Digital Foundations

Most security incidents and data errors at work don't start with sophisticated attacks — they start with basic mistakes. A file saved in the wrong place, a sensitive attachment sent to the wrong person, or a shared password written in a chat message. Getting the fundamentals right removes the majority of everyday risk.

Always save work files to your organisation's approved storage (cloud drive or file server), not your personal desktop or downloads folder. Personal devices are not backed up by IT and cannot be audited. When naming files, use clear, descriptive names with dates where relevant — avoid "final_v2_REAL_v3.docx" patterns. Before deleting any file, confirm it is not referenced elsewhere and is not subject to a retention policy.

Use your organisation's approved communication tools for work conversations. Don't discuss client data, credentials, or internal decisions in personal email, personal messaging apps, or public channels. When sending files with personal or sensitive information, use the approved file-sharing method — not plain email attachments when avoidable. If you're unsure whether a channel is appropriate for the information you're sharing, assume it isn't and check first.

Personal data includes names, email addresses, phone numbers, and anything that could identify an individual. It should only be accessed, copied, or shared when you have a clear work reason to do so. Don't download bulk data to local storage. Don't copy customer data into tools that aren't approved for that purpose. If your role doesn't require access to a particular data set, don't access it — even if you technically can.

Lock your screen when you step away — even briefly. Keep your operating system and applications up to date. Don't install unauthorised software on work devices. Use strong, unique passwords for every work account, and use your organisation's password manager if one is provided. If you receive unexpected login prompts or requests to enter credentials, stop and report it before proceeding.