Legal
Responsible disclosure
How to report a security vulnerability in CES systems.
Last updated: 13 November 2026
Our commitment
Security is at the heart of what CES does, and we welcome reports from people who find vulnerabilities in our website or systems. We ask that you report them to us privately so we can fix them before they are exploited.
How to report
Send us your report using our contact form, choosing “Cybersecurity” as the area you need help with and starting your message with “Security report”. Our cybersecurity team will contact you for details. Please include:
- a description of the vulnerability and where it is;
- the steps needed to reproduce it;
- the potential impact, as far as you understand it.
Please do
- give us reasonable time to investigate and fix the issue before sharing it with anyone else;
- only test against systems you are authorised to test, and stop as soon as you have confirmed the issue.
Please don’t
- access, change or delete data that does not belong to you, or keep any data you come across;
- disrupt our services or our clients’ services, for example through denial-of-service or heavy automated scanning;
- use social engineering, phishing or physical attacks against our people or offices.
What we will do
- acknowledge your report and keep you informed as we investigate;
- fix confirmed issues as quickly as we reasonably can;
- not take legal action against anyone who reports a vulnerability in good faith and follows this policy.
This policy covers CES’s own website and systems. It does not cover systems we manage on behalf of clients, which are governed by our agreements with them.