This Cybersecurity Policy addresses the guidelines of Goodwood Consulting for preserving the security of our data and technology infrastructure. The more we rely on technology to collect, store, and manage information, the more vulnerable we become to security breaches. Human errors, attacks, and system malfunctions could cause damage to the company and our clients and may jeopardize our reputation.
For this reason, we have implemented a number of security measures and prepared instructions that help mitigate security risks. This policy applies to all employees and anyone who has permanent or temporary access to our systems and hardware.
Confidential Data
Confidential data is secret and valuable. Common examples include unpublished financial information, customers/partners/vendors data, undisclosed intellectual property, customer lists (existing and prospective), and client information. All employees are obliged to protect this data.
Additional Measures
To further reduce the likelihood of security breaches, employees are instructed to:
- Turn off screens and lock devices when leaving them unattended
- Report stolen or damaged equipment as soon as possible
- Change all account passwords at once when a device is stolen
- Report any perceived threat or possible security weakness in company systems
- Refrain from downloading suspicious, unauthorized, or illegal software
- Avoid accessing suspicious websites
We also:
- Install anti-malware software and access authentication systems
- Provide security training to all employees
- Regularly inform employees about new scam emails or viruses and ways to combat them
- Investigate security breaches thoroughly
Incident Response & Client Notification
Goodwood maintains a formal Incident Response Plan covering detection, reporting, containment, investigation, remediation, evidence preservation, and post-incident review.
Notification commitments
If a Security Incident impacts Client Information, Goodwood will provide the affected client with:
- Preliminary notification within 24 hours of discovery — initial facts and a point of contact.
- Full incident report within 72 hours of discovery (or sooner as facts permit), with follow-up updates as the investigation proceeds.
- Nature and scope of the event (to the extent known), categories of affected data, containment and remediation steps, and ongoing incident contact.
Our 72-hour commitment is designed to support clients' obligations under SEC Regulation S-P (Privacy of Consumer Financial Information and Safeguarding Customer Information), which requires registered investment advisers to receive timely notice from service providers following a breach of a customer information system.
The 72-hour clock starts when Goodwood becomes aware of the incident. Where a client has a shorter contractually required notification window, the shorter window controls. Goodwood cooperates with clients and regulators, providing logs and investigation results as appropriate.
Disciplinary Action
We expect all employees to always follow this policy. Those who cause security breaches may face disciplinary action:
- First-time, unintentional, small-scale breaches may result in a verbal warning and additional security training
- Intentional, repeated, or large-scale breaches will invoke more severe disciplinary action up to and including termination
How to Report a Security Incident
Clients, vendors, researchers, and members of the public may report suspected security incidents to Goodwood at any time.