document set

This policy sets out how Harborview Accounting Ltd protects its information, systems, and the data entrusted to it by customers and partners. It applies to everyone who works in or with the business — employees, contractors, and temporary staff — and to every device and service used for business purposes.

The controls in this policy are proportionate to the size and nature of the business. They exist to keep the business operating, to meet the expectations of customers and insurers, and to satisfy legal obligations around the data the business handles.

Because Harborview Accounting Ltd handles personal data, this policy also supports the business's data protection obligations. Data protection questions that go beyond day-to-day security practice are escalated to the owner or designated data protection lead.

The business owner (or managing director) is accountable for this policy. A named security lead is responsible for day-to-day operation: managing accounts, checking that controls remain in place, and acting as the first point of contact for concerns. The current security lead is recorded alongside this policy.

Every member of staff is responsible for following this policy, for reporting anything suspicious promptly, and for asking before working around a control. No one is expected to diagnose a security problem — only to report it.

Harborview Accounting Ltd is rolling out multi-factor authentication (MFA) across all accounts on Microsoft 365, starting with email and administrator accounts. New accounts are created with MFA enabled from day one, and the owner will review rollout progress monthly until it is complete. Completing this rollout is the business's highest-priority security action.

MFA is not yet confirmed on all of the business's other important logins — online banking, administrator consoles, remote access. Extending MFA to these accounts follows immediately after email in priority: they are the logins attackers move to once email is hardened.

Staff use the business's password manager to generate and store a strong, unique password for every work account. Passwords are never reused across services, never shared over email or chat, and never written down in the open.

Administrator access to Microsoft 365 is limited to the smallest number of people who genuinely need it. Administrator accounts are used only for administration — day-to-day email and documents happen in ordinary user accounts.

When someone joins, they receive only the access their role needs. When someone leaves, access is removed no later than their last working day, using the leaver checklist at Appendix B.

Some work happens on personally owned devices. Any device used for business purposes — company or personal — must have a screen lock (5 minutes or less), an up-to-date operating system, and full-disk encryption enabled; the business verifies all three within 30 days of adopting this policy and at each annual review. Business data on a personal device stays inside business accounts (Microsoft 365); it is not copied into personal apps or storage.

Harborview Accounting Ltd is putting endpoint protection (antivirus/EDR) in place on every device used for work. Built-in protection (such as Microsoft Defender) is enabled everywhere immediately as the baseline; the business will confirm coverage on all devices as a priority action. Insurers routinely ask for this control.

Operating systems, browsers, and applications install security updates automatically. Updates are not deferred indefinitely: a device that keeps failing to update is looked into, not ignored.

No work device runs an operating system or application that has stopped receiving security updates. When software reaches the end of its support life, it is upgraded or the device is replaced — not kept in service.

Business data lives in the business's cloud storage and office server, inside business accounts — not in personal email, personal cloud drives, or on USB sticks. Access to sensitive folders is limited to the people who need them.

The business handles personal data about customers and contacts. This data is collected only for a clear business purpose, kept only as long as it is needed, and deleted securely when it is not. Requests from individuals about their data are passed to the owner without delay.

Confidential client material is stored in client-specific folders with access limited to the team working on that client. It is shared externally only through controlled links or agreed secure channels — never as open attachments to the wrong thread.

The office server is kept in a locked or supervised space, updated like any other device, and covered by the backup arrangements in this policy.

Business data is backed up automatically. Backups are protected by the same account security as the rest of the business (including MFA) so that an attacker who compromises a device cannot also destroy the backups.

The business will carry out its first test restore within 60 days of adopting this policy, and twice yearly thereafter, recording each result. An untested backup is a hope, not a control.

Remote work happens through business accounts on Microsoft 365 over the worker's own secured connection. Public Wi-Fi is used only with the device's VPN or hotspot fallback; sensitive work is not done on shared or public computers.

Remote access to the office server goes through a VPN or an equally secured connection — never a port opened directly to the internet.

The business keeps its list of online services and vendors current in the register at Appendix A. A new service is added to the register — and gets MFA and a unique password — before the business starts depending on it.

For every external service, the business records who is responsible for securing it, who manages its accounts, and who is contacted when it fails, and keeps that record current.

Day-to-day IT is handled by an outside provider. That provider's access is treated with the same care as any administrator's: named accounts rather than shared logins, MFA on every account the provider uses, and a yearly review of what it can reach. The provider's responsibilities and contact details are recorded alongside this policy.

Card payments are handled entirely by the business's payment provider. Harborview Accounting Ltd never writes down, emails, or stores full card numbers itself — if a card number arrives by email or note, it is deleted and the customer is asked to pay through the proper channel.

Changes to payment details — the business's or a supplier's — are verified by a phone call to a number already on file, never a number supplied in the request itself, before any money moves. Changes above a set threshold need a second person's approval before they take effect. An emailed request to change bank details is treated as fraudulent until proven otherwise.

