Security

Safeguarding institutional information and public services

Security controls support the confidentiality of information, the integrity of standards and certification decisions, and the availability of authoritative public services.

Security principles

Protection proportionate to consequence

The Association applies layered controls across identity, privileged access, evidence storage, application security, network protection, monitoring, change governance, recovery and incident response. Administrative services are protected by separate access controls and are excluded from public navigation and indexing.

Access is granted on least-privilege principles, high-consequence actions are subject to additional authorisation, and material security activity is logged and reviewed. Controls are tested and adjusted in response to changing threat, vulnerability and operational risk.

Responsible disclosure

Report a potential weakness

Good-faith reports should identify the affected public service, provide a concise description, reproducible steps and the potential impact. Submit the minimum information necessary to demonstrate the concern and select “Security disclosure” on the official enquiry form.

Do not access, alter, download, retain or disclose information beyond what is necessary to demonstrate the issue. Do not include active malicious code, credentials or third-party personal information in the initial submission.

Submit a security report

Testing boundaries

Activities not authorised

Denial-of-service, volumetric or resource-exhaustion testing.
Credential attacks, password spraying, automated login attempts or bypass of authentication controls.
Social engineering, phishing, physical intrusion or targeting of personnel and service providers.
Testing that could damage data, impair service, affect another user or breach applicable law.
Public disclosure before the Association has had a reasonable opportunity to assess and address a validated issue.

Nothing on this page grants permission to access a restricted service, account, system or information. Research must remain within lawful, non-destructive and proportionate boundaries.

Response

Reports are handled through a restricted workflow

Reports are triaged according to plausibility, severity, exploitability and affected information or service. The Association may request clarification or a secure method for further evidence. Remediation timing reflects the risk, complexity, testing and need to protect service continuity.

Where appropriate, the reporter’s contribution is acknowledged, subject to consent, legal obligations and the need to protect security information.