Information and data security statement
At CFE Research, we treat the security, confidentiality, and integrity of client and participant data as fundamental to our work. We understand that every piece of information we handle carries responsibility, and we are committed to maintaining the highest standards of protection and governance.
Where we engage external suppliers or subcontractors, we require them to adhere to security standards consistent with our ISMS, and we include confidentiality and audit rights in our contractual terms.
We also maintain a record of security incidents, regularly review them with senior management, and act on any opportunities to strengthen controls.
Our foundations and certifications
- We operate a robust Information Security Management System (ISMS), formally aligned with ISO/IEC 27001.
- We hold the Cyber Essentials certification, affirming that we maintain strong baseline controls against the most common cyber threats.
- Our governance, processes and controls are regularly reviewed and improved — security is a continuous journey, not a one-time effort.
Scope and coverage
Our ISMS covers the full lifecycle of client and research data across our organisation, including:- Data collection systems (online, telephone, face-to-face)
- Internal IT infrastructure (networks, servers, cloud services, endpoint devices)
- Data processing and analysis tools
- Backup, archiving, and secure disposal / anonymisation procedures
- Physical security of premises, devices, and access controls
- Interfaces with third parties, subcontractors and vendors
Where we engage external suppliers or subcontractors, we require them to adhere to security standards consistent with our ISMS, and we include confidentiality and audit rights in our contractual terms.
Key technical and organisational controls
We deploy a range of controls to maintain confidentiality, integrity, and availability of data, including:- Encryption of data in transit (TLS / HTTPS) and at rest (storage encryption)
- Role-based access controls and the principle of least privilege
- Multi-factor authentication (MFA) for systems handling sensitive data
- Access logging, audit trails, and periodic access approval reviews
- Network segmentation, firewalls, intrusion detection / prevention systems
- Regular vulnerability scanning and patch management
- Annual third-party penetration testing
- Redundant hardware, failover systems and resilient architecture
- Secure backup procedures
- Secure deletion / anonymisation of data when no longer required
- A formal security incident management process, including detection, containment, investigation, remediation, and post-incident review
Incident reporting and response
In the event of a security incident or suspected data breach, we follow a clearly defined process to:- Detect, verify and categorise the incident
- Contain and mitigate impact
- Notify affected clients, participants and regulatory bodies (as required) in a timely manner
- Conduct root cause analysis
- Take corrective actions to prevent recurrence
- Document lessons learned and feed them into ongoing risk assessments and policy updates
We also maintain a record of security incidents, regularly review them with senior management, and act on any opportunities to strengthen controls.
Governance, risk and continual improvement
- Our senior leadership oversees information security accountability, ensuring that the ISMS is resourced, maintained, and continually improved.
- We conduct regular risk assessments, internal audits, and management reviews to ensure our controls remain appropriate and effective.
- Our policies, standards and procedures are reviewed on a scheduled basis or sooner when significant change occurs.
- All staff (and contractors) receive mandatory security awareness training, which is refreshed annually and reinforced with ongoing reminders and simulations.
Legal, regulatory and ethical compliance
We comply with applicable legal and regulatory frameworks including UK GDPR and the Data Protection Act 2018. In the context of social research, we adhere to ethical principles and industry guidelines ( Market Research Society, Magenta Book) to ensure participants’ rights, privacy, and confidentiality are respected.Transparency and reassurance
We recognise that clients and participants want confidence in how their data is handled. To that end:- We are willing, where appropriate and subject to confidentiality, to provide clients or their auditors with evidence of compliance
- We publish this statement to explain our approach, and we encourage clients to raise security questions or requests
- While no system is immune to risk, our structured, standards-based approach, combined with continuous review and improvement, provides a strong basis of trust and protection.
