RHONDDA CYNON TAF COUNTY BOROUGH COUNCIL INFORMATION SECURITY INCIDENT MANAGEMENT POLICY Version 2.0.1

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "RHONDDA CYNON TAF COUNTY BOROUGH COUNCIL INFORMATION SECURITY INCIDENT MANAGEMENT POLICY Version 2.0.1"

Transcription

1 RHONDDA CYNON TAF COUNTY BOROUGH COUNCIL INFORMATION SECURITY INCIDENT MANAGEMENT POLICY Version Revised and effective from 1st April 2012

2 Document Control Organisation Title Author Filename Owner Subject Protective Marking Review date ICT Services Information Security Incident Management Policy Steve Carter \\adrctcictnas2\gcsx\gcsx-project\policies and Procedures\Information Security Incident Management Policy Head of ICT/SIRO Security Incident Management Unclassified The Information Management & Security Forum will formally review the Information Security Policy annually Revision History Revision Revisor Previous Description of Revision Date Version 01/07/09 E. Pritchard 0.1 Highlighted (other than yellow) - removed 20/07/09 E. Pritchard 0.3 Amends from HR, ICT & Internal Audit 22/02/12 S. Carter 2.0 Updates around Paper based Incidents and Reporting 1/04/2012 S. Carter 2.0 Review - Minor Amendments Document Approvals This document requires the following approvals: Sponsor Approval Name Date Information Management & Phil Derham (Finance) Security Forum Andrew Hopkins (Internal 01/03/2012 Audit) Rhianydd Davies (HR) Jeanette Howells (ESG) Josie Rhisart (Education) Sally Churchill (CCS) Andy Wilkins (Legal) Louise Evans (ICT) Head Of ICT Tim Jones 19/03/2012 SIRO Leigh Gripton 21/03/2012 Document Distribution This document will be distributed to: Name Job Title Address All employees, members, contractors, third party suppliers Page 2 of 11

3 Contents Section Page 1 Policy Statement 4 2 Purpose 4 3 Scope 4 4 Definition 4 5 Risks 5 6 Applying the Policy 5 7 Policy Compliance 5 8 Policy Governance 6 9 Review and Revision 6 Appendices Section Page 10 Reporting Information Security Incident Procedure 7 11 Examples of Information Security Incidents Process Flow; Reporting an Information Security Event or 11 Weakness Page 3 of 11

4 1 Policy Statement Protecting Rhondda Cynon Taff County Borough Council s computers, systems, electronic and paper based data from unauthorised use is of paramount importance with the management of system security and our response to breaches playing an important role in this process. All employees and personnel that have access to the Authority s information assets must adhere to the policy defined below in order to protect the security of the network, protect computer systems and protect data integrity and confidentiality. 2 Purpose The purpose of this policy is to mandate a standard for the management of Information Security Incidents or weaknesses. A consistent approach to dealing with all security events must be maintained across the Council. The events must be analysed to establish when security events become escalated to an incident. The incident response procedure must be a seamless continuation of the event reporting process and must include contingency plans to advise the Council on continuing operation during the incident. 3 Scope This policy applies to employees, members, contractors, third party suppliers or anyone with access to electronic or paper based information systems and or output from such systems. 4 Definition This policy needs to be applied as soon as information systems or data are suspected to be, or are actually affected by an adverse event which is likely to lead to a security incident. The definition of an information management security incident ( Information Security Incident in the remainder of this policy and procedure) is an adverse event that has caused or has the potential to cause damage to an organisation s information assets, reputation and / or personnel. Incident management is concerned with intrusion, compromise and misuse of information and information resources, and the continuity of critical information systems and processes. An Information Security Incident includes, but is not restricted to, the following: The loss or theft of data or information. The transfer of data or information to those who are not entitled to receive that information. Attempts (either failed or successful) to gain unauthorised access to data or information storage or a computer system. Page 4 of 11

5 Changes to information or data or system hardware, firmware, or software characteristics without the Council's knowledge, instruction, or consent. Unwanted disruption or denial of service to a system. The unauthorised use of a system for the processing or storage of data by any person. Examples of some of the more common forms of Information Security Incidents have been provided in Appendix 2. 5 Risks The Council recognises that there are risks associated with users accessing and handling information in order to conduct official Council business. This policy aims to mitigate the following risks: To reduce the impact of information security breaches by ensuring incidents are responded to consistently, efficiently and effectively. To help identify areas for improvement to decrease the risk and impact of future incidents. Non-compliance with this policy could have a significant effect on the efficient operation of the Council and may result in financial loss and an inability to provide necessary services to our customers. 6 Applying the Policy Events and weaknesses need to be reported at the earliest possible stage as they need to be assessed by an Information Management Officer. The Information Management Officer enables the Service to identify when a series of events or weaknesses have escalated to become an incident. It is vital for ICT Services to gain as much information as possible from the business users to identify if an incident is occurring. For full details of the procedure for incident handling please refer to Appendix 3. 7 Policy Compliance Any breach of this policy may warrant further investigation that may lead to the Council s disciplinary procedures being invoked and in certain circumstances, may necessitate the involvement of the Police. Specifically in relation to third party suppliers or contractors, non conformance will result in the immediate removal of access to Council systems. If damage or compromise of Council systems results, the Council may consider legal proceedings Page 5 of 11

