External Vulnerability Scanning and Security Monitoring Policy

iTCHYROBOT UK Limited

Published: 5 November 2026
Version: 1.0
Status: Active
Policy owner: Information Security Management

1. Purpose and Background

iTCHYROBOT UK Limited provides website development, hosting and ongoing technical management services to schools, academy trusts and other educational organisations.

We have become aware of an increasing number of schools and academy trusts registering their websites and IT infrastructure with Police CyberAlarm, often through their appointed IT support providers.

Police CyberAlarm is a free, policing-led cybersecurity service that provides external vulnerability scanning and optional internal network monitoring.

We welcome initiatives that help educational organisations identify cybersecurity risks and improve their security arrangements.

As an organisation operating under ISO 27001, we recognise the value of independent security assessments, responsible vulnerability disclosure and continuous improvement.

However, security testing must be balanced against our responsibilities to protect the confidentiality, integrity and availability of the systems and information entrusted to us.

This policy establishes our position on Police CyberAlarm, defines the external scanning activities we authorise and clarifies the responsibilities of schools, academy trusts and their IT providers.

Our objective is to support independent security scrutiny without introducing unnecessary operational risks,expanding our data exposure footprint or compromising existing security controls.

2. Understanding Police CyberAlarm

Police CyberAlarm provides two distinct services relevant to educational organisations.

2.1 Secure Sensor – Internal Network Monitoring

The Police CyberAlarm Secure Sensor uses firewall log data to identify suspicious and potentially malicious activity targeting an organisation’s network.

According to Police CyberAlarm, the service collects relevant network metadata for analysis and does not collect the content of communications.

Deployment requires a compatible firewall or security device, an appropriate physical or virtual machine, and authority to share the relevant network log data.

For schools and academy trusts, this service ordinarily falls within the responsibilities of the organisation managing their internal IT networks.

Where a school uses an external IT support provider, the school and its provider should assess the suitability, security and data protection implications of deploying the Secure Sensor. This falls outside the remit of the services iTCHYROBOT manages our maintains for your school(s).

iTCHYROBOT does not authorise the installation of Police CyberAlarm Secure Sensors or other third-party monitoring agents on infrastructure under our management.

We do not authorise the routine forwarding of our firewall, server, application or access logs to Police CyberAlarm.

This restriction does not prevent schools or their IT providers from deploying the Secure Sensor on infrastructure they independently own or manage.

ITCHYROBOT will always co-operate and share information required of us by any official legal request.

Importantly, the Secure Sensor is an optional component of Police CyberAlarm. Our decision not to deploy it on our hosting infrastructure does not prevent schools or academy trusts from using Police CyberAlarm’s external website vulnerability scanning service. The external website vulnerability scanning service operates independently of the Secure Sensor and remains authorised within the scope and conditions defined in this policy.

2.2 External Website Vulnerability Scanning

Police CyberAlarm offers vulnerability scanning of registered public-facing websites and IP addresses.

This service can operate without installing software on the hosting infrastructure.

It is this external scanning capability that is relevant to websites hosted and managed by iTCHYROBOT.

We support the principle of independent external vulnerability scanning, subject to the authorisation and limitations set out in this policy.

3. Security Data Minimisation and Operational Independence

Our approach to information security is based on minimising unnecessary data exposure and maintaining control over security or commercially sensitive operational information.

Our firewall, server and application logs contain valuable intelligence about our infrastructure, threat detection capabilities, security controls and incident response processes.

Collectively, this information can reveal details of our infrastructure architecture, security monitoring arrangements, defensive configurations and operational response patterns.

We regard this information as both security and commercially sensitive and restrict its distribution accordingly.

Sharing security telemetry with additional organisations, regardless of their security credentials, expands the number of systems, people and processes through which that information may be accessed, processed or stored.

Every additional data flow introduces considerations relating to access control, retention, confidentiality, contractual responsibility and incident management.

Our position is not a judgement on the security or integrity of Police CyberAlarm. It is a deliberate decision to minimise our data exposure footprint.

We already operate established security monitoring, threat intelligence and incident response capabilities inline with our ISO 27001 processes and as such we have not identified sufficient additional operational benefit from forwarding our security telemetry to Police CyberAlarm to justify introducing this additional data flow.

Accordingly:

  • We will not install Police CyberAlarm Secure Sensors on our hosting infrastructure.
  • We will not forward firewall, server, application or access logs to Police CyberAlarm.
  • We will not provide third-party access to our internal monitoring systems except under commercial agreement for specific security audits conducted under our control.
  • We will not disclose internal security configurations, detection rules or operational intelligence beyond what is necessary for legitimate security assurance or incident management.

