Security Policies

This policy defines the acceptable use of Carriyo's information systems, including computers, networks, email, internet, and cloud services. It aims to protect Carriyo, our employees, and our…

This policy defines the requirements for controlling access to Carriyo's information systems, applications, and data. It ensures that access is granted based on the principle of least privilege and…

This policy establishes requirements for protecting Carriyo's endpoints, servers, and cloud workloads against viruses, malware, ransomware, and other malicious software. It ensures that anti-malware…

This policy governs the use of artificial intelligence (AI) tools, large language models (LLMs), and machine learning services within Carriyo. It establishes guardrails to ensure that AI usage does…

This policy establishes the framework for business continuity management at Carriyo. It ensures that critical business functions can continue during and after a disruption, minimizing impact on our…

This policy defines the process for managing changes to Carriyo's production systems and infrastructure. It ensures that changes are implemented in a controlled manner, minimizing risk to service…

This policy defines how Carriyo collects, processes, stores, and protects personal data in compliance with the General Data Protection Regulation (GDPR), the UK GDPR, and other data protection…

This policy establishes the requirements for retaining, archiving, and securely disposing of data across Carriyo's systems and operations. It ensures that data is kept only for as long as necessary…

This policy defines the acceptable and secure use of email and instant messaging systems at Carriyo. It establishes controls to protect against data leakage, phishing, social engineering, and other…

This policy establishes information security requirements throughout the employee lifecycle at Carriyo — from pre-employment screening through onboarding, ongoing employment, and termination or…

This policy defines Carriyo's approach to managing information security incidents. It ensures that incidents are identified quickly, managed effectively, and that lessons learned are used to improve…

This policy defines Carriyo's information classification scheme and the handling requirements for each classification level. It ensures that information assets are protected with controls…

This policy establishes the framework for managing information security across Carriyo. It defines our commitment to protecting the confidentiality, integrity, and availability of all information…

This policy defines the requirements for IT disaster recovery at Carriyo, ensuring that critical technology services and data can be restored within acceptable timeframes following a disruptive…

This policy establishes the security requirements for mobile devices and personal devices used to access Carriyo systems and data. It defines the controls required to protect Carriyo's information…

This policy establishes physical and environmental security controls to prevent unauthorized physical access, damage, and interference to Carriyo's information and information processing facilities.…

This policy defines the requirements for managing software releases at Carriyo, from development through to production deployment. It ensures that releases are secure, tested, approved, and deployed…

This policy establishes the information security requirements for remote working at Carriyo. As a fully remote organisation, Carriyo must ensure that information assets are protected regardless of…

This policy defines Carriyo's methodology for identifying, analysing, evaluating, and treating information security risks. It provides a consistent and repeatable approach to risk assessment that…

This policy establishes the requirements for software testing at Carriyo, ensuring that all software deployed to production has been adequately tested for functionality, security, performance, and…

This policy establishes requirements for identifying, assessing, managing, and monitoring information security risks associated with Carriyo's suppliers and third-party service providers, ensuring…

This procedure defines the process for identifying, documenting, analyzing, and resolving nonconformities within Carriyo's Information Security Management System (ISMS). It ensures that corrective…

This procedure defines the requirements for creating, reviewing, approving, distributing, revising, and retiring all documents within Carriyo's Information Security Management System (ISMS). It…

This document establishes the requirements for integrating information security into all projects at Carriyo, regardless of type or size. Security must be considered from project initiation through…

This document establishes the process for collecting, analysing, and acting on threat intelligence at Carriyo. Effective threat intelligence enables the organisation to proactively identify, assess,…