BenchmarkingSecured by Jam badge

Secured by Jam Cyber

Why you can trust us with your information.

We handle sensitive information every day: your personal details, your financial records, matters you'd rather keep private. Here's exactly what protects it, and why that's enough.

Our Approach

People, technology, and governance

We protect client information across three areas: the people who handle it, the technology protecting it, and the governance keeping both accountable. Each is covered in detail below.

People

The staff who use these systems, trained and supported to do so safely.

Technology

The tools and systems running continuously to protect devices, accounts, and data.

Governance

The oversight that keeps every measure documented, audited, and accountable.

People

The people who make it work

Every security control still depends on a person using it well. Here is how our staff are trained and supported to make good calls.

  • Monthly cyber security awareness training. Every staff member completes short training each month on current scam and attack tactics, so awareness doesn't go stale.
  • Simulated phishing testing. Staff are regularly sent realistic, harmless test phishing emails, so a genuine attempt is more likely to be spotted than clicked.
  • An online staff training platform. Staff complete role-specific and baseline cyber security training through a dedicated platform, with completion tracked and reported rather than left to chance.
  • Managed staff onboarding and offboarding. When someone joins or leaves us, their system access is set up or fully removed as a managed step, with a record kept.

Technology

The technology working in the background

Behind the scenes, a set of tools and systems runs continuously to protect our devices, accounts, and data. None of it needs a staff member to remember to turn it on.

Device protection

  • Next-generation antivirus. Protects our computers against viruses and malware using real-time threat detection, not an outdated virus list.
  • Endpoint detection and response (EDR). Computers and servers are continuously monitored for advanced threats, with an active response the moment something suspicious appears.
  • Managed security patching. Windows and other business software are kept patched to the latest security release, closing off a common way attackers get in.
  • Full-disk encryption. Every managed device has its hard drive encrypted, so the data stays unreadable if the device is lost or stolen.
  • Application control (allow-listing). Only pre-approved software can run on our devices, stopping both accidental installs and attacker tools from executing.

Identity and access

  • Multi-factor authentication (MFA). Logging into a computer or server needs a second verification step, with a record of who accessed what and when.
  • Managed device access to Microsoft 365. Microsoft 365 can only be reached from devices we've registered, computer, phone, or tablet alike.
  • Business password management. Staff passwords are strong, unique, and stored securely, and the tool won't hand one to a fake login page.

Microsoft 365 and data protection

  • Advanced email filtering. Every email in and out is filtered for malware, scams, and spoofed senders, with AI-assisted detection catching attacks that slip past basic filters.
  • Email authentication (DMARC). Confirms which messages genuinely came from our domain and blocks attempts to impersonate it.
  • Macro blocking in Microsoft Office. Automatic macros in Office documents, a common way malicious files run code, are blocked by default.
  • 24/7 Microsoft 365 monitoring. Our Microsoft 365 environment is watched around the clock for signs of attack, including unusual account activity.
  • Cloud backup with unlimited retention. Microsoft 365 data is backed up with unlimited retention, and a single lost file can be restored on its own.
  • Cloud application alerting. Unusual activity in our cloud applications triggers an alert, so problems get caught and fixed quickly.

Monitoring and threat filtering

  • 24/7 monitoring by a security operations centre (SOC). A security operations centre watches for signs of compromise around the clock, not only during business hours.
  • 24/7 firewall monitoring. Firewalls protecting the network are monitored around the clock for suspicious activity.
  • Dark web monitoring. Our email domain and credentials are monitored for exposure on the dark web, so a leaked login can be acted on early.
  • Malicious website blocking. Dangerous and inappropriate websites are blocked from loading, based on categories of risk rather than a fixed list.
  • Web traffic filtering (DNS filtering). Internet traffic is filtered at the network level, blocking known malicious or high-risk sites before a device can connect.

Governance

The governance that keeps it accountable

Good tools and trained staff still need oversight. This is how we track our own security and can prove it to a third party when asked.

Policy and access control

  • Documented security policies aligned to the ISO 27001 standard. Give staff clear guidance rather than word of mouth.
  • Restricted admin rights. Staff use our computers under restricted permissions, so day-to-day use can't install unapproved software or change system settings.

Demonstrating security posture

  • A documented security profile. A written record sets out exactly what security measures are in place, ready to show an auditor, insurer, or board on request.
  • Quarterly Microsoft 365 security audit. Our Microsoft 365 environment is audited every quarter for vulnerabilities, unintended access, or data left exposed.
  • Support through third-party security audits. When an external auditor asks about our security, Jam Cyber helps answer the technical questions directly.
  • Insurance and supplier questionnaire support. When an insurer, client, or supplier sends a security questionnaire, Jam Cyber handles the technical detail on our behalf.

When something goes wrong

  • Incident investigation and reporting. If something does go wrong, Jam Cyber investigates what happened and produces a clear report we can act on.
  • Secure emergency access to critical documents. Critical passwords and documents are kept in a secure emergency-access system, so we are never locked out of our own information.
  • Identity verification for support requests. Before acting on any support request, Jam Cyber confirms it's genuinely coming from an authorised person on our team, not an impersonator.