Information Security and Cybersecurity Policy

Al-Waris Foundation depends on digital systems to support its charitable activities, administration, fundraising, communications, financial management and project delivery.

The charity is committed to protecting its:

Information security should be proportionate to the charity's size, activities, resources and risks.

Security controls must protect the charity without unnecessarily preventing legitimate charitable work.

This policy establishes Al-Waris Foundation's approach to:

This policy applies to trustees, staff where applicable, volunteers, contractors and other authorised persons who access Al-Waris Foundation information or systems.

It covers systems including:

The Board of Trustees retains overall responsibility for ensuring that significant information-security risks are appropriately managed.

Trustees should ensure that:

Technical and operational security may be delegated to appropriately authorised persons.

Al-Waris Foundation will seek to apply the following principles:

Information should only be accessible to people who legitimately require it.

Information should be protected from unauthorised or accidental alteration.

Important systems and information should remain reasonably available when required.

Users should receive only the access reasonably required for their role.

Material system actions should be attributable where reasonably practicable.

Critical systems should not depend upon a single security control where additional proportionate safeguards are available.

Information should be handled according to its sensitivity.

Information may broadly be treated as:

Public information may include:

Public information may still require integrity protection to prevent unauthorised alteration.

Internal information may include:

It should not automatically be made public.

Confidential information may include:

Access should be limited according to legitimate need.

Highly sensitive information may include:

Such information requires enhanced protection.

Access to systems must be authorised.

Permissions should reflect:

Access should not be provided merely because a person is associated with the charity.

Being a trustee does not automatically require operational access to every Al-Waris Foundation system.

Where trustees do not perform operational functions, they may receive governance information without receiving:

This supports least-privilege security.

Administrator privileges should be limited to people who genuinely require them.

Administrative accounts should receive enhanced protection because compromise may permit:

Where supported, systems should use role-based permissions.

Roles may distinguish between functions such as:

Custom permissions may be used where appropriate.

Shared accounts should be avoided where individual accounts are reasonably available.

Individual accounts improve:

Where a shared account is unavoidable, credentials must be securely controlled.

New system accounts should only be created where there is a legitimate need.

Access should be approved according to the sensitivity of the system.

Access should be removed or changed promptly when a person:

Critical access should not remain active indefinitely after it is no longer required.

The charity should periodically review access to significant systems.

Reviews should consider:

Passwords should be sufficiently strong for the system concerned.

Users should prefer:

Simple or easily guessed passwords should not be used for significant charity systems.

Passwords protecting important charity systems should not be reused across unrelated services.

A compromise of one service should not automatically compromise multiple charity accounts.

The charity encourages the use of reputable password managers for managing complex and unique credentials.

Password-manager access should itself be strongly protected.

Passwords should not normally be sent through:

Where credentials must be transferred, an appropriately secure method should be used.

Multi-factor authentication should be enabled for significant systems where supported.

It should be strongly prioritised for:

Administrative or otherwise privileged accounts should normally be required to use MFA where the service supports it.

A password alone should not be relied upon for critical administrative systems where stronger authentication is reasonably available.

Stronger authentication methods should be preferred where practicable.

Depending on the service, these may include:

SMS authentication may still be used where stronger options are unavailable or impractical.

Recovery codes should be stored securely.

They should not be stored openly alongside the password they are intended to recover.

Critical accounts should have appropriate recovery arrangements.

Recovery should not depend entirely on a single:

where loss of that item could permanently prevent the charity from accessing an essential system.

Email is a major security risk because attackers may impersonate:

Users should treat unexpected or unusual requests cautiously.

Official Al-Waris Foundation email addresses should be used for charity business where appropriate.

Different mailboxes may be used for functions such as:

Access should be granted according to responsibility.

Automated communications should be routed to appropriate official mailboxes according to their purpose.

For example:

Routing should be centrally managed where practicable.

Users should be alert to phishing indicators including:

Suspicious communications should be verified independently.

Requests involving:

should receive additional verification where appropriate.

Email alone should not always be treated as sufficient evidence for a high-risk financial instruction.

Users should avoid entering charity credentials after following an unexpected or suspicious link.

Where possible, the known official service should be accessed directly.

Unexpected attachments should be treated cautiously.

Files that may contain executable code or macros require particular care.

The charity's internet domain is a critical asset.

Domain-management accounts should have:

Unauthorised domain changes can compromise the charity's website and email simultaneously.

DNS configuration should only be modified by authorised persons.

Material changes should be reviewed carefully, particularly changes involving:

Where reasonably supported, Al-Waris Foundation should maintain appropriate email authentication controls such as:

These controls can reduce unauthorised use of the charity's domain for email impersonation.

The charity website should be designed and operated using proportionate security practices.

These should include where relevant:

Public website traffic involving personal or sensitive information should use HTTPS.

