Login/Signup

Associates IT User Policy

October 2026

1. Introduction

UMi Holdings Limited and its subsidiary companies (trading as “UMi”) takes the security of its data and IT systems, and that of its employees and other interested parties very seriously.

As well as ensuring that the appropriate technology and infrastructure is in place to meet this  need, UMi requires that its employees and all other users of its systems are aware of the rules  and behavioural expectations surrounding the use of its IT systems and equipment and access to information.

UMi regularly reviews its IT security measures to ensure that they reflect changes in legislation  technology and relevant risks and remain in line with best practice recommendations for cyber security.

2. Definition

For the purposes of this policy document, the following terminology is used:

“IT systems” refers to all equipment, software and data supplied, accessed or used by UMi and  its staff and any other user, including devices authorised for use under its Bring Your Own Device  BYOD Policy.

“User” refers to all UMi employees, and any other party granted access to UMi’s IT systems such as associates, service providers, authorised contractors and temporary or agency workers.

3. Purpose

This policy outlines the rules that must be followed when using, or otherwise accessing, IT systems provided by UMi.

4. Scope

This policy applies to every user and to all UMi-owned, supplied or authorised hardware, software, online services and BYOD devices. Breaches could result in access being withdrawn, disciplinary action or, where appropriate, legal action.

5. Access Rights

Access will only be granted where required for an authorised business purpose and in line with UMi’s IT Security Administration Policy. Access rights are administered by the UMi IT Team, supported by UMi’s managed service provider ITPS following set authorisation procedures. Where a system is not managed by the UMi IT Team, e.g. a social media tool, the relevant line manager is responsible for overseeing permissions and access rights.

Each user has been provided with an individual account with a unique login and password. Multifactor authentication (MFA) must be used whenever it is available. MFA should be completed with Microsoft Authenticator (ideally with number matching where available) for Microsoft 365, Dynamics 365, etc. and all other software. In the rare instances where it is not possible to use the MS Authenticator application then MFA should be completed using a one-time passcode (OTP) sent via mobile phone (text or call) or a different email account to the one linked to the system being accessed.

All users are responsible:

  • for accessing only the systems and services for which approval has been granted and remain accountable for activity undertaken through their account

  • keeping credentials confidential and never sharing them following the password rules set out below

  • for using MFA where available, ideally via the MS Authenticator Application

  • for changing any suspected or compromised passwords immediately and notifying ITPS, the Chief Technology & Investment Officer and their line manager immediately

  • for locking devices whenever they are left unattended even for a few seconds, this applies no matter where you are working, in the office, home or elsewhere

  • for preventing third parties, including family and friends from using UMi equipment (laptops, mobiles, tablets, etc)

Passwords

All new users will be initially issued with a unique temporary password to their MS365 account which they will be forced to change at first login.

All passwords used to access UMi’s IT systems must comply with the following rules, even where a third-party system or application has a lower standard and is not enforced:

  • be a minimum of 12 characters in length and differ from your username

  • be random, complicated, unique and not previously used or used elsewhere (at work or home) and difficult to guess

  • combine unrelated words including both alphabetic and numeric characters and at least one special character (e.g. !, $, %, & etc) (don’t replace alphabetic characters with obvious characters, e.g. @ for ‘a’)

  • contain no more than two identical characters in a row

  • not be disclosed to others

  • do not use common passwords, for example 12345678, password (and variations of, qwertryuiop and do not include obvious dictionary words (when used on their own), proper nouns, dates, locations, sports teams, brands, etc

  • do not write passwords down or store them at any time or anywhere that can easily be accessed, e.g. in a notebook or diary or on a post-it note, etc

  • never store passwords in files that are not encrypted, and password protected on your device or network drive e.g. not in a Word, Excel, Notepad file, etc

  • Keeper must be used for storing passwords and not in native browser-based password stores, e.g. Chrome, Edge, Safari, etc

  • The master password required to access the Keeper vault should be twice the length of the password strength described above

Password throttling. After 3 unsuccessful attempts trying to access the network/laptop (MS365 login), users will be restricted for a period until further attempts can be made.

Users can change their passwords using the inbuilt functionality within MS365 and ITPS can force a password reset.

In addition, users may also make use of biometrics: fingerprint or face recognition technologies, where these are available and enabled.

6. Software

Only approved software and Software as a Service (SaaS) approved by UMi, Chief Technology & Investment Officer and licensed to UMi should be installed, accessed, trialled or subscribed to to process UMi’s data or be used on UMi issued devices. No other software files or folders may be transferred or downloaded onto UMi’s network from external networks or websites, or via any medium such as CD-ROMS, USB sticks or file transfer mechanisms unless it has been authorised as free of viruses and malware by ITPS.

