• Anti-malware protection;
• Secure backup and recovery arrangements.

Use of personal devices is governed by the Council's BYOD Policy and is permitted only where authorised by the IT Service.

9. Data handling and classification

Information must be handled in accordance with its sensitivity and purpose.

Users must:

• Store information securely;
• Share information only where lawful and necessary;
• Dispose of information securely in line with the Retention Schedule;
• Avoid unnecessary duplication or local storage of sensitive information.

10. Incident and breach management

All suspected or actual information security incidents must be reported to the DPO immediately.

Security incidents involving personal data are managed in accordance with the Council's Data Breach Procedure, including assessment, containment, notification and learning.

11. Third-party and supplier security

Where third parties process Council information:

• Appropriate contractual safeguards are required;
• Suppliers must demonstrate suitable security measures;
• Access is limited to what is necessary for service delivery.

12. Remote working and personal devices

Remote working and use of personal devices introduce additional security risks.

Such activity is permitted only in accordance with the Council's BYOD Policy and related guidance, which sets out security requirements, user responsibilities and permitted use.