Trust Centre and Sub-processor List

An inventory of information and associated assets is maintained, and each asset has a designated owner responsible for protecting it.

Acceptable use rules set out user responsibilities and handling requirements for systems and information, based on classification.

Employees and third parties return all company assets when their employment or contract ends, tracked through offboarding checklists.

Removable media is handled according to its classification, authorised and logged when taken off-site, and securely destroyed when no longer needed.

Data and licensed software are securely wiped from equipment before it is disposed of or re-used, and disposal records are kept.

Continuity plans are integrated with business continuity arrangements so security controls stay in place during a crisis.

Systems and infrastructure are designed with redundancy and backup plans so information stays available during disruption.

System usage and performance are monitored to forecast capacity needs and maintain uptime.

Backups follow defined procedures and are tested regularly, and recovery test results are retained.

Critical systems have redundant processing capacity to meet availability objectives.

Inspra takes part in industry groups and professional associations to stay current on emerging threats, regulation and good practice.

Legal, statutory, regulatory and contractual requirements, including those that apply to cryptography, are identified, documented and reviewed regularly.

Use of licensed software and proprietary information is governed by policy and checked through periodic reviews.

Records are protected against loss, unauthorised access and destruction in line with regulatory and business requirements.

The information security program is independently reviewed at planned intervals and whenever significant changes occur.

Managers regularly check that day-to-day operations comply with internal security policies and applicable standards.

Audit testing is planned in advance so it does not disrupt operations or put data integrity at risk.

Vulnerabilities are tracked through vendor advisories and security testing, and patches are applied and reviewed regularly.

Systems follow secure baseline configurations that are tracked, verified and updated through formal change control.

Software installation on operational systems is controlled, and only approved software is permitted.

A classification scheme assigns sensitivity levels to information based on its legal, regulatory and business impact.

Information is labelled according to its classification so people know how to handle it.

Information sent by email, in backups or to suppliers follows formal transfer procedures and is protected with encryption and access controls.

Personal information is protected in line with applicable privacy law through encryption, access control and privacy policies.

Information is securely deleted when it is no longer required, and defined retention periods are enforced.

Sensitive data is masked where appropriate to limit how much of it is exposed.

Technical and administrative controls detect and prevent unauthorised transfer of information out of the organisation.

Remote access policies and controls protect information that is accessed or processed outside the office.

Staff working from home use company-issued laptops managed under the same endpoint security requirements.

Endpoint and mobile device policies require users to lock or secure unattended devices and meet endpoint security requirements.

Anti-malware tools with automatic updates and scanning are deployed, backed by user awareness training.

A dedicated access control policy restricts access according to business role and security requirements, and requires regular reviews of access rights.

Formal onboarding and offboarding processes register new users and remove departing users promptly.

Passwords and other authentication secrets are issued, stored and managed securely under strong password rules.

Access is provisioned and revoked through formal approval, reviewed periodically, and removed systematically when people leave.

Privileged access is limited to authorised personnel through role-based access and separate administrative accounts.

Access to systems, functions and data is restricted to what each role needs.

Sign-in to systems uses secure authentication, including strong password requirements and session management.

Tools that can override system or application controls are restricted and used only with documented approval.

Procedures define who contacts regulators and other authorities when a breach or regulatory incident occurs.

Incident response roles, responsibilities and procedures are formally documented and ready to use across all systems.

Security events are assessed to decide whether they are incidents that need escalation, logging or reporting.

Incidents are handled through defined steps for detection, reporting, analysis and mitigation.

Post-incident reviews identify root causes, and corrective actions are implemented to prevent recurrence.

Digital evidence related to security events is identified, collected and preserved in a way that protects its integrity.

All staff must report observed or suspected security events through designated channels.

Findings from vulnerability assessments, penetration tests, system logs and vendor partners inform how threats are mitigated.

System events, user activity and administrator actions are logged and reviewed to detect anomalies.

Systems are monitored for suspicious behaviour using logs, alerts and vulnerability reports.

System clocks are synchronised to an Australian NTP time source so log timestamps line up across systems.

Network access and traffic are controlled with firewalls, network segmentation, network access control and enforced VPN use.

Internal and outsourced network services have defined security controls and service levels.

Networks are segmented by function, with access rules controlling traffic between segments.

Web access is filtered to block malicious sites and unauthorised content.

Background checks are completed for new hires in line with legal requirements and in proportion to the risk of the role.

Employment contracts set out the information security responsibilities of both staff and the company.

All staff receive security training and periodic awareness refreshers relevant to their roles.

A defined disciplinary process addresses breaches of security policy and is communicated to all staff.

Security obligations that continue after employment ends are defined and communicated during offboarding.

Staff sign non-disclosure agreements, which are reviewed regularly against data protection obligations.

Defined perimeters and security zones protect areas that hold critical information and equipment.

Access passes and visitor logs restrict entry to secure areas to authorised people.

Offices and server rooms are protected with physical and environmental controls that prevent unauthorised access.

Surveillance, alarms and access logs detect unauthorised attempts to enter secure areas.

Fire protection, surge protection and secure storage guard against environmental hazards and physical attack.

Formal procedures govern authorised access, visitor escorts and conduct within secure areas.

Clear desk and clear screen rules reduce the risk of sensitive information being seen or removed.

Equipment is located and protected to prevent theft, environmental damage and unauthorised access.

Power, UPS and HVAC systems are in place to prevent service interruptions caused by utility failures.

Power and network cabling is routed and secured to prevent damage, interference or tapping.

Equipment is maintained on a regular, tracked schedule to keep systems available and reliable.

Cryptography protects sensitive information, and encryption keys are managed securely.

Applications that exchange data over public networks use HTTPS/TLS, input validation and secure session handling.

System design and integration follow least privilege, defence in depth, secure defaults and modular design.

An information security policy and supporting topic-specific policies are approved by management, communicated to staff, and reviewed at planned intervals or after significant change.

Security responsibilities are defined and assigned across leadership, IT, HR and operational staff, so every control has an accountable owner.

Conflicting duties are separated across management, IT, HR and security roles to reduce the risk of unauthorised or accidental changes.

Management requires all employees and contractors to follow security policies and provides the resources needed to do so.

Security risks and responsibilities are identified during project planning and addressed throughout the project lifecycle.

Procedures for key IT and security operations are documented, shared with the people who use them, and reviewed regularly.

Supplier access to information is risk-assessed, and suppliers that handle sensitive data are covered by security agreements and monitoring.

Supplier agreements include security clauses covering how information is processed, transmitted and stored.

Risks from ICT products and services are addressed in risk assessments and contractual obligations.

Supplier services are monitored and reviewed regularly, and security risks are reassessed whenever service delivery changes.

Cloud service providers are assessed and bound by a data processing agreement or their published data processing terms, which we review before use. We use Australian regions or location pinning wherever available.

Contracts for outsourced development define security requirements and how the vendor's work is monitored.