Security awareness is currently covered informally when someone joins. The business commits to a short, structured refresher at least yearly — spotting phishing, using MFA, handling data, and how to report a concern — so that awareness no longer depends on who happened to do the onboarding. Completion is logged at Appendix C. Reporting a suspected mistake is always treated as the right move, never a disciplinary matter.

This policy is reviewed once a year — timed to the insurance renewal — and after any significant incident or change to how the business works. The review date and any changes are recorded on the document.

For every online service the business depends on, record in one place: the service name, who administers it, what data it holds, whether MFA and a unique password are set on it, and who to contact if it stops working. Start the register now with the services already named in this policy — Microsoft 365 and the business's cloud storage and office server — and add every other service before the business starts depending on it.

When someone leaves the business, complete and date each step on their last working day: disable their account on Microsoft 365; remove them from any shared drives or folders; change any shared passwords they knew; collect company-owned devices; and confirm their access to every other business service has been removed. Keep the completed checklist with this policy.

Record, for each member of staff: the date of their onboarding security briefing, and the date of each annual refresher. Keep this log alongside the policy so training coverage can be checked at a glance during the annual review.

This plan tells everyone at Harborview Accounting Ltd exactly what to do when something goes wrong: a phishing email that was clicked, a hacked account, ransomware, lost or stolen equipment, or data ending up where it shouldn't. Its structure follows the widely used incident lifecycle: recognise, contain, assess, recover, learn.

Activate this plan whenever there is a reasonable suspicion of an incident. It is always better to activate and stand down than to wait for certainty — early action is what limits damage.

The incident lead is the security lead, with the owner as deputy. The incident lead directs the response and keeps the timeline; the owner decides external communication and any spend. Both are reachable by phone, and their current numbers are kept with the printed copy of this plan.

Key external contacts are listed alongside this plan and checked at each review: the business's IT provider (with an out-of-hours number), its cyber insurer's claims line, and its bank. The IT provider is brought in no later than containment. If the business holds cyber insurance, the insurer is called early — most policies include incident support, and late notification can jeopardise the claim.

Anyone who notices something wrong reports it to the incident lead immediately, by phone or in person — not just by email, which may itself be compromised. Warning signs include: unexpected password-reset emails, sign-in alerts from unfamiliar places, files that won't open or have strange extensions, colleagues receiving odd emails 'from' the business, or a device suddenly slowing or acting oddly.

The reporter writes down what they saw and when, and does not delete anything, run cleanup tools, or turn the device off unless told to — evidence and logs are what make recovery and any insurance claim possible.

For a compromised account: from a known-clean device, change the account password, sign out all active sessions, and check for new mail rules, forwarding addresses, or newly added devices. In Microsoft 365, the administrator does this from the admin console.

For a suspect device: disconnect it from the network (unplug the cable, turn off Wi-Fi) but leave it powered on, and stop using it. For suspected ransomware, disconnect the office server and any connected backup drives first — protecting the backups is the single most important containment step.

If money is involved — a fraudulent payment made or attempted — the bank is called immediately, before anything else in this plan. Banks can sometimes recall payments if contacted within hours.

Once contained, the incident lead establishes: what happened, which accounts, devices, and data were touched, and whether the incident is actually over. If the business has IT support or insurer-provided incident response, they are brought in here at the latest.

Because the business holds personal data, the assessment always answers one specific question: was personal data accessed, taken, or lost? If it may have been, the owner takes advice promptly on whether the incident meets the legal threshold for reporting to the data protection regulator and to affected individuals — where it does, statutory windows are short (72 hours in many jurisdictions), so this question is asked on day one, not after recovery. Not every incident involves personal data or meets that threshold, and over-reporting has its own cost — the advice is what settles it, not an assumption either way.

If client-confidential material may have been exposed, the affected clients are told promptly and honestly by the owner — before they hear it elsewhere. Contract terms with those clients may set specific notification duties; they are checked as part of the assessment.

Recovery starts only when the incident lead is satisfied the attacker's access is gone: passwords rotated, MFA confirmed on affected accounts, malicious rules and devices removed, and compromised machines wiped or professionally cleaned before rejoining the network.

Data is restored from backup where needed, restoring the most recent copy from before the incident. Restored data is spot-checked before the business relies on it again.

Within two weeks of closing an incident, the incident lead runs a short review with everyone involved: what happened, what the timeline was, what worked, and what single change would most reduce the chance of a repeat. The write-up is kept with this plan, and the change is actually made — an unimplemented lesson is not a lesson.

The plan will be exercised as a short tabletop walkthrough — fifteen minutes, one scenario, everyone in the room — within 12 months of adoption, and annually thereafter, so that the first time anyone reads it is not during a real incident.