Purpose
ICC Group’s screening, due diligence and investigative work involves information that requires responsible handling. The purpose of this policy statement is to define the principles governing the protection and authorised use of that information.
The policy objectives are confidentiality, integrity and availability: protecting information from inappropriate disclosure, maintaining its reliability, and supporting access by authorised people when needed.
Browse sections
Scope
These principles apply to business and personal information handled in connection with ICC’s activities, including electronic records, physical documents, reports and communications.
Security responsibilities extend to personnel and external parties entrusted with information within the scope of their work.
Responsibility and accountability
Responsibility for information security must be assigned within the business. Those handling information must understand their obligations, follow applicable instructions and report suspected problems through the appropriate channel.
Management is responsible for approving supporting arrangements and providing resources appropriate to the risks.
Authorised access
Access must have a legitimate business purpose and reflect the individual’s responsibilities.
Information should not be accessed out of personal interest or shared merely because a recipient works for the same organisation. Access should be reconsidered when duties change or an engagement ends.
Credentials must not be shared or used to bypass access restrictions.
Responsible collection and handling
Information collection should be relevant to the instructed activity and permitted by applicable law.
Confidential records must be handled according to their sensitivity, any source restrictions, the engagement requirements and relevant legal obligations.
Personnel should use approved business channels and avoid transferring confidential work to personal accounts or unauthorised storage.
Disclosure and external parties
Information should be disclosed only to recipients authorised and legally entitled to receive it, and only to the extent needed for the purpose.
External providers entrusted with information should be subject to appropriate requirements reflecting their role and the sensitivity of the material.
Outsourcing an activity does not remove the need to assess its confidentiality and security implications.
Record integrity
Verification and reporting should preserve the distinction between confirmed facts, source statements, allegations and unresolved matters.
Records should be protected against unauthorised alteration. Corrections should be handled in a way that preserves an appropriate explanation of material changes.
Risk-based protection
Protective measures should reflect the nature of the information, the likelihood and consequences of misuse, and applicable legal and contractual requirements.
Supporting arrangements should address relevant risks associated with devices, systems, physical records, transmission, access and disposal.
This public statement does not disclose sensitive implementation details or assert certification to a particular standard.
Incident reporting
Suspected loss, inappropriate access, mistaken disclosure or other security concerns should be reported promptly.
External parties can contact gcc@iccverify.com with the subject “Information security concern”. Provide a concise description and a means of contact. Do not attach confidential case records or exploit suspected vulnerabilities to demonstrate the issue.
Incident handling should address assessment, containment, investigation and recovery, with notifications made where required by law or contract.
Continuity and retention
Information availability should be considered in business continuity and recovery arrangements.
Records should be retained for justified purposes and disposed of through appropriate methods when no longer required. Continuity copies and backups should be considered within the overall retention arrangements.
Awareness and improvement
Personnel should receive security guidance appropriate to their responsibilities. Material incidents, business changes and identified weaknesses should inform review and improvement.
The statement and supporting procedures should be reviewed at intervals approved by management and when significant changes justify review.
Further information
For personal information questions, read our Privacy Policy or contact gcc@iccverify.com.
No system or communication method can eliminate every security risk. The purpose of this statement is to establish responsible practices and accountability.