1. Governance principles
- Purpose and proportionality: information is collected and retained for defined business, service, safety or legal purposes;
- Accountability: responsibilities are assigned for systems, information, access and risk decisions;
- Confidentiality: access is limited according to role, need and authority;
- Integrity: reasonable measures protect information from unauthorised or accidental alteration;
- Availability: systems, backups and recovery arrangements support operational needs;
- Lifecycle management: information is classified, retained, archived and disposed of according to risk and obligation.
2. Roles and responsibilities
KDFS leadership oversees governance and risk. System and process owners maintain appropriate controls. Authorised users must follow access, confidentiality, security and records requirements. Customers remain responsible for decisions and information under their control, as described in applicable agreements and product policies.
3. Safeguards
Safeguards are selected according to risk and may include encryption, multi-factor authentication, least-privilege access, tenant separation, logging, monitoring, vulnerability management, backups, change control, incident response and supplier assessment.
4. Retention and disposal
KDFS uses a principle-based approach: records are retained for their operational, contractual, accountability, safety and legal value, then securely deleted or de-identified when no longer reasonably required. Product and customer requirements may result in different retention periods.
5. Monitoring and improvement
Controls and risks are reviewed through operational monitoring, external security-rating services, incident and change reviews, customer feedback and periodic policy review. Findings are prioritised according to likelihood, consequence and contractual or legal importance.
6. Contact and assurance requests
Email [email protected] and describe the organisation, purpose and documents or evidence requested.