Security Policy

Last updated 3 November 2026. Applies to orders and new engagements from 21 October 2026 and to existing managed service agreements from 21 November 2026. The same document is published on theurbannetwork.tech and thecommandline.com.au.

This policy describes the security controls The Urban Network Group Pty Ltd (ABN 53 687 320 234), trading as The Urban Network and The Command Line, applies to its own systems and the standards it applies when delivering security services. Our practices follow the Australian Signals Directorate (ASD) Essential Eight. We implement and maintain Essential Eight Maturity Level 1 as a baseline and plan Level 2 with clients. It describes our practices; it is not a certification.

1. Governance

• Security controls and policies are reviewed at least annually.
• Risk assessments are completed before onboarding new services or vendors.
• Security responsibilities are clearly assigned.
• Security is built into every project and service.

2. Essential Eight

• Application control: only approved applications run on systems we manage.
• Patch applications: critical patches within 48 hours of release; others within 14 days.
• Microsoft Office macros: disabled by default and enabled only with explicit approval.
• User application hardening: browsers and productivity apps block untrusted content.
• Restrict administrative privileges: least privilege, reviewed quarterly.
• Patch operating systems: critical vulnerabilities within 48 hours.
• Multi-factor authentication: required for everyone accessing our systems and client environments.
• Regular backups: daily automated backups with offline or offsite copies, tested quarterly.

3. Access control

• Individual accounts only; no shared credentials.
• MFA for all remote access, email and cloud services, with sign-in through Microsoft Entra ID for our internal systems.
• Privileged access is separate and logged.
• Access is reviewed when roles change and removed within 24 hours of departure.
• Client environment access is documented, scoped to the minimum and logged.

4. Data protection and encryption

• Data in transit is encrypted with TLS 1.2 or higher.
• Data at rest is encrypted with AES-256 or equivalent.
• Portable devices and storage media are encrypted.
• Client data is kept logically separate.
• Credentials are kept in an enterprise password manager, never in email, documents or our records system.

5. Network and endpoint security

• Remote access to client systems uses encrypted VPN or zero-trust connections.
• DNS filtering blocks known malicious sites.
• Endpoints we manage run endpoint detection and response with real-time threat detection.
• Removable media use is controlled.

6. Vendors and AI tools

We assess the security of significant vendors before use and review them annually. Our key providers include Microsoft, Google, Cloudflare and Shopify, which hold their own certifications such as ISO 27001 and SOC 2. AI-assisted tools are used with a person reviewing anything before it is sent or acted on, and passwords, keys and card numbers are never given to them.

7. Incident response

We keep a documented incident response plan covering detection, containment, recovery and post-incident review. If an incident affects client data, we notify the affected client within 24 hours of becoming aware of it, provide regular updates, and help with any notification required under the Notifiable Data Breaches scheme.

8. Continuity and recovery

We keep business continuity and disaster recovery plans, reviewed annually, with recovery objectives for critical systems and quarterly restore tests.

9. People and physical security

Everyone working for us completes security awareness training when they start and annually. We do not run our own data centre; data is hosted with enterprise cloud providers. Workspaces are secured, screens locked when unattended, and sensitive paper records shredded.

10. Vulnerability management

We scan our own systems for vulnerabilities and fix critical issues within the patch times in section 2. Managed security clients receive vulnerability scanning as part of their service.

11. Reporting a security concern

If you find a vulnerability in our systems or have a security concern, contact us straight away using the details below. We investigate every report promptly and responsibly.

Contact

Email support@theurbannetwork.tech or help@thecommandline.com.au (both reach the same team), or call +61 7 3077 7769. Please do not send passwords, payment card details or sensitive records by email or through a website form.