THE URBAN NETWORK GROUP PTY LTD · ABN 53 687 320 234

Security Policy

Original policy dates retained from the earlier website. Where an email address was obscured in the source, please call 0402 338 763 for the appropriate contact.

The Urban Network Group Pty Ltd · Last updated: 1 January 2026

This policy describes the technical and organisational security controls maintained by The Urban Network Group Pty Ltd to protect our own systems, and the standards we apply when delivering security services to clients. Our security practices are aligned with the Australian Signals Directorate (ASD) Essential Eight framework.

1. Security governance

Security is a core organisational priority at TUN. We maintain a continuous security improvement programme that includes:

• Regular review of security controls and policies (at minimum annually)
• Risk assessments conducted prior to onboarding new services or vendors
• Clear assignment of security responsibilities within the team
• Security considerations embedded in all project and service delivery activities

2. ASD Essential Eight alignment

TUN implements and maintains controls aligned to the ASD Essential Eight Maturity Model. Our current implementation covers:

• Application control: Only approved and tested applications are permitted to execute on TUN-managed systems
• Patch applications: Critical patches are applied within 48 hours of release; all others within 14 days
• Configure Microsoft Office macro settings: Macros are disabled by default and enabled only with explicit approval
• User application hardening: Web browsers and productivity applications are configured to block untrusted content
• Restrict administrative privileges: Administrative access is granted on a least-privilege basis and reviewed quarterly
• Patch operating systems: Operating systems are patched within 48 hours for critical vulnerabilities
• Multi-factor authentication: MFA is mandatory for all staff accessing TUN systems and client environments
• Regular backups: Daily automated backups with offline/offsite copies tested quarterly

3. Access control

Access to TUN systems and client environments is governed by the principle of least privilege:

• All staff are issued individual accounts — shared credentials are not permitted
• Multi-factor authentication (MFA) is enforced for all remote access, email, and cloud services
• Privileged access is separately credentialed and subject to additional logging and monitoring
• Access rights are reviewed when staff roles change and revoked within 24 hours of departure
• Client environment access is documented, scoped to the minimum required, and logged

4. Data protection and encryption

• All data in transit is encrypted using TLS 1.2 or higher
• Data at rest is encrypted using AES-256 or equivalent standards
• Portable devices and storage media used in the delivery of services are encrypted
• Client data is logically segregated and never commingled with other client data
• Sensitive credentials are stored in enterprise-grade password management systems with zero-knowledge architecture

5. Network security

• TUN operational networks are segmented and protected by enterprise-grade firewalls and intrusion detection systems
• All remote access to client systems is conducted over encrypted VPN or Zero Trust Network Access (ZTNA) connections
• DNS filtering and web proxy controls are applied to block access to known malicious sites
• Network traffic is logged and reviewed for anomalous activity

6. Endpoint security

• All TUN-managed endpoints are protected by enterprise endpoint detection and response (EDR) software
• Endpoint agents provide real-time threat detection, behavioural analysis, and automated response
• USB and removable media usage is controlled and logged
• All endpoints are subject to the patch management controls described in Section 2

7. Vendor and third-party security

TUN assesses the security posture of all significant third-party vendors and technology partners before use. Our key service providers include enterprise-grade platforms operated by Microsoft and Google, which maintain their own comprehensive security certifications (ISO 27001, SOC 2 Type II). Vendor security assessments are reviewed annually.

8. Incident response

TUN maintains a documented Incident Response Plan (IRP) covering detection, containment, eradication, recovery, and post-incident review. In the event of a security incident affecting client data:

• The affected client will be notified within 24 hours of TUN becoming aware of the incident
• TUN will provide regular updates on the investigation and remediation progress
• Where required, TUN will assist with mandatory breach notifications under the Notifiable Data Breaches (NDB) scheme (Privacy Act 1988)
• A post-incident review will be conducted and remediation actions implemented to prevent recurrence

9. Business continuity and disaster recovery

• TUN maintains a Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) reviewed annually
• Critical operational systems have documented recovery time objectives (RTO) and recovery point objectives (RPO)
• Backup restoration is tested quarterly to validate recoverability
• TUN staff are trained on emergency procedures and escalation paths

10. Staff security

• All TUN staff complete security awareness training upon commencement and annually thereafter
• Staff handling sensitive client data are subject to reference and identity verification checks
• Phishing simulation exercises are conducted periodically to maintain staff vigilance
• Acceptable use policies govern all staff use of TUN and client systems

11. Physical security

• TUN does not operate a public-facing data centre; client data is hosted in enterprise cloud environments
• Physical access to any TUN office or workspace is controlled and restricted to authorised personnel
• Screens are locked when unattended; clear desk policies are enforced
• Physical documents containing sensitive information are stored securely and disposed of via cross-cut shredding

12. Vulnerability management

TUN conducts regular vulnerability scanning of its operational systems and promptly remediates identified weaknesses. Clients engaged on managed security services receive vulnerability scanning as part of their service package. Critical vulnerabilities are escalated and remediated in accordance with the patch timelines in Section 2.

13. Reporting a security concern

If you identify a security vulnerability in our systems or services, or wish to report a security concern, please contact us immediately at [email address obscured in the retrieved source] or call +61 (0) 402 338 763. We are committed to investigating all reports promptly and responsibly.