This position is consistent with our wider approach to information security risk management and data minimisation.

It does not affect our willingness to engage in security panels/discussions or receive and investigate external vulnerability reports.

4. Authorisation for External Vulnerability Scanning

4.1 Standing Authorisation

iTCHYROBOT grants limited, conditional authorisation to the official Police CyberAlarm service to conduct non-intrusive external vulnerability scanning of public-facing school and multi-academy trust websites hosted and managed by iTCHYROBOT.

This authorisation applies exclusively to the official Police CyberAlarm service.

It does not extend to other vulnerability scanning providers, independent security researchers, third-party contractors or services operating on behalf of Police CyberAlarm unless separately authorised in writing.

This authorisation is restricted to activities that do not compromise the confidentiality, integrity or availability of our systems or customer information.

4.2 Permitted Activities

The following activities are permitted within the scope of this policy:

  • Examination of publicly accessible website pages and resources.
  • Inspection of publicly available HTTP and HTTPS response headers.
  • TLS certificate and protocol configuration checks.
  • Identification of publicly disclosed software and service information.
  • Non-intrusive TCP port discovery associated with the registered website.
  • Passive vulnerability identification using publicly available information.
  • Non-destructive inspection of publicly accessible services.

These activities must not involve attempts to exploit vulnerabilities, bypass security controls or access restricted information.

4.3 Shared Hosting and IP Addresses

Our infrastructure hosts websites and services for multiple independent educational organisations.

A school or academy trust may have authority to register its own website for scanning, but this does not automatically provide authority to conduct unrestricted testing of the underlying hosting infrastructure.

Our standing authorisation applies to the registered public-facing website and its associated web services. It does not authorise unrestricted scanning of shared hosting IP addresses or unrelated services.

Where an IP address hosts multiple customer websites, scanning must remain within the permitted scope of this policy.

Broader infrastructure assessments require our prior written agreement.

4.4 Activities Not Authorised

The following activities are expressly excluded from this authorisation:

  • Active exploitation or attempted exploitation of vulnerabilities.
  • Intrusive penetration testing.
  • Brute-force authentication or credential attacks.
  • Attempts to bypass authentication or authorisation controls.
  • Attempts to circumvent firewalls, Fail2ban or other intrusion prevention mechanisms.
  • Denial-of-service or load testing.
  • Automated submissions to forms or application workflows.
  • Uploading files or executing commands.
  • Modifying, deleting or extracting information.
  • Accessing non-public information or personal data.
  • Testing unrelated websites or services sharing our infrastructure.
  • Installation of software, sensors or monitoring agents.
  • Collection or forwarding of internal server or security logs.
  • Any testing that deliberately disrupts or degrades service availability.

Any testing beyond the permitted scope requires prior written authorisation from iTCHYROBOT.

5. Existing Security Controls

iTCHYROBOT operates a layered approach to infrastructure and application security.

Our security arrangements include:

  • An ISO 27001 information security management system.
  • Cyber Essentials security controls.
  • Network firewalling and traffic filtering.
  • Automated intrusion detection and prevention.
  • Fail2ban-based IP blocking.
  • Threat intelligence monitoring and integration.
  • NCSC Early Warning monitoring.
  • Operating system and application vulnerability management.
  • Regular security patching.
  • Automated vulnerability assessments.
  • Independent external security testing.
  • Documented incident response and vulnerability management procedures.

Our infrastructure is monitored and maintained through established operational security processes.

5.1 Internal and External Vulnerability Assessments

We undertake regular automated vulnerability assessments using OWASP ZAP and other security testing arrangements.

Our testing approach includes two distinct configurations.

External assessments examine publicly exposed services and the effectiveness of the security controls protecting them.

Controlled internal assessments operate through authorised access arrangements, allowing underlying applications and services to be assessed without interference from automated perimeter blocking mechanisms.

These assessments provide complementary information about externally visible exposure and underlying application security.

We also use independent security testing where appropriate.

Police CyberAlarm may provide an additional source of external security information, but it does not replace our existing vulnerability management arrangements.

6. Automated Blocking and Scanning Limitations

Police CyberAlarm’s external scanning activity will be subject to the same security controls as other external traffic accessing our infrastructure.

We do not whitelist external vulnerability scanning services or provide exemptions from our automated security controls under this standing authorisation.

This position is maintained for several reasons.

6.1 Service Availability

We host websites for multiple educational organisations.

