Access follows role.
Protection follows risk.

This policy states the baseline for protecting USG website, account, document and case systems. Detailed controls are risk-based and may be supplemented by a service schedule, centre requirement or customer security agreement.

Website account access uses a single-use email verification link. Verification establishes control of an email address, not a professional qualification. Administrator access is restricted to authorised accounts and roles. Email-link verification alone is not multi-factor authentication; this policy does not claim MFA is enabled across every USG system.

• unique user identities and no shared administrative accounts;
• least-privilege permissions based on role, matter and current need;
• stronger authentication, including MFA, where enabled for the relevant system;
• controlled verification for recovery and email changes, without treating a new email alone as authority to transfer a protected record;
• separate approval for administrative, financial and service-specific powers, including time-limited access where appropriate; and
• prompt joiner, mover and leaver changes, with periodic review of permissions and inactive accounts.

Account upgrades should preserve the person’s existing identity and records. A public verification result must not grant private workspace access. Suspected loss of email or account control should be reported to Support promptly.

Data should be classified, minimised and stored only in approved systems. Sensitive documents must not be placed in public forms, ordinary email or unmanaged devices. Encryption should protect appropriate data in transit and at rest, with keys and secrets separated from public source and access restricted.

Departmental mailboxes, application databases, confidential workspaces and administrative notifications have different purposes and access boundaries. A notification is not authority to read every related document. Supplier support access, exports and backup restoration require appropriate authorisation and records. Retention and deletion must address all relevant copies, not only the visible account.

Systems should use supported components, controlled changes, vulnerability management, backups, recovery testing, logging and monitoring proportionate to risk. Production and development access should be separated where practicable; test data should not contain unnecessary real personal data.

Suppliers, Service Centres and Strategy Partners receive only the access necessary for an expressly confirmed scope. Due diligence, contractual controls, incident duties and exit steps should reflect the information and service involved. Appointment does not grant unrestricted access to USG systems or data.

Suspected compromise, unauthorised disclosure, loss, misuse or service disruption must be reported promptly through the incident route. The response will prioritise containment, preservation of evidence, assessment, notification duties, recovery and corrective action. See Complaints and Incident Response.

Access reviews, security testing, backup checks, incident exercises and material supplier reviews should be recorded. The service-specific control schedule identifies measures applicable to that service. This public baseline is not a claim that every system has identical controls or a certification against a named standard.

New supplier, recovery, authentication or AI arrangements require assessment before use. Public security information must not expose credentials, private endpoints, internal network topology, exploitable configuration or confidential incident evidence.

Operations Management coordinates platform responsibility and continuity. The technical function maintains assigned access and operational controls; each service department controls who needs access to its matters. The Privacy and Compliance functions assess data-protection and related reporting obligations. Relevant staff must escalate suspected incidents without waiting for a complete investigation.

Account support and security incidents: support@universalsustainablegrowth.org. Privacy matters: privacy@universalsustainablegrowth.org. Administrative responsibility: office@universalsustainablegrowth.org. The incident and complaint procedure governs assessment, communication and review.