Secured by Jam Cyber
Why you can trust Benchmarking with your information.
The Company handles sensitive information every day: your personal details, your financial records, matters you'd rather keep private. Here's exactly what protects it, and why that's enough.
Benchmarking's Approach
People, technology, and governance
The Company protects client information across three areas: the people who handle it, the technology protecting it, and the governance keeping both accountable. Each is covered in detail below.
People
The staff who use these systems, trained and supported to do so safely.
Technology
The tools and systems running continuously to protect devices, accounts, and data.
Governance
The oversight that keeps every measure documented, audited, and accountable.
People
The people who make it work
Every security control still depends on a person using it well. Here is how staff at Benchmarking are trained and supported to make good calls.
- Monthly cyber security awareness training. Every staff member completes short training each month on current scam and attack tactics, so awareness doesn't go stale.
- Simulated phishing testing. Staff are regularly sent realistic, harmless test phishing emails, so a genuine attempt is more likely to be spotted than clicked.
- An online staff training platform. Staff complete role-specific and baseline cyber security training through a dedicated platform, with completion tracked and reported rather than left to chance.
- Managed staff onboarding and offboarding. When someone joins or leaves the Company, their system access is set up or fully removed as a managed step, with a record kept.
Technology
The technology working in the background
Behind the scenes, a set of tools and systems runs continuously to protect Benchmarking's devices, accounts, and data. None of it needs a staff member to remember to turn it on.
Device protection
- Next-generation antivirus. Protects company computers against viruses and malware using real-time threat detection, not an outdated virus list.
- Endpoint detection and response (EDR). Computers and servers are continuously monitored for advanced threats, with an active response the moment something suspicious appears.
- Managed security patching. Windows and other business software are kept patched to the latest security release, closing off a common way attackers get in.
- Full-disk encryption. Every managed device has its hard drive encrypted, so the data stays unreadable if the device is lost or stolen.
- Application control (allow-listing). Only pre-approved software can run on company devices, stopping both accidental installs and attacker tools from executing.
Identity and access
- Multi-factor authentication (MFA). Logging into a computer or server needs a second verification step, with a record of who accessed what and when.
- Managed device access to Microsoft 365. Microsoft 365 can only be reached from devices the Company has registered, computer, phone, or tablet alike.
- Business password management. Staff passwords are strong, unique, and stored securely, and the tool won't hand one to a fake login page.
Microsoft 365 and data protection
- Advanced email filtering. Every email in and out is filtered for malware, scams, and spoofed senders, with AI-assisted detection catching attacks that slip past basic filters.
- Email authentication (DMARC). Confirms which messages genuinely came from the Company's domain and blocks attempts to impersonate it.
- Macro blocking in Microsoft Office. Automatic macros in Office documents, a common way malicious files run code, are blocked by default.
- 24/7 Microsoft 365 monitoring. The Company's Microsoft 365 environment is watched around the clock for signs of attack, including unusual account activity.
- Cloud backup with unlimited retention. Microsoft 365 data is backed up with unlimited retention, and a single lost file can be restored on its own.
- Cloud application alerting. Unusual activity in the Company's cloud applications triggers an alert, so problems get caught and fixed quickly.
Monitoring and threat filtering
- 24/7 monitoring by a security operations centre (SOC). A security operations centre watches for signs of compromise around the clock, not only during business hours.
- 24/7 firewall monitoring. Firewalls protecting the network are monitored around the clock for suspicious activity.
- Dark web monitoring. The Company's email domain and credentials are monitored for exposure on the dark web, so a leaked login can be acted on early.
- Malicious website blocking. Dangerous and inappropriate websites are blocked from loading, based on categories of risk rather than a fixed list.
- Web traffic filtering (DNS filtering). Internet traffic is filtered at the network level, blocking known malicious or high-risk sites before a device can connect.
Governance
The governance that keeps it accountable
Good tools and trained staff still need oversight. This is how Benchmarking tracks its own security and can prove it to a third party when asked.
Policy and access control
- Documented security policies aligned to the ISO 27001 standard. Give staff clear guidance rather than word of mouth.
- Restricted admin rights. Staff use company computers under restricted permissions, so day-to-day use can't install unapproved software or change system settings.
Demonstrating security posture
- A documented security profile. A written record sets out exactly what security measures are in place, ready to show an auditor, insurer, or board on request.
- Quarterly Microsoft 365 security audit. The Company's Microsoft 365 environment is audited every quarter for vulnerabilities, unintended access, or data left exposed.
- Support through third-party security audits. When an external auditor asks about the Company's security, Jam Cyber helps answer the technical questions directly.
- Insurance and supplier questionnaire support. When an insurer, client, or supplier sends a security questionnaire, Jam Cyber handles the technical detail on the Company's behalf.
When something goes wrong
- Incident investigation and reporting. If something does go wrong, Jam Cyber investigates what happened and produces a clear report the Company can act on.
- Secure emergency access to critical documents. Critical passwords and documents are kept in a secure emergency-access system, so the Company is never locked out of its own information.
- Identity verification for support requests. Before acting on any support request, Jam Cyber confirms it's genuinely coming from an authorised person at the Company, not an impersonator.