TOMs - Technical & Organisational Measures 

To fulfill the security requirements of the Data Protection Addendum, all Consultants must adhere to the following standards:

Device Security:

• Encryption: Full Disk Encryption (BitLocker/FileVault) must be active.

• Access Control: Devices must be password/biometric protected with a maximum 5-minute auto-lock.

• Credentials: Multi-Factor Authentication (MFA) must be enabled on all accounts.

Data Handling:

• Storage: Use E Co. Cloud storage. Avoid local downloads.

• Connectivity: No unsecured public Wi-Fi without a VPN.

• Disposal: Securely delete local files and shred paper notes.

Incident Response:

• Notify privacy@ecoltdgroup.com within 24 hours of any suspected breach or lost device.