Uncoordinated scanning may generate additional traffic, application requests or resource consumption that could affect service availability.

We have a responsibility to protect the availability of services used by schools, parents, staff and pupils. Legitimate user traffic will be prioritised. Scanning or suspicious activity will be actively blocked.

6.2 Operational Control

We do not control when Police CyberAlarm initiates scans, their frequency or the volume and nature of requests generated.

Security testing capable of affecting production systems should ordinarily be coordinated with the organisation responsible for maintaining those systems.

This allows appropriate technical resources to be available should an issue arise or immediate response be required.

6.3 Consistent Security Enforcement

Our intrusion prevention controls operate according to established security policies.

Introducing exceptions for external scanners would create additional configuration and management requirements and could introduce unnecessary security risks.

We therefore apply our existing controls consistently.

6.4 Shared Infrastructure Protection

Security controls protecting one website may also protect other services hosted on the same infrastructure.

We cannot weaken these controls solely to facilitate testing requested by an individual customer or third party.

We do offer dedicated hosting arrangements, and if you are on a dedicated plan then please talk to us about your specific security scanning requirements.

As a trust if you wish to have control over your security scanning we can discuss moving your school/trust to dedicate hosting and develop a security testing plan appropriate to your needs. This will incur different costs to our school shared hosting environment.

6.5 Scanner Identification and Trust

External traffic cannot be considered trustworthy solely because it claims to originate from an authorised security scanning service.

Our defensive systems assess activity according to its behaviour and applicable security rules.

6.6 Expected Scanning Outcomes

Depending on its scanning behaviour, Police CyberAlarm may trigger our automated intrusion prevention mechanisms.

This may result in temporary or extended blocking of the originating IP address and prevent the scanner from completing its assessment.

Such blocking is an expected consequence of our security controls and does not, by itself, indicate a vulnerability or security failure.

Equally, a blocked or incomplete scan must not be interpreted as evidence that the website is free from vulnerabilities.

Schools and their IT providers should recognise these limitations when interpreting Police CyberAlarm reports.

We will not disable or weaken our existing security controls simply to allow an external scanning service to complete an assessment.

7. Vulnerability Reporting and Remediation

We recognise that schools and academy trusts may register their websites with Police CyberAlarm through their appointed IT support providers.

However, the organisation receiving a vulnerability report is not necessarily the organisation responsible for maintaining the affected system.

For websites hosted and managed by iTCHYROBOT, responsibility for investigating and addressing vulnerabilities within our contracted service scope rests with us.

An external IT provider will not have access to the underlying website, application configuration or hosting infrastructure.

We therefore request that schools, academy trusts and their IT providers share relevant Police CyberAlarm vulnerability reports with iTCHYROBOT.

ITCHYROBOT is contracted with the school/MAT to provide hosting service. As part of the permission granted via this agreement the school is obligated to report any positive security findings to the iTCHYROBOT Ltd technical team within 4 hours. Failure to comply will be consider a security breech and be dealt with accordingly.

Reports should contain sufficient information to allow us to identify and investigate the issue.

Where appropriate, we will:

  1. Review and validate the reported finding.
  2. Assess the affected systems and potential impact.
  3. Evaluate existing mitigating security controls.
  4. Determine the appropriate risk classification.
  5. Prioritise remediation or other risk treatment.
  6. Implement and verify corrective actions.
  7. Record relevant findings and actions within our information security management system.

Not every automated vulnerability finding represents an exploitable security weakness.

Findings may relate to software identification, configuration choices, unavailable services or behaviour intentionally restricted by existing controls.

All reports will therefore be assessed in their technical and operational context.

We welcome constructive security findings that help improve the services we provide.

We do not welcome every report forwarded to us as a matter of course.

8. Responsibilities of Schools and IT Providers

Schools and academy trusts should distinguish between internal network security and externally hosted website security.

Internal Networks

The decision to deploy Police CyberAlarm’s Secure Sensor on a school’s internal network rests with the school and the organisation responsible for managing that infrastructure.

Appropriate authority, technical compatibility and data protection considerations should be established before deployment.

Externally Hosted Websites

For websites hosted by iTCHYROBOT, the limited standing authorisation in this policy applies.

Schools do not need to seek individual written permission for Police CyberAlarm scanning that remains strictly within the authorised scope.

However, schools and their IT providers should:

  • Confirm that the correct website is registered.
  • Avoid registering shared hosting IP addresses for unrestricted vulnerability testing.
  • Ensure scanning remains within the scope authorised by this policy.
  • Forward relevant findings to iTCHYROBOT within 4 hours of a positive finding to schools@itchyrobot.co.uk
  • Avoid interpreting incomplete scans as evidence of either security or insecurity.
  • Contact us before arranging intrusive or active security assessments.
  • Review this policy periodically for changes.