HTTP traffic should normally redirect securely to HTTPS where appropriate.

Administrative functionality should not be exposed unnecessarily.

Admin access should require authentication and appropriate authorisation.

Sensitive administrative actions may require stronger controls.

Content-management permissions should distinguish between users who can:

where proportionate.

Content editing rights should not automatically grant full system administration.

Where supported, public content should use controlled workflows such as:

This reduces accidental or unauthorised public changes.

Material CMS content should retain version history where reasonably practicable.

This allows the charity to:

Databases should not provide unrestricted public access to confidential information.

Controls may include:

Where a public website legitimately reads information directly from a backend service, public access should be restricted to information intended for publication.

Draft, private, administrative or sensitive records must not become publicly accessible merely because they share the same database.

Where reasonably practicable, production systems should be separated from:

Testing should not unnecessarily alter live charity information.

Changes to live payment infrastructure require particular care.

Development or testing must not unintentionally:

Test environments should be used where supported.

The charity should minimise direct handling of payment-card information.

Where possible, regulated payment providers should handle card processing.

The charity should not store full card details unless there is a legitimate requirement and appropriate compliance framework.

Payment-provider accounts should use:

Live credentials must be treated as highly sensitive.

Payment and other webhooks should be authenticated or cryptographically verified where the provider supports this.

An incoming request should not automatically be trusted merely because it claims to originate from a payment provider.

Secrets must not be intentionally committed to:

unless the credential is specifically designed to be public.

Sensitive configuration should be managed using appropriate environment or secret-management systems.

Production secrets should be separated from development configuration where appropriate.

Variables intentionally exposed to client-side applications must never contain secrets.

A variable being labelled as an environment variable does not make it confidential if the application sends it to the browser.

Repository access should be limited according to legitimate development and governance needs.

Repositories should use appropriate:

Material security-sensitive changes should receive proportionate review before production deployment.

This is particularly important for changes involving:

Where practicable, software changes should be validated through appropriate automated testing.

This may include:

Automated testing does not replace appropriate human review.

Software dependencies should be monitored for known vulnerabilities.

Critical or materially exploitable vulnerabilities should be addressed according to risk.

Not every low-severity advisory requires emergency action.

Development workflows may use proportionate automated checks such as:

Security tools should support rather than replace appropriate judgement.

Production deployments should occur through authorised processes.

Where practicable:

Hosting accounts should receive strong protection because compromise may allow an attacker to:

Administrative hosting access should therefore be tightly controlled.

Before using significant cloud services, Al-Waris Foundation should consider:

Third-party services may include:

The charity should apply proportionate due diligence according to the sensitivity and importance of the service.

Analytics systems should be configured in a manner consistent with:

Analytics accounts should not receive broader access to personal information than reasonably required.

Where applicable consent is required for non-essential analytics, the analytics technology should not be activated before valid consent.

Withdrawal of consent should be respected appropriately.

See the Data Protection and UK GDPR Policy and Cookie Policy where applicable.

Official social-media accounts are charity digital assets.

They should use:

Personal credentials should not become the charity's only means of recovering an important account where avoidable.

Access should be removed when a person no longer manages the charity's social media.

Passwords should be changed where necessary following:

Devices used to access confidential charity information should have proportionate protection.

This may include:

Personal devices may be used for charity activity where appropriately secure.

Users should take reasonable steps to prevent:

Loss or theft of a device containing or providing access to charity information should be reported promptly.

Actions may include:

Before disposing of or transferring a device used for charity activity, confidential information should be securely removed where reasonably practicable.

Simply deleting visible files may not always securely erase them.

Supported security updates should be installed within a reasonable period according to risk.

Critical security updates may require accelerated action.

Unsupported operating systems or software should not be used for sensitive charity activity where doing so creates an unreasonable security risk.

Where replacement cannot occur immediately, compensating controls should be considered.

Reasonable precautions should be taken against:

Suspicious devices may need to be disconnected from charity systems pending investigation.

Users should avoid installing unnecessary or untrusted software on devices used for sensitive charity activities.

Particular caution should be exercised with:

Sensitive activity over untrusted public Wi-Fi should be avoided or appropriately protected.

Users should exercise particular caution when accessing:

Information security also depends on physical controls.

Reasonable measures may include:

Confidential or highly sensitive information should not be unnecessarily displayed where unauthorised people can view it.

USB drives and other removable storage should be used cautiously.

Sensitive information should not be copied to uncontrolled removable media without a legitimate reason.

Appropriate encryption should be used for sensitive information where reasonably necessary.

Encryption may apply to:

Important information should have proportionate backup arrangements.

Backups should reflect:

Where practicable, critical backups should not depend entirely upon the same account or system as the primary data.

This reduces the risk that one compromise destroys both live data and recovery copies.