Responsibilities of all users:

  • not to install, access, subscribe to, copy or download software of any sort unless specifically authorised by the Chief Technology & Investment Officer. This includes SaaS accessible via web browsers. Only software that is licensed to UMi may be installed on any computer or device, used or subscribed to and accessed via a web browser. Software requests should be made using the ICT Request Form available in SharePoint before any software is accessed, even for trial and evaluation purposes

  • in the event that a user receives software directly from a vendor, it should be passed to ITPS or the download request link verified for installation

  • do not attempt to disable or over-ride any of UMi’s installed software, including anti-malware software, firewalls and automatic updating services

Software updates and patches are centrally controlled by ITPS and pushed out to all devices. In order for software updates to be installed and effective, devices need to be restarted, NOT just turned off and on again. Users will be notified several times on their PC when it needs to be restarted for an update, if this is ignored after 24 days the PC will automatically restart and there is a risk that the user may lose data.

All users should restart their UMi issused PC at least once a week.

7. Artificial Intelligence (AI)

Large language models, generative AI, agents and agentic tools should be used responsibly to protect UMi’s reputation, information, cyber security and credibility. Only approved tools should be used for UMi work. All colleagues have access to MS Co-pilot this is the only AI tool that should be used for work purposes unless other tools have been explicitly approved by the Chief Technology & Investment Officer. Co-Pilot sits in UMi’s secure Microsoft environment and so there is no risk of data leakage, as there is with other AI tools.

When using AI an individual should always review and approve the output before use for any reason following the below checklist and never just used straight from the tool.

  • Accuracy: Outputs, facts, calculations, links and references have been independently checked

  • Privacy and confidentiality: Personal, commercially sensitive, proprietary, confidential or restricted information is appropriately protected

  • Bias and quality: Outputs have been reviewed for bias, unsupported assumptions, excessive agreement, UMi tone of voice and suitability

  • Intellectual property: Ownership, copyright, attribution and source reliability are known

  • Cyber security: AI-generated links, files, sources and instructions have been verified before use

  • Customer use: AI used in customer-facing services has been subject to appropriate approval, testing, oversight, and ongoing accuracy and consistency checks

Also consider how and when you use AI, given its environmental impact, so only use it responsibly.

8. Internet, Email, Messaging and Social Media Usage

Users must represent UMi professionally and use internet, email, conferencing, messaging and social media safely, lawfully and primarily for business purposes. Reasonable personal use is permitted where it does not affect duties.

Users must not:

  • download unapproved software or open suspicious links, files or attachments when processing UMi data or using UMi issued devices

  • access, promote or distribute obscene, pornographic, sexist, racist, defamatory, illegal, discriminatory or other inappropriate materials. This is a dismissible offence with potential criminal liabilities

  • use UMi systems for personal gain, gambling, impersonation or unauthorised activity

  • use UMi accounts to post political views or anything that will reflect poorly on UMi and its professional reputation

  • make inappropriate comments in relation to UMi in social media and comply with UMi’s digital and social media guidelines

  • disclose confidential or classified information without approval

  • share account credentials

Emails must be checked for accuracy, professionalism, intended recipients, authority and confidentiality.

A centrally managed UMi signature for use on UMi controlled domain emails will be used for external messages. Email signatures are important as they contain legally important information. Please notify ITPS if signatures are missing.

SharePoint or OneDrive links with appropriate permissions should be used in preference to attachments, unless there is no other choice, for internal and external communications. Sensitive attachments must be protected and passwords shared separately using a different communication method to the original communication.

Bcc must be used for bulk external emails.

Only managers with delegated authority can enter into subscriptions or commitments on UMi’s behalf after commercial terms and the software have been accepted via the ICT Request Form.

UMi reserves the right to monitor and audit the use of our systems and communications in accordance with applicable law and policy.

Personal WhatsApp accounts are not to be used for UMi-controlled, sensitive, confidential or official internal information/communications. Microsoft tools are to be used, although general customer communications can use WhatsApp where requested, approved and appropriate.

9. Malicious Code

UMi will take all necessary steps to protect the integrity of its software and information against the introduction of malicious code (malware), which may arise from the download or accessing of unauthorised software or mobile code, spam, email, messaging applications, SMS, websites, web applications, software, notebook computers, PDAs, mobile phones, portable memory media, or other means.

Users should remain vigilant for malware, phishing and other malicious activity and never knowingly introduce malware to UMi’s computer systems. If in doubt do not click on any links and report the email to ITPS as per below.

Unknown portable media, files, cloud transfers or software must not be used. Only trusted portable media and sources that have been scanned and approved by ITPS should be used/accessed.

Suspicious messages should not be opened and their links or attachments not clicked. Suspected phishing emails must be attached to a new email and sent to [email protected], copying the Chief Technology & Investment Officer.

Any suspected infection or security warning must be reported immediately to ITPS and the Chief Technology & Investment Officer, with a screenshot where possible.

10. Security

It is UMi’s policy to protect all computer hardware, software, data and documentation from misuse, theft, unauthorised access and environmental hazards. As well as the technical measures employed by the business, it is expected that all users will also take responsibility for security.