6 8 Policy Governance The following table identifies who within the council is Accountable, Responsible, Informed or Consulted with regards to this policy. The following definitions apply: Responsible the person(s) responsible for developing and implementing the policy. Accountable the person who has ultimate accountability and authority for the policy. Consulted the person(s) or groups to be consulted prior to final policy implementation or amendment. Informed the person(s) or groups to be informed after policy implementation or amendment. Responsible Accountable Consulted Informed All Group Directors, Service Directors and Heads of Service Head of Service for ICT Human Resources, Internal Audit, ICT Information Management Group All users of Council Systems 9 Review and Revision The Information Management Group will review the Information Security Policy and its supporting policies every six months and reissue it annually, drawing attention to any changes that may have been made. Page 6 of 11

7 10 Appendix 1 - Procedure for Incident Handling 10.1 Reporting Information Security Events or Weaknesses The following sections detail how all users must report information security events or weaknesses. Appendix 3 provides a process flow diagram illustrating the process to be followed when reporting information security events or weaknesses Reporting Information Security Events for all Employees All suspected security events should be reported immediately to the user s Line Manager and the ICT Service Desk on The ICT Service Desk will require you to supply further information, the nature of which will depend upon the nature of the incident. However, the following information must be supplied: Contact name and number of person reporting the incident. E mail address of person reporting the incident. Department and Directorate of person reporting the incident. The type of data, information or equipment involved. Whether the loss of the data puts any person or other data at risk. Location of the incident. Inventory numbers of any equipment affected. Date and time the security incident occurred. Location of data or equipment affected. Type and circumstances of the incident. Security events, for example a virus infection, could quickly spread and cause data loss across the organisation. All users must understand, and be able to identify that any unexpected or unusual behaviour on the workstation could potentially be a software malfunction. If an event is detected users must: Note the symptoms and any error messages on screen. Disconnect the workstation from the network if an infection is suspected (with assistance from ICT Support Staff). Not use any removable media (for example USB memory sticks) that may also have been infected Responsibilities for the Management of Information Security Incidents A consistent approach to dealing with all security events must be maintained across the Council. The events must be analysed and the Information Management Officer must be consulted to establish when security events become escalated to an incident. The incident Page 7 of 11

8 response procedure must be a seamless continuation of the event reporting process and must include contingency plans to advise the Council on continuing operation during the incident Collection of Evidence If an incident requires information to be collected for an investigation, strict rules must be adhered to. The collection of evidence for a potential investigation must be approached with care and where necessary the Information Management Officer may contact the Councils Data Protection Officer and Internal Audit for guidance. If in doubt about a situation, for example concerning computer misuse or paper security, contact the ICT Service Desk for advice Responsibilities and Procedures Management responsibilities and appropriate procedures must be established to ensure an effective response against security events. The Information Management Officer must in consultation with Senior Information Management Risk Officer (SIRO), Legal Services, Internal Audit and Human Resources decide when events are classified as an incident and determine the most appropriate response. An incident management process must be created and include details of: Identification of the incident, analysis to ascertain its cause and vulnerabilities exploited. Limiting or restricting further impact of the incident. Tactics for containing the incident. Corrective action to repair and prevent reoccurrence. Communication across the Council to those affected. The actions required to recover from the security incident must be under formal control. Only identified and authorised staff should have access to the affected electronic or paper based systems during the incident and all of the remedial actions should be documented in as much detail as possible Learning from Information Security Incidents To learn from incidents and improve the response process incidents must be recorded and a Post Incident Review conducted. The following details must be retained by ICT: Types of incidents. Volumes of incidents and malfunctions. Costs incurred during the incidents. Page 8 of 11

9 The information must be collated and reviewed on a regular basis by ICT Services and any patterns or trends identified. Any changes to the process made as a result of the Post Incident Review must be formally noted. The information, where appropriate, should be shared with GovCertUK, the Warning, Advice and Reporting Point (WARP) to aid the alert process for the region and where deemed appropriate the Information Commissioners Office (ICO). Page 9 of 11

10 11 Appendix 2 Examples of Information Security Incidents Examples of the most common Information Security Incidents are listed below. It should be noted that this list is not exhaustive. Misuse Giving information to someone who should not have access to it - verbally, in writing or electronically. Computer infected by a Virus or other Malware. Sending a sensitive to 'all staff' by mistake. Receiving unsolicited mail of an offensive nature. Receiving unsolicited mail which requires you to enter personal data. Finding data that has been changed by an unauthorised person. Receiving and forwarding chain letters including virus warnings, scam warnings and other s which encourage the recipient to forward onto others. Unknown people asking for information which could gain them access to Council data (e.g. a password or details of a third party). Sending confidential or sensitive information to the incorrect recipient Use of unapproved or unlicensed software on Council equipment. Accessing a computer system using someone else's authorisation (e.g. someone else's user id and password). Writing down your password and leaving it on display / somewhere easy to find. Printing or copying confidential information and not storing it correctly or confidentially. Theft / Loss Theft / loss of a hard copy file. Theft / loss of any computer equipment. Page 10 of 11