Critical backup arrangements should be tested periodically where practicable.

A backup should not be assumed usable merely because a system reports that it exists.

The charity should avoid retaining unnecessary personal information.

Reducing unnecessary data also reduces the potential impact of a security breach.

Confidential information should only be shared where there is a legitimate reason.

Recipients should receive only the information reasonably necessary.

Sensitive files should not be made publicly accessible merely for convenience.

Where links are used, appropriate access restrictions should be considered.

Beneficiary information may create particular risks if exposed.

Records should avoid unnecessary collection of:

unless genuinely required.

Safeguarding information requires enhanced confidentiality.

Access should be restricted to people with a legitimate safeguarding or governance need.

Security controls must not prevent urgent safeguarding information from reaching the appropriate person.

Donor information should be protected from unauthorised access or disclosure.

Donation history, contact details and payment-related information should only be available to appropriately authorised users.

Financial information including:

should receive appropriate protection.

Data exports may create additional security risk because they can bypass normal application access controls.

Exports containing confidential information should be:

Significant systems should maintain appropriate audit logs where supported.

Logs may record:

Security and audit logs may themselves contain sensitive information.

Access should be appropriately restricted.

Logs should not record passwords or unnecessary secrets.

The charity may use proportionate monitoring to identify:

Monitoring should remain consistent with privacy and data-protection obligations.

A cybersecurity incident may include:

Where a significant cyber incident is suspected, appropriate immediate actions may include:

Actions should be proportionate to the incident.

Where a password or authentication credential is suspected to be compromised:

Reusing the compromised password elsewhere increases the scope of the response required.

Where an email account is compromised, the response should consider:

Attackers may create hidden forwarding or mailbox rules, so changing the password alone may be insufficient.

Where the website is compromised, the charity should consider:

If ransomware is suspected:

Payment of a ransom should not be treated as a routine solution and may create legal, sanctions and practical risks.

A security incident involving personal data must also be assessed under the Data Protection and UK GDPR Policy.

The charity should determine:

Where a personal-data breach meets the applicable legal threshold for notification to the Information Commissioner's Office, it should be reported within the required timeframe.

Current legal requirements should be checked when an incident occurs.

Where applicable law requires affected individuals to be informed, communications should be:

The charity should not conceal a serious breach merely to avoid reputational harm.

A significant cyber incident may also constitute a serious incident for charity-regulatory purposes.

Trustees should assess the incident under the Serious Incident Reporting Policy.

The charity may report cybercrime, fraud or extortion to appropriate law-enforcement or reporting bodies where necessary.

Significant security incidents should be documented.

Records may include:

Following a significant incident, the charity should consider:

Critical digital services should be considered within the charity's continuity planning.

The charity should understand how it would continue essential functions if a key system became unavailable.

Following a major outage or cyber incident, recovery should prioritise systems according to charitable and operational importance.

Examples may include:

AI tools may support legitimate charity activities.

Users must consider security before providing AI systems with confidential information.

Highly sensitive information should not be entered into an external AI service unless the use has been appropriately assessed and authorised.

Personal data supplied to AI systems must be handled consistently with the Data Protection and UK GDPR Policy.

Where possible, unnecessary personal identifiers should be removed before using external AI tools.

AI-generated software should not be assumed secure merely because it was generated automatically.

Material code should undergo appropriate:

Automated development or administrative agents should receive only the access reasonably required for the task.

They should not be granted unnecessary production credentials or broad administrative access.

Automated tools must not make material production changes outside their authorised scope.

High-risk changes involving:

should receive appropriate approval and validation.

Security measures should be proportionate.

Controls that are excessively difficult may encourage unsafe workarounds.

The charity should therefore seek secure processes that remain practical for legitimate users.

People with access to significant systems should receive proportionate security awareness.

Topics may include:

People with privileged access should understand the additional risks associated with:

Anyone who identifies a suspected security weakness or incident should report it promptly to an appropriate authorised person.

People should not attempt unauthorised security testing against charity systems merely because they believe a vulnerability may exist.

Good-faith vulnerability reports received from external researchers should be assessed appropriately.

The charity should:

Authorised security testing may include:

Testing must be appropriately scoped to avoid damaging production systems or third-party services.

If a service provider suffers a breach affecting Al-Waris Foundation, the charity should assess:

When a technology supplier relationship ends, the charity should consider:

Security records should be retained in accordance with the Records Retention and Disposal Policy.

Retention periods should reflect:

Information-security concerns should be shared only with people who reasonably need to know.

However, confidentiality must not be used to conceal:

Breaches of this policy may result in:

The response should be proportionate to the circumstances.

This policy should be read alongside:

This policy will be reviewed:

Version: 2.0 Status: Approved Approved by: Board of Trustees Approval date: 25/08/2026 Next scheduled review: 24/08/2027