All users must:

  • protect their UMi issued PCs, laptops, printers and other devices from spillages (e.g. food and drink) and all equipment should be cleaned at regular intervals. Cleaning materials are available from Facilities on request

  • take any laptops, associated power cables and peripherals needed to perform their jobs away with them every evening for business resilience purposes

  • UMi issued or used for processing UMi data portable equipment left in offices, must be securely stored. Users working out of third-party premises, in particular must be extremely vigilant as access controls may not be as robust as those at UMi premises

  • ensure that UMi issued or used for processing UMi data equipment is not left unattended in public areas; if necessary, equipment must be locked out of sight, i.e. in the boot of a vehicle if it is unattended for short periods only and never overnight

  • always log out of systems in the correct manner and shut down machines when they are to be left unattended, including powering off any peripherals (monitor, keyboard, mouse, etc). If workstations/laptops/PCs are being left unattended for any period of time, then they must be locked using Ctrl+Alt+Del or windows key and L. Simply turning off the monitor/screen is not acceptable

  • ensure their data files are stored on their device OneDrive or SharePoint that are automatically backed up. Never store data on memory sticks unless it has been agreed in advance

  • keep to a minimum the number of files on your desktop as this slows down performance and they are more easily accessible should unauthorised access be gained to your device

  • always use links to OneDrive/SharePoint when sharing data where possible

Users must not:

  • in any circumstances remove UMi data and use for personal gain. All UMi data is the property of the company. Unauthorised removal of UMi data can result in legal action as it is considered theft, and if any personal data is involved then the activity is also illegal under data protection laws

  • use personal devices and non-company owned devices to store company data

Mobile Devices

Mobile Device Management (MDM) software is on all UMi issued and BYOD mobile phones/tablets. This enables the business to secure the device, control access to the data it owns on the device, set passwords, disable UMi devices and remotely delete data on UMi devices and BYOD if they are lost, transferred or stolen.

Users must:

  • keep the MDM software enabled and only use MDM enabled devices to access UMi company data

  • password protect, with a minimum eight-digit password, and where available use biometric ID security features

  • only download applications from the approved Google or Apple app store or listed in the MDM app catalogue

  • install operating system, security and application updates promptly

  • notify ITPS immediately if a device is factory reset

Smart Glasses

Employees/Associates must not use smart glasses, wearable cameras, AI-enabled recording devices or similar technologies to capture, process, transmit or store UMi, client, supplier or employee information or activities without prior written authorisation. Unauthorised recording, image capture, transcription or AI analysis (unless using an approved tool) of confidential business activities is strictly prohibited, and a breach of this requirement may result in disciplinary action, up to and including dismissal.

11. Loss or Theft of Equipment

The loss or theft of mobile devices/laptops presents the risk of unauthorised network access and data being compromised or stolen. It is imperative that in the event of such an incident swift action is taken to block the equipment and reduce the risk of any data breach.

All UMi issued laptops are encrypted with BitLocker, so can only be accessed with the correct username and password. In the event of loss or theft, UMi can also take steps to remove its access privileges.

Users must:

Immediately report the loss or theft of:

  • Any UMi mobile devices (including mobile phones, tablets, iPads, laptops etc)

  • BYOD devices

  • Personal devices where these are used to access company data e.g. email

As soon as it is possible to do so, including out of hours:

  • Contact Simon Goon on 07769 295161, or if unavailable, Nicki Clark on 07710 476907

  • Contact the ITPS 24-hour helpline for laptop loss (0191 442 0250)

  • Provide the exact details of the incident, including:

  • nature and time of the incident/loss

  • make and model of device

  • mobile number (if applicable)

  • details of the type of information accessed via / stored on the device, e.g. emails, MS365 applications, any other

12. Authority, Responsibility & Decision Making Levels

All users are responsible for following the detailed procedures specified in this Policy document.

The Chief Technology and Investment Officer is responsible for:

  • Determining that rules are suitable, thorough and effective in relation to changing threats and environments.

  • Maintaining approved software lists.

  • Monitoring internet and email usage.

  • Ensuring all users are aware of how to identify viruses and the steps to follow.

  • Incident management (including viruses and loss/theft of equipment).

Systems Administrators (the IT Technology Team, supported by ITPS) are responsible for implementing the necessary configurations and processes to support the above, including:

  • Access control / user administration.

  • Installation and maintenance of selected anti-malware software, patches and updates.

  • Checking that portable media are free from viruses before authorising for use.

13. Compliance

All users are responsible for adhering to this policy at all times; non-compliance mayresult in disciplinary action.

14. Review

This policy will be reviewed annually, or in line with changes in legislation, technology or risks that dictate a change to procedures. Any changes to the policy will be communicatedto all users.

15. Retention of Documents

All policies will be stored in accordance with the Document Retention Policy and should be available on the business’s Toolkit.

↑