11 SECURITY INCIDENT MANAGEMENT POLICY OWNER: ICT SMT DATE: 24/02/ Appendix 3 Process Flow; Reporting an Information Security Event or Weakness INFORMATION SECURITY INCIDENT MANAGEMENT POLICY Version 1. 0 All suspected security events to be reported to user s Line Manager and the ICT Service Desk via telephone. The following information must be provided *Contact name and number of the person reporting the incident * address of the person reporting the incident *Department and Directorate of person reporting the incident *The type of data, information or equipment involved Whether * the loss of data put any person or other data at risk *Location of the incident *Inventory numbers of any equipment affected *Location of data or equipment affected *Type and circumstances of the incident Event Record created in HEAT and unique sequential reference number generated and provided to the customer The ICT Service Desk will advise the user to *Note the symptoms and any error messages on the screen Disconnect the workstation from the network if an infection is suspected and request assistance from ICT Support Staff *Not use any removable media, for example USB memory sticks that may have been infected Security event to be analysed by Information Management Officer and progressed as either an event or an incident Incident Event or Incident Event If an incident requires the collation of evidence for a potential investigation this must be approached with care and the Councils Data Protection Officer and Internal Audit team consulted for guidance Incident Management Process to be invoked to include Analysis of the cause and the vulnerabilities exploited * * Limiting or restricting further impact of the incident *Tactics for containing the incident *Corrective action to repair and prevent reoccurrence *Communication across the Council to those affected ICT Information Management Officer to Sign off event with SIRO Event Closed Actions required to recover from the incident must be under formal c. ontrol Identified / Authorised staff only to have access to the affected systems during the incident. Remedial action undertaken to be documented in as much detail as possible Post Incident Review to be conducted, the following must be retained by ICT, Types of incident, volumes of incidents and malfunctions, costs incurred during the incident. Where appropriate information to be shared with WARP (Warning, Advice and Reporting Point), GovCert UK and the Information Commissioners Office (ICO) Incident Closed Incident Report retained Page 1 Page 11 of 11

Information Security Incident Management Policy and Procedure

Information Security Incident Management Policy and Procedure Information Security Incident Management Policy and Procedure Version Final 1.0 Document Control Organisation Title Author Filename Owner Subject Protective Marking North Dorset District Council IT Infrastructure

More information

Policy and Procedure Document. Information Security Incident Management Policy and Procedure

Policy and Procedure Document. Information Security Incident Management Policy and Procedure Policy and Procedure Document Information Security Incident Management Policy and Procedure [23/08/2011] Page 1 of 9 Document Control Organisation Redditch Borough Council Title Information Security Incident

More information

Information Security Incident Management Policy and Procedure. CONTROL SHEET FOR Information Security Incident Management Policy

Information Security Incident Management Policy and Procedure. CONTROL SHEET FOR Information Security Incident Management Policy Bolsover District Council North East Derbyshire District Council & Rykneld Homes Ltd Information Security Incident Management Policy September 2013 Version 1.0 Page 1 of 13 CONTROL SHEET FOR Information

More information

Information Security Policy. Chapter 10. Information Security Incident Management Policy

Information Security Policy. Chapter 10. Information Security Incident Management Policy Information Security Policy Chapter 10 Information Security Incident Management Policy Author: Policy & Strategy Team Version: 0.4 Date: December 2007 Version 0.4 Page 1 of 6 Document Control Information

More information

Security Incident Management Policy

Security Incident Management Policy Security Incident Management Policy January 2015 Document Version 2.4 Document Status Owner Name Owner Job Title Published Martyn Ward Head of ICT Business Delivery Document ref. Approval Date 27/01/2015

More information

Information Security Incident Management Policy

Information Security Incident Management Policy Information Security Incident Management Policy Version: 1.1 Date: September 2012 Unclassified Version Control Date Version Comments November 2011 1.0 First draft for comments to IT Policy & Regulation

More information

Security Incident Policy

Security Incident Policy Organisation Title Author Owner Protective Marking Somerset County Council Security Incident Policy Peter Grogan Information Governance Manager Unclassified POLICY ON A PAGE Somerset County Council will

More information

RHONDDA CYNON TAF COUNTY BOROUGH COUNCIL INFORMATION SECURITY POLICY Version 2.0.1

RHONDDA CYNON TAF COUNTY BOROUGH COUNCIL INFORMATION SECURITY POLICY Version 2.0.1 RHONDDA CYNON TAF COUNTY BOROUGH COUNCIL INFORMATION Version 2.0.1 Revised and effective from 1st April 2012 Document Control Document Control Organisation Title Author Filename ICT Services Information

More information

DBC 999 Incident Reporting Procedure

DBC 999 Incident Reporting Procedure DBC 999 Incident Reporting Procedure Signed: Chief Executive Introduction This procedure is intended to identify the actions to be taken in the event of a security incident or breach, and the persons responsible

More information

Information Security Incident Management Policy. Information Security Incident Management Policy. Policy and Guidance. June 2013

Information Security Incident Management Policy. Information Security Incident Management Policy. Policy and Guidance. June 2013 Information Security Incident Management Policy Policy and Guidance June 2013 Project Name Information Security Incident Management Policy Product Title Policy and Guidance Version Number 1.2 Final Page

