Information Security Policy Statement

Purpose and scope

This statement sets out how Xcademia protects the information it holds about learners, customers, partners and its own business, and the systems and platforms used to deliver training. It applies to our staff, associate trainers and specialist partners who handle our information.

It also supports ISO 9001:2015 requirements on the infrastructure and environment we need for our services (clause 7.1.3) and the control of documented information (clause 7.5).

Our approach and status

Xcademia holds Cyber Essentials, and we maintain supporting information security and data protection policies. Our information security policies are aligned with ISO/IEC 27001 principles. Alignment describes the framework we use. It does not represent ISO/IEC 27001 certification.

Handling information

We handle information according to agreed access, retention, secure sharing and disposal requirements. In practice, this means:

• Access control: people are given access to systems and records only through individual accounts.
• Least privilege: access is limited to what a person needs for their role and is removed when it is no longer needed.
• Secure sharing: we share information only with those who need it, using approved and protected methods.
• Retention and disposal: we keep information only for as long as it is needed for the purpose or required by law, and then dispose of it securely.
• Documented information: policies, procedures and records are controlled so that the current version is available where it is needed and is protected from loss or unauthorised change.

Training exercises

Our training exercises use synthetic or anonymised information wherever possible. We do not use real personal data or live customer systems in labs and simulations unless there is a clear need, it is agreed in advance and appropriate safeguards are in place.

Staff awareness

Everyone who works for us, including associate trainers and partners, is expected to understand and follow our information security requirements. We make people aware of their responsibilities, including protecting devices and accounts, handling information carefully and recognising and reporting suspicious activity.

Incident reporting and escalation

Anyone who suspects a security incident, a lost device or a data breach must report it straight away. Reports go to management, who assess the incident, take steps to contain and recover from it, and decide whether anyone needs to be told. Where personal data is affected, we follow data protection law, including reporting to the Information Commissioner's Office and notifying affected people where the law requires it. We record incidents and the actions taken, and use what we learn to improve.

You can report a concern to info@xcademia.com or +44 20 8050 4999.

Data protection and review

How we collect and use personal information is explained in our privacy policy, which addresses UK GDPR and the Data Protection Act 2018. We keep our Cyber Essentials current and review this statement at least once a year, and earlier following a material change or a significant incident.

Questions about this policy?

Contact us or email info@xcademia.com.