Information security policy: information security at the centre of how we work.

Sterling International Consulting delivers management consultancy services with information security at the centre of its business processes, to protect information generated within the organisation, information acquired during project execution and information stored or transmitted during service delivery. Sterling's offices in the United Arab Emirates, India and the Philippines hold ISO/IEC 27001 certification for their information security management systems; current certificate details are available on request.

It is the policy of Sterling to:

• Ensure the confidentiality, integrity and availability of business information.
• Make details of our policy known to all other interested parties, including external parties where appropriate, and determine the need for communication and by what methods relevant to the business management system.
• List all information assets and the security risks that may arise for each of them, taking a process- and project-based approach to information risk management.
• Comply with all legal requirements, codes of practice and all other statutory, regulatory and contractual requirements applicable to our activities, satisfy applicable requirements related to information security and continually improve the information security management system.
• Provide the required resources, including hardware, software, applications, trained and competent staff and any other requirements, to ensure these objectives are met.
• Ensure that all employees are made aware of their individual obligations in respect of this information security policy.
• Maintain a management system that achieves these objectives and seek continual improvement in its effectiveness and performance, based on risk.
• Periodically review current practices, policies and guidance, so that we apply appropriate security measures and continually enhance our information security performance.

This policy provides a framework for setting, monitoring, reviewing and achieving our objectives, programmes and targets. The business management system is regularly reviewed by top management to ensure it remains appropriate and suitable to our business, and it is subject to regular internal audits. Information security is the responsibility of all employees at Sterling International Consulting.

Implementing a management system means seeing a client's procedures, records, risk assessments and sometimes personal data. We handle that information through its whole life:

• Before receipt: how material will be exchanged, where working copies will be kept and what happens to them at the end are agreed with the client and recorded in the engagement agreement. We ask for no more than the work needs, and prefer samples and working copies to full data sets.
• During the engagement: access is limited to the engagement team. Information is used only to deliver that engagement, and never shared with another client or reused for another purpose.
• Devices and accounts: work is done on accounts protected by individual credentials, on devices kept up to date and locked when unattended. Client material is not kept on personal storage or sent through personal accounts.
• At closure: engagement information is returned to the client or deleted, as agreed, except where the agreement or the law requires a record to be kept.

Everyone working for Sterling reports a suspected security incident, a lost device or a misdirected message to Sterling's management immediately. Incidents are contained, investigated and corrected. Where an incident affects a client's information, we notify the client without undue delay, tell them what we know and work with them on the response.

Subcontracted consultants and service providers that handle client information on our behalf do so under written confidentiality and security obligations at least as strict as ours, and only for the engagement concerned.

The enquiry system checks the required details, the length of each entry and that the submission is valid. Browser-session checks and limits on repeated requests reduce misuse, and retry checks prevent duplicate or conflicting records. Cloudflare Turnstile adds a security check against automated abuse, and the website validates the result before it accepts a new enquiry. Accepted enquiries are stored before any email notification is attempted, so a delivery problem does not lose a saved enquiry. Viewing, exporting, deleting and managing enquiries requires privileged website access. These measures address specific risks; they cannot remove every possibility of error, misuse or interruption.

• Use the enquiry form for your goals, timing and business requirements only.
• Do not send passwords, payment-card details, identity documents, health information or confidential client data sets through the form or the website assistant.
• When a project needs sensitive evidence, agree an exchange method with your Sterling contact first.
• Check the website address before entering details, and verify unexpected requests for credentials, payment changes or confidential records through a contact route you already trust.

To report a problem with the website, use the Contact page with a short description, the page affected and when you noticed it. For a concern involving personal information, write to privacy@sterling-grc.com. Please do not collect other people's information, send exploit files through the enquiry form or keep accessing data that is not yours; ask us for a suitable method before sharing sensitive evidence about a suspected issue.