More information

Information Incident Management Policy

Information Incident Management Policy Information Incident Management Policy Change History Version Date Description 0.1 04/01/2013 Draft 0.2 26/02/2013 Replaced procedure details with broad principles 0.3 27/03/2013 Revised following audit

More information

Islington Security Incident Policy A council-wide information technology policy. Version 0.7.1 July 2013

Islington Security Incident Policy A council-wide information technology policy. Version 0.7.1 July 2013 A council-wide information technology policy Version 0.7.1 July 2013 Copyright Notification Copyright London Borough of Islington 2014 This document is distributed under the Creative Commons Attribution

More information

Chiltern District Council ICT Security Policy

Chiltern District Council ICT Security Policy Chiltern District Council ICT Security Policy Chapter 3 Information Security Policy Version 2.1: 31/03/2012 Page 1 of 6 CONTENTS 1 Information Security Incident Management Policy 3 1.1 Overview 3 1.2 Policy

More information

U07 Information Security Incident Policy

U07 Information Security Incident Policy Dartmoor National Park Authority U07 Information Security Incident Policy June 2010 This document is copyright to Dartmoor National Park Authority and should not be used or adapted for any purpose without

More information

Quick Guide To Information Governance Policies

Quick Guide To Information Governance Policies Quick Guide To Information Governance Policies Data Protection The Data Protection Act 1998 established principles and rights in relation to the collection, use and storage of personal information by organisations.

More information

IT Infrastructure Security Policy. Policy and Guidance

IT Infrastructure Security Policy. Policy and Guidance IT Infrastructure Security Policy Policy and Guidance June 2013 Project Name Product Title IT Infrastructure Security Policy Policy and Guidance Version Number 1.2 Final Document Control Organisation Mendip

More information

INFORMATION SECURITY POLICY

INFORMATION SECURITY POLICY INFORMATION SECURITY POLICY INFORMATION SECURITY POLICY ISO 27002 5.1 Author: Owner: Organisation: Chris Stone Ruskwig TruePersona Ltd Document No: SP- 5.1 Version No: 1.0 Date: 10 th January 2010 Copyright

More information

Please note this policy is mandatory and staff are required to adhere to the content

Please note this policy is mandatory and staff are required to adhere to the content Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the

More information

Somerset County Council - Data Protection Policy - Final

Somerset County Council - Data Protection Policy - Final Organisation Title Author Owner Protective Marking Somerset County Council Data Protection Policy - Final Peter Grogan Information Governance Manager Unclassified POLICY ON A PAGE Somerset County Council

More information

Information Security Policy September 2009 Newman University IT Services. Information Security Policy

Information Security Policy September 2009 Newman University IT Services. Information Security Policy Contents 1. Statement 1.1 Introduction 1.2 Objectives 1.3 Scope and Policy Structure 1.4 Risk Assessment and Management 1.5 Responsibilities for Information Security 2. Compliance 3. HR Security 3.1 Terms

More information

Merthyr Tydfil County Borough Council. Information Security Policy

Merthyr Tydfil County Borough Council. Information Security Policy Merthyr Tydfil County Borough Council Information Security Policy 2014 Cyfarthfa High School is a Rights Respecting School, we recognise the importance of ensuring that the United Nations Convention of

More information

UNCLASSIFIED. http://www.govcertuk.gov.uk. General Enquiries. Incidents incidents@govcertuk.gov.uk Incidents incidents@govcertuk.gsi.gov.uk.

UNCLASSIFIED. http://www.govcertuk.gov.uk. General Enquiries. Incidents incidents@govcertuk.gov.uk Incidents incidents@govcertuk.gsi.gov.uk. Version 1.2 19-June-2013 GUIDELINES Incident Response Guidelines Executive Summary Government Departments have a responsibility to report computer incidents under the terms laid out in the SPF, issued

More information

Policy Document. IT Infrastructure Security Policy

Policy Document. IT Infrastructure Security Policy Policy Document IT Infrastructure Security Policy [23/08/2011] Page 1 of 10 Document Control Organisation Redditch Borough Council Title IT Infrastructure Security Policy Author Mark Hanwell Filename IT

More information

Policy Document. Communications and Operation Management Policy

Policy Document. Communications and Operation Management Policy Policy Document Communications and Operation Management Policy [23/08/2011] Page 1 of 11 Document Control Organisation Redditch Borough Council Title Communications and Operation Management Policy Author

More information

Schedule 13 Security Incident and Data Breach Policy. January 2015 v2.1

Schedule 13 Security Incident and Data Breach Policy. January 2015 v2.1 Schedule 13 Security Incident and Data Breach Policy January 2015 v2.1 Document History Purpose Document Purpose Document developed by Document Location To provide a corporate policy for the management

More information

Head of Information & Communications Technology Responsible work team: ICT Security. Key point summary... 2

Head of Information & Communications Technology Responsible work team: ICT Security. Key point summary... 2 Policy Procedure Information security policy Policy number: 442 Old instruction number: MAN:F005:a1 Issue date: 24 August 2006 Reviewed as current: 11 July 2014 Owner: Head of Information & Communications