Registration with Police CyberAlarm does not transfer responsibility for website security or remediation to a school’s internal IT provider.

Responsibility remains determined by the systems concerned and the contractual arrangements governing their management.

9. Unauthorised Testing and Suspected Malicious Activity

Our limited authorisation for Police CyberAlarm does not constitute unrestricted permission to test, investigate or attempt to compromise our systems.

We reserve the right to immediately restrict or block activity that exceeds the permitted scope or presents a risk to the confidentiality, integrity or availability of our infrastructure.

Where necessary, we may:

  • Block originating IP addresses or networks including the school.
  • Apply additional security restrictions.
  • Preserve relevant logs and forensic evidence.
  • Notify the originating organisation.
  • Report suspected malicious activity to appropriate authorities.
  • Pursue appropriate civil remedies or refer suspected criminal conduct to law enforcement.

Where activity indicates attempted unauthorised access, exploitation, compromise or deliberate service disruption, we reserve the right to take appropriate legal action.

The description of an activity as security research, vulnerability scanning or penetration testing does not automatically establish authorisation.

We will assess incidents according to the nature of the activity, the permissions granted and the potential or actual impact on our systems and customers.

10. Our Commitment to Continuous Improvement

Information security is an ongoing process requiring continuous monitoring, assessment and improvement.

We recognise that no organisation or security control can guarantee the complete absence of vulnerabilities.

Our approach is therefore based on identifying risks, implementing appropriate controls, monitoring their effectiveness and responding promptly when weaknesses are identified.

We welcome responsible vulnerability disclosure and independent scrutiny that contributes to these objectives.

Police CyberAlarm may provide useful additional information for schools and academy trusts, particularly where organisations do not already operate established security monitoring and vulnerability management arrangements.

For our hosting infrastructure, we consider it an additional source of external assessment rather than a replacement for existing security processes.

We welcome friendly challenge and independent verification, while retaining responsibility for the security, availability and operational management of our infrastructure.

11. Policy Review, Amendments and Withdrawal of Authorisation

This policy reflects our current understanding of Police CyberAlarm and the external vulnerability scanning services it provides.

Our authorisation is conditional upon scanning activity remaining within the scope defined in this document.

We reserve the right to amend, restrict, suspend or withdraw this authorisation at any time.

Changes may be made in response to:

  • Changes in Police CyberAlarm’s scanning methods or capabilities.
  • Changes to our infrastructure or security controls.
  • Operational incidents or service availability concerns.
  • Changes in legal, regulatory or contractual requirements.
  • Information security risk assessments.
  • Changes to our vulnerability management arrangements.

The current version of this policy will be published on our website.

Schools, academy trusts and IT providers relying on this authorisation are responsible for reviewing the published policy before initiating or continuing scanning arrangements.

Previous versions of this policy should not be relied upon as evidence of continuing authorisation.

12. Security Contact and Responsible Disclosure

Security findings relating to websites or infrastructure managed by iTCHYROBOT should be reported directly to our team by email to schools@itchyrobot.co.uk.

Reports should include:

  • The affected website or service.
  • A description of the suspected vulnerability.
  • Relevant technical evidence.
  • The date and time of the observation.
  • Details of any testing performed.
  • Contact information for follow-up enquiries.

Please do not include unnecessary personal information, credentials or sensitive customer data in vulnerability reports.

We will assess relevant reports through our established information security and vulnerability management processes.

Our Position in Summary

iTCHYROBOT welcomes independent security scrutiny and supports schools using Police CyberAlarm to better understand their cybersecurity risks.

We provide limited standing authorisation for non-intrusive external website vulnerability scanning by the official Police CyberAlarm service.

We do not authorise internal monitoring agents, Secure Sensors or the forwarding of security logs from our hosting infrastructure.

External scanning remains subject to our existing security controls, including automated intrusion prevention and IP blocking. No whitelisting or security exemptions are provided under this policy.

Schools and their IT providers should share relevant vulnerability findings with us so that they can be properly investigated and addressed.

Our responsibility is to protect the confidentiality, integrity and availability of the services entrusted to us. We welcome constructive security assessments, but will not compromise those responsibilities or unnecessarily expand our data exposure footprint to accommodate them.

iTCHYROBOT UK Limited
Information Security Management
Version 1.0 | 5 November 2026