Policies & Procedures

Cyber Security Policy and Procedures v3.0

Cyber Security Policy and Procedure

Policy Lead Mrs. Tavleen Sharma (Registered Manager)

Version No. 3.0

Date of issue May 2026

Date to be reviewed April 2027

Purpose and Introduction:

VCare Consultancy Services Limited is committed to maintaining effective cyber security, information governance and operational resilience arrangements to protect service users, employees, business systems and confidential information from cyber threats, unauthorised access, loss, disruption or misuse.

This policy establishes the organisation’s approach to cyber security management in accordance with UK GDPR, the Data Protection Act 2018, NHS DSP Toolkit requirements and guidance issued by the National Cyber Security Centre (NCSC).

Scope:

This policy applies to:

• All employees, directors, contractors and agency workers.

• All electronic systems, devices and networks used for business purposes.

• All service user, staff, safeguarding, payroll, operational and financial information.

• Home working, remote access and mobile working activities.

• Third-party suppliers and digital service providers with access to organisational systems or information.

Governance and Responsibilities:

Overall responsibility for cyber security and information governance sits with senior management and the Registered Manager.

Responsibilities include:

• Ensuring cyber security risks are reviewed regularly.

• Ensuring appropriate technical and organisational controls are implemented.

• Reviewing incidents, risks and lessons learned.

• Ensuring staff receive cyber security and data protection training.

• Supporting business continuity and operational resilience arrangements.

All employees are responsible for:

• Protecting passwords and devices.

• Reporting suspected cyber incidents immediately.

• Following organisational policies and procedures.

• Handling personal information securely.

Identification of Critical Data and Systems:

VCare Consultancy Services Limited identifies and maintains oversight of critical systems and information assets including:

• Carebeans digital care management system.

• QCS policies and compliance systems.

• Electronic care records and care plans.

• Staff personnel and payroll information.

• Safeguarding and incident records.

• Business email systems and cloud-based storage.

The organisation applies proportionate security controls depending on the sensitivity and operational importance of information and systems.

Access Controls and Security Measures:

The organisation maintains a range of technical and organisational controls including:

• Password-protected systems and devices.

• Role-based access controls.

• Secure cloud-based systems.

• Anti-virus and endpoint protection.

• Multi-factor authentication where available.

• Software updates and security patching.

• Secure disposal of confidential information.

• Encryption of sensitive information where appropriate.

Access to information is restricted to authorised personnel only and is reviewed as part of operational management processes.

Logging and Monitoring:

VCare Consultancy Services Limited maintains incident reporting and operational monitoring arrangements to support identification of cyber security concerns.

Where applicable, systems maintain:

• User access logs.

• Audit trails.

• Incident reporting records.

• Device and access monitoring information.

Cyber incidents, suspicious activity and data breaches are documented, investigated and reviewed by senior management.

Home Working and Remote Access:

Employees undertaking home or remote working activities must:

• Use password protected devices.

• Avoid use of unsecured public Wi-Fi networks.

• Store confidential information securely.

• Ensure devices are not left unattended.

• Report lost or stolen devices immediately.

• Follow organisational confidentiality and information governance procedures.

Where possible, digital systems used remotely should utilise secure cloud-based access arrangements.

Backup and Recovery Arrangements:

The organisation maintains business continuity and recovery arrangements to support operational resilience in the event of cyber incidents, system disruption or data loss.

This includes:

• Use of cloud-based systems.

• Regular system backups where applicable.

• Secure retention of operational information.

• Escalation and recovery procedures.

• Contingency arrangements for care delivery.

Recovery arrangements are reviewed periodically as part of organisational governance processes.

Incident Response and Reporting:

VCare Consultancy Services Limited maintains procedures for responding to cyber security incidents and information governance breaches.

Incidents may include:

• Phishing attacks.

• Malware or ransomware.

• Loss of devices.

• Unauthorised disclosure of information.

• Suspicious system activity.

• Data breaches.

Employees must immediately report suspected incidents to senior management or the Registered Manager.

Incident response processes include:

• Identification and containment.

• Investigation and assessment.

• Escalation where required.

• Recovery and restoration of services.

• Documentation and lessons learned review.

• ICO reporting where legally required.

Training and Awareness:

All employees receive cyber security, confidentiality and data protection awareness training during induction and periodically thereafter.

Training includes:

• Password security.

• Phishing awareness.

• Safe handling of personal information.

• Reporting cyber incidents.

• Remote working security.

The organisation promotes ongoing awareness through supervision, operational communications and policy review.

Third Party and Supplier Management:

Third-party suppliers and digital providers with access to organisational systems or information are expected to maintain appropriate information governance and cyber security standards.

The organisation undertakes reasonable due diligence in relation to suppliers handling confidential information or supporting digital operations.

Compliance:

VCare Consultancy Services Limited is committed to compliance with:

• UK GDPR.

• Data Protection Act 2018.

• NHS DSP Toolkit requirements.

• Applicable NCSC guidance.

• CQC information governance expectations.

The organisation continues to review and improve cyber security arrangements in line with operational risks and evolving threats.

Home Working Threat Assessment:

VCare recognises home and remote working risks including use of unsecured Wi-Fi, loss or theft of devices, unauthorised viewing of confidential information, phishing emails and accidental disclosure. These risks are controlled through password protection, secure cloud access, staff training, confidentiality procedures, avoidance of public Wi-Fi, secure storage of records and immediate reporting of lost devices or suspected incidents.

Policy Review:

This policy will be reviewed annually or earlier following:

• Significant cyber incidents.

• Changes to legislation or guidance.

• Operational changes.

• Outcomes of audits or risk reviews.