More information

Software Policy. Software Policy. Policy and Guidance. June 2013

Software Policy. Software Policy. Policy and Guidance. June 2013 Software Policy Policy and Guidance June 2013 Project Name Software Policy Product Title Policy and Guidance Version Number 1.2Final Page 1 of 8 Document Control Organisation Title Author Filename Owner

More information

INFORMATION SECURITY INCIDENT REPORTING POLICY

INFORMATION SECURITY INCIDENT REPORTING POLICY Reference number Approved by Information Management and Technology Board Date approved 30 April 2013 Version 1.0 Last revised Review date March 2014 Category Owner Target audience Information Assurance

More information

IT ACCESS CONTROL POLICY

IT ACCESS CONTROL POLICY Reference number Approved by Information Management and Technology Board Date approved 30 April 2013 Version 1.0 Last revised Review date March 2014 Category Owner Target audience Information Assurance

More information

NORTH SOMERSET COUNCIL. Corporate Information Security Policy

NORTH SOMERSET COUNCIL. Corporate Information Security Policy Corporate Information Security Policy NORTH SOMERSET COUNCIL Corporate Information Security Policy Version 1_8 FINAL Author Date Approved Review Date Contents Authorisation Statement... 3 Document Amendment

More information

Third Party Security Requirements Policy

Third Party Security Requirements Policy Overview This policy sets out the requirements expected of third parties to effectively protect BBC information. Audience Owner Contacts This policy applies to all third parties and staff, including contractors,

More information

Corporate Information Security Management Policy

Corporate Information Security Management Policy Corporate Information Security Management Policy Signed: Chief Executive. 1. Definition of Information Security 1.1. Information security means safeguarding information from unauthorised access or modification

More information

Human Resources Policy documents. Data Protection Policy

Human Resources Policy documents. Data Protection Policy Policy documents Aims of the Policy apetito is committed to meeting its obligations under data protection law. As a business, apetito handles a range of Personal Data relating to its customers, staff and

More information

THE MORAY COUNCIL. Guidance on data security breach management DRAFT. Information Assurance Group. Evidence Element 9 appendix 31

THE MORAY COUNCIL. Guidance on data security breach management DRAFT. Information Assurance Group. Evidence Element 9 appendix 31 THE MORAY COUNCIL Guidance on data security breach management Information Assurance Group DRAFT Based on the ICO Guidance on data security breach management under the Data Protection Act 1 Document Control

More information

Information Security Policy

Information Security Policy You can learn more about the programme by downloading the information in the related documents at the bottom of this page. Information Security Document Information Security Policy 1 Version History Version

More information

SECURITY INCIDENT REPORTING AND MANAGEMENT. Standard Operating Procedures

SECURITY INCIDENT REPORTING AND MANAGEMENT. Standard Operating Procedures SECURITY INCIDENT REPORTING AND MANAGEMENT Standard Operating Procedures Notice: This document has been made available through the Police Service of Scotland Freedom of Information Publication Scheme.

More information

Network Password Management Policy & Procedures

Network Password Management Policy & Procedures Network Password Management Policy & Procedures Document Ref ISO 27001 Section 11 Issue No Version 1.3 Document Control Information Issue Date April 2009, June 2010, September 2011 Status Approved By FINAL

More information

Tameside Metropolitan Borough Council ICT Security Policy for Schools. Adopted by:

Tameside Metropolitan Borough Council ICT Security Policy for Schools. Adopted by: Tameside Metropolitan Borough Council ICT Security Policy for Schools Adopted by: 1. Introduction 1.1. The purpose of the Policy is to protect the institution s information assets from all threats, whether

More information

University of Sunderland Business Assurance Information Security Policy

University of Sunderland Business Assurance Information Security Policy University of Sunderland Business Assurance Information Security Policy Document Classification: Public Policy Reference Central Register Policy Reference Faculty / Service IG 003 Policy Owner Assistant

More information

ISO IEC 27002 2005 (17799 2005) TRANSLATED INTO PLAIN ENGLISH

ISO IEC 27002 2005 (17799 2005) TRANSLATED INTO PLAIN ENGLISH 13.1 REPORT INFORMATION SECURITY EVENTS AND WEAKNESSES 1 GOAL Make sure that information system security incidents are promptly reported. 2 GOAL Make sure that information system security events and weaknesses

More information

Version: 2.0. Effective From: 28/11/2014

Version: 2.0. Effective From: 28/11/2014 Policy No: OP58 Version: 2.0 Name of Policy: Anti Virus Policy Effective From: 28/11/2014 Date Ratified 17/09/2014 Ratified Health Informatics Assurance Committee Review Date 01/09/2016 Sponsor Director

More information

ABERDARE COMMUNITY SCHOOL

ABERDARE COMMUNITY SCHOOL ABERDARE COMMUNITY SCHOOL IT Security Policy Drafted June 2014 Revised on....... Mrs. S. Davies (Headteacher) Mr. A. Maddox (Chair of Interim Governing Body) IT SECURITY POLICY Review This policy has been

More information

Policy Document Control Page

Policy Document Control Page Policy Document Control Page Title Title Policy for the Permitted use of removable media - harmonised Version: 4 Reference Number: CO50 Supersedes Supersedes: 3 Description of Amendment(s): No changes

More information

University of Aberdeen Information Security Policy

University of Aberdeen Information Security Policy University of Aberdeen Information Security Policy Contents Introduction to Information Security... 1 How can information be protected?... 1 1. Information Security Policy... 3 Subsidiary Policy details:...

