Protecting AMWS systems, email and data from cyber threats. This assessment tests the controls actually operated under POL_HSQE_30 IT Security — a deliberately proportionate control set for a 20-person contractor that does not operate at ISO 27001 scale.
All AMWS digital working — Northampton Office (Unit 1), Unit 2C Stour Road, home working locations, and personal devices used for the WhatsApp Works group.
| Hazard | Existing controls | Initial | Additional controls | Residual | ||||
|---|---|---|---|---|---|---|---|---|
| S | L | R | S | L | R | |||
| Phishing or invoice-fraud email leading to a diverted payment | Directors hold finance credentials with MFA (POL_HSQE_30 Section 2); unexpected attachments and urgent-payment emails paused and checked with the Directors (Section 3); suspected phishing forwarded to the Directors, deleted and logged in the HR/IT folder | 4 | 3 | 12 | Any request to change bank details is verified by telephone to a previously known number before payment is made, whoever it appears to come from. Invoice-fraud awareness carried in the IT-security toolbox talk on annual rotation | 3 | 2 | 6 |
| Ransomware or malware on a company laptop | Endpoint antivirus active, automatic updates on, full-disk encryption via BitLocker / FileVault (POL_HSQE_30 Section 5); Microsoft 365 / OneDrive provider backup as the primary backup (Section 4); GitHub history for the IMS and Van Packs portals | 4 | 2 | 8 | Annual restore test recorded in the APP_17 testing log (see RA_HO_02); Cyber Essentials certification targeted 31/12/2026 under KPI B4. Residual stays medium until the certification and the restore test both exist — at present the recovery position is documented but unproven | 3 | 2 | 6 |
| Weak, reused or shared passwords | Minimum 12 characters and no reuse across systems; no shared logins between operatives; the Directors hold master credentials for finance, telematics and cloud storage (POL_HSQE_30 Section 2) | 3 | 2 | 6 | Password manager adoption confirmed for the Directors and the admin post as part of the Cyber Essentials work | 2 | 1 | 2 |
| Interception or compromise when working on an unsecured public network | MFA on all cloud services; company laptops encrypted; no customer data stored locally on devices | 3 | 2 | 6 | Public Wi-Fi not used for finance or customer-portal access — tether to a company mobile instead. AMWS does not operate a VPN and this control is proportionate in its place | 2 | 1 | 2 |
| Compromise of a named customer-portal credential (Anglian Water, Severn Trent) | Customer-system access is by individual named credentials, never shared (POL_HSQE_30 Section 7); MFA where the customer platform supports it | 3 | 2 | 6 | Credentials revoked the same day a person leaves and the revocation recorded against the access list | 2 | 1 | 2 |
| Third-party or supply-chain IT exposure | AMWS does not host customer data on its own infrastructure; suppliers with IT access — for example Grenke leasing and the Lyreco account — are reviewed at the APP_19 Supplier Annual Review alongside physical-goods suppliers (POL_HSQE_30 Section 7) | 3 | 2 | 6 | None. Formal supplier security assessment would be disproportionate for an IT estate with no self-hosted customer data — the APP_19 review is the control, and the residual risk is accepted at medium | 3 | 2 | 6 |
| A notifiable personal-data breach is not identified or reported inside 72 hours | POL_HSQE_30 Section 8 incident pathway — 24-hour internal report to the Directors, isolate, assess, decide on ICO notification, log in APP_21 | 3 | 2 | 6 | The pathway has never been exercised. Walk it through as a tabletop at a weekly compliance call before the next annual review (Sean Ashton, by 04/09/2027) | 2 | 1 | 2 |
This document is maintained under AMWS's continuous-compliance model. Substantive revisions are reviewed and signed off by the Directors at the standing weekly Director / HSQE compliance call (Sean Ashton, Onyx + Leanne Mason). Currency, cross-references and minor edits are checked at the monthly Onyx site visit. The annual Management Review (September) provides the strategic-level confirmation. Compliance is therefore continuous, not gated on a single annual meeting.