More information

Islington ICT Physical Security of Information Policy A council-wide information technology policy. Version 0.7 June 2014

Islington ICT Physical Security of Information Policy A council-wide information technology policy. Version 0.7 June 2014 Islington ICT Physical Security of Information Policy A council-wide information technology policy Version 0.7 June 2014 Copyright Notification Copyright London Borough of Islington 2014 This document

More information

Seychelles Revenue Commission Practice Statement PS CM 2009/02

Seychelles Revenue Commission Practice Statement PS CM 2009/02 Seychelles Revenue Commission Practice Statement This Corporate Management Practice Statement is issued under the authority of the Revenue Commissioner (Commissioner) of the Seychelles Revenue Commission

More information

43: DATA SECURITY POLICY

43: DATA SECURITY POLICY 43: DATA SECURITY POLICY DATE OF POLICY: FEBRUARY 2013 STAFF RESPONSIBLE: HEAD/DEPUTY HEAD STATUS: STATUTORY LEGISLATION: THE DATA PROTECTION ACT 1998 REVIEWED BY GOVERNING BODY: FEBRUARY 2013 EDITED:

More information

Information Security Policy

Information Security Policy Information Security Policy Revised: September 2015 Review Date: September 2020 New College Durham is committed to safeguarding and promoting the welfare of children and young people, as well as vulnerable

More information

INFORMATION SECURITY MANAGEMENT SYSTEM. Version 1c

INFORMATION SECURITY MANAGEMENT SYSTEM. Version 1c INFORMATION SECURITY MANAGEMENT SYSTEM Version 1c Revised April 2011 CONTENTS Introduction... 5 1 Security Policy... 7 1.1 Information Security Policy... 7 1.2 Scope 2 Security Organisation... 8 2.1 Information

More information

SECURITY POLICY REMOTE WORKING

SECURITY POLICY REMOTE WORKING ROYAL BOROUGH OF WINDSOR AND MAIDENHEAD SECURITY POLICY REMOTE WORKING Introduction This policy defines the security rules and responsibilities that apply when doing Council work outside of Council offices

More information

Information Security

Information Security Information Security A staff guide to the University's Information Systems Security Policy Issued by the IT Security Group on behalf of the University. Information Systems Security Guidelines for Staff

More information

Cyber Security Incident Reporting Scheme

Cyber Security Incident Reporting Scheme OCIO/G4.12a ISMF Guideline 12a Cyber Security Incident Reporting Scheme BACKGROUND Reporting cyber security incidents is a source of intelligence information that assists in the development of a greater

More information

Corporate Information Security Policy

Corporate Information Security Policy Corporate Information Security Policy. A guide to the Council s approach to safeguarding information resources. September 2015 Contents Page 1. Introduction 1 2. Information Security Framework 2 3. Objectives

More information

Infrastructure Security Policy

Infrastructure Security Policy Bolsover District Council North East Derbyshire District Council & Rykneld Homes Ltd ICT Infrastructure Security Policy September 2013 Version 1.0 Page 1 of 11 CONTROL SHEET FOR ICT Infrastrutcure Security

More information

Information Security Policies. Version 6.1

Information Security Policies. Version 6.1 Information Security Policies Version 6.1 Information Security Policies Contents: 1. Information Security page 3 2. Business Continuity page 5 3. Compliance page 6 4. Outsourcing and Third Party Access

More information

DATA SECURITY BREACH MANAGEMENT POLICY AND PROCEDURE

DATA SECURITY BREACH MANAGEMENT POLICY AND PROCEDURE DATA SECURITY BREACH MANAGEMENT POLICY AND PROCEDURE 1. INTRODUCTION Annex C 1.1 Surrey Heath Borough Council (SHBC) processes personal data and must respond appropriately against unauthorised or unlawful

More information

PS177 Remote Working Policy

PS177 Remote Working Policy PS177 Remote Working Policy January 2014 Version 2.0 Statement of Legislative Compliance This document has been drafted to comply with the general and specific duties in the Equality Act 2010; Data Protection

More information

AUDIT COMMITTEE 10 DECEMBER 2014

AUDIT COMMITTEE 10 DECEMBER 2014 AUDIT COMMITTEE 10 DECEMBER 2014 AGENDA ITEM 8 Subject Report by MANAGEMENT OF INFORMATION RISKS DIRECTOR OF CORPORATE SERVICES Enquiries contact: Tony Preston, Ext 6541, email tony.preston@chelmsford.gov.uk

More information

Note: Non JCQ awarding bodies have their own reporting forms and these would be used where appropriate.

Note: Non JCQ awarding bodies have their own reporting forms and these would be used where appropriate. MALPRACTICE IN ASSESSMENT POLICY 1. Policy Statement 1.1 Carshalton College is committed to ensuring that issues of malpractice in internal and external examinations and assessments are addressed. For

More information

Working Practices for Protecting Electronic Information

Working Practices for Protecting Electronic Information Information Security Framework Working Practices for Protecting Electronic Information 1. Purpose The following pages provide more information about the minimum working practices which seek to ensure that

More information

WEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY

WEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY WEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY DATA LABEL: PUBLIC INFORMATION SECURITY POLICY CONTENTS 1. INTRODUCTION... 3 2. MAIN OBJECTIVES... 3 3. LEGISLATION... 4 4. SCOPE... 4 5. STANDARDS... 4

More information

Data Protection Breach Reporting Procedure

Data Protection Breach Reporting Procedure Central Bedfordshire Council www.centralbedfordshire.gov.uk Data Protection Breach Reporting Procedure October 2015 Security Classification: Not Protected 1 Approval History Version No Approved by Approval

More information

Council, 14 May 2015. Information Governance Report. Introduction

Council, 14 May 2015. Information Governance Report. Introduction Council, 14 May 2015 Information Governance Report Introduction 1.1 The Information Governance function within the Secretariat Department is responsible for the HCPC s ongoing compliance with the Freedom

More information

REMOTE WORKING POLICY

REMOTE WORKING POLICY Reference number Approved by Information Management and Technology Board Date approved 30 April 2013 Version 1.0 Last revised Review date March 2014 Category Owner Target audience Information Assurance

More information

Information Security Policy

Information Security Policy Information Security Policy To whom this document applies: All Trust staff, including agency and contractors Procedural Documents Approval Committee Issue Date: January 2010 Version 1 Document reference:

More information

Information Classification and. Handling Policy

Information Classification and. Handling Policy Information Security Document Information Classification and 1 Version History Version Date Detail Author 1.0 27/06/2013 Approved by Information Governance Jo White Group 2.0 31/07/2013 Approved by Information

More information

Information Incident Management and Reporting Procedures

Information Incident Management and Reporting Procedures ` Information Incident Management and Reporting Procedures Compliance with all CCG policies, procedures, protocols, guidelines, guidance and standards is a condition of employment. Breach of policy may

More information

Information Security Policy

Information Security Policy Information Security Policy Author: Responsible Lead Executive Director: Endorsing Body: Governance or Assurance Committee Alan Ashforth Alan Lawrie ehealth Strategy Group Implementation Date: September

More information

INFORMATION SECURITY POLICY

INFORMATION SECURITY POLICY INFORMATION SECURITY POLICY Rev Date Purpose of Issue/ Description of Change Equality Impact Assessment Completed 1. June 2011 Initial Issue 2. 29 th March 2012 Second Version 3. 15 th April 2013 Third

More information

Physical Security Policy

Physical Security Policy Physical Security Policy Author: Policy & Strategy Team Version: 0.8 Date: January 2008 Version 0.8 Page 1 of 7 Document Control Information Document ID Document title Sefton Council Physical Security

More information

Incident reporting procedure

Incident reporting procedure Incident reporting procedure Responsible Officer Author Date effective from Aug 2009 Date last amended Aug 2009 Review date July 2012 Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance

More information

IT Security Policy - Information Security Management System (ISMS)

IT Security Policy - Information Security Management System (ISMS) IT Security Policy - Information Security Management System (ISMS) Responsible Officer Contact Officer Vice-President, Finance & Operations Chief Digital Officer Superseded Documents IT Security Policy,

More information

Senior School 1 PURPOSE 2 SCOPE 3 SCHOOL RESPONSIBILITIES

Senior School 1 PURPOSE 2 SCOPE 3 SCHOOL RESPONSIBILITIES Senior School 1 PURPOSE The policy defines and describes the acceptable use of ICT (Information and Communications Technology) and mobile phones for school-based employees. Its purpose is to minimise the

More information

Incident Response Plan for PCI-DSS Compliance

Incident Response Plan for PCI-DSS Compliance Incident Response Plan for PCI-DSS Compliance City of Monroe, Georgia Information Technology Division Finance Department I. Policy The City of Monroe Information Technology Administrator is responsible

More information

Anti Virus Policy. WHICTS Policy. Author: Ian McGregor Deputy Director of ICT. Status Draft Version 1.0. Date 23 rd September 2008 Circulation

Anti Virus Policy. WHICTS Policy. Author: Ian McGregor Deputy Director of ICT. Status Draft Version 1.0. Date 23 rd September 2008 Circulation Anti Virus Policy Department / Service: IM & T Department Author: Ian McGregor Deputy Director of ICT Status Draft Version 1.0 Date 23 rd September 2008 Circulation ICT Programme Board Review date November

More information

INFORMATION SECURITY POLICY

INFORMATION SECURITY POLICY Information Security Policy INFORMATION SECURITY POLICY Introduction Norwood UK recognises that information and information systems are valuable assets which play a major role in supporting the companies

More information

The Ministry of Information & Communication Technology MICT

The Ministry of Information & Communication Technology MICT The Ministry of Information & Communication Technology MICT Document Reference: ISGSN2012-10-01-Ver 1.0 Published Date: March 2014 1 P a g e Table of Contents Table of Contents... 2 Definitions... 3 1.

More information

Security Incident Procedures Response and Reporting Policy

Security Incident Procedures Response and Reporting Policy Security Incident Procedures Response and Reporting Policy Approved By: \S\ James Palmer CSC Loss Prevention Director PCI Policy # 1030 Version # 1.0 Effective Date: MM/DD/YYYY Date 1.0 Purpose The purpose

More information

INFORMATION TECHNOLOGY SECURITY STANDARDS

INFORMATION TECHNOLOGY SECURITY STANDARDS INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL

More information

Harper Adams University College. Information Security Policy

Harper Adams University College. Information Security Policy Harper Adams University College Information Security Policy Introduction The University College recognises that information and information systems are valuable assets which play a major role in supporting

More information

Caedmon College Whitby

Caedmon College Whitby Caedmon College Whitby Data Protection and Information Security Policy College Governance Status This policy was re-issued in June 2014 and was adopted by the Governing Body on 26 June 2014. It will be

More information

Information Security Incident Management Guidelines. e-governance

Information Security Incident Management Guidelines. e-governance Information Security Incident Management Guidelines for e-governance Draft DEPARTMENT OF ELECTRONICS AND INFORMATION TECHNOLOGY Ministry of Communication and Information Technology, Government of India.

More information

STRATEGIC POLICY REQUIRED HARDWARE, SOFTWARE AND CONFIGURATION STANDARDS

STRATEGIC POLICY REQUIRED HARDWARE, SOFTWARE AND CONFIGURATION STANDARDS Policy: Title: Status: ISP-S9 Use of Computers Policy Revised Information Security Policy Documentation STRATEGIC POLICY 1. Introduction 1.1. This information security policy document contains high-level

More information

Information Security Incident Protocol

Information Security Incident Protocol Information Security Incident Protocol Document Owner Caroline Dodge Tel: 01622-221652 caroline.dodge@kent.gov.uk Version Version 2: July 2013 Contents 1. Protocol Objectives 2. Scope 3. Protocol Statement

More information

KEELE UNIVERSITY IT INFORMATION SECURITY POLICY

KEELE UNIVERSITY IT INFORMATION SECURITY POLICY Contents 1. Introduction 2. Objectives 3. Scope 4. Policy Statement 5. Legal and Contractual Requirements 6. Responsibilities 7. Policy Awareness and Disciplinary Procedures 8. Maintenance 9. Physical

More information

Information Security Policy

Information Security Policy Central Bedfordshire Council www.centralbedfordshire.gov.uk Information Security Policy January 2016 Security Classification: Not Protected 1 Approval History Version No Approved by Approval Date Comments

More information

INFORMATION SECURITY POLICY. Contents. Introduction 2. Policy Statement 3. Information Security at RCA 5. Annexes

INFORMATION SECURITY POLICY. Contents. Introduction 2. Policy Statement 3. Information Security at RCA 5. Annexes INFORMATION SECURITY POLICY Ratified by RCA Senate, February 2007 Contents Introduction 2 Policy Statement 3 Information Security at RCA 5 Annexes A. Applicable legislation and interpretation 8 B. Most

More information

Highland Council Information Security Policy

Highland Council Information Security Policy Highland Council Information Security Policy Document Owner: Vicki Nairn, Head of Digital Transformation Page 1 of 16 Contents 1. Document Control... 4 Version History... 4 Document Authors... 4 Distribution...

More information

Merthyr Tydfil County Borough Council. Data Protection Policy

Merthyr Tydfil County Borough Council. Data Protection Policy Merthyr Tydfil County Borough Council Data Protection Policy 2014 Cyfarthfa High School is a Rights Respecting School, we recognise the importance of ensuring that the United Nations Convention of the

More information

Internet, , Computer, and Telecommunications Policy

Internet,  , Computer, and Telecommunications Policy Internet, Email, Computer, and Telecommunications Policy 1. Purpose This policy sets out appropriate use of Monitor internet, email, general computer, and telecommunication services and equipment. This

More information

INFORMATION SECURITY QUESTIONS AND ANSWERS Market Research Industry

INFORMATION SECURITY QUESTIONS AND ANSWERS Market Research Industry INFORMATION SECURITY QUESTIONS AND ANSWERS Market Research Industry OVERVIEW This presentation provides an awareness of information security and its impact on the market research industry based on a risk

More information

So the security measures you put in place should seek to ensure that:

So the security measures you put in place should seek to ensure that: Guidelines This guideline offers an overview of what the Data Protection Act requires in terms of information security and aims to help you decide how to manage the security of the personal data you hold.

More information

Procedures on Data Security Breach Management Version Control Date Version Reason Owner Author 16/09/2009 Draft 1 Outline Draft Jackie Groom

Procedures on Data Security Breach Management Version Control Date Version Reason Owner Author 16/09/2009 Draft 1 Outline Draft Jackie Groom Procedures on Data Security Breach Management Version Control Date Version Reason Owner Author 16/09/2009 Draft 1 Outline Draft Jackie Groom Indirani 02/11/2009 Draft 2 Include JG s comments Jackie Groom

More information

Informatics Policy. Information Governance. Network Account and Password Management Policy

Informatics Policy. Information Governance. Network Account and Password Management Policy Informatics Policy Information Governance Policy Ref: 3589 Document Title Author/Contact Document Reference 3589 Document Control Network Account Management and Password Policy Pauline Nordoff-Tate, Information

More information

Nazareth Catholic College Student Acceptable Use of Information and Communications Technology Procedures

Nazareth Catholic College Student Acceptable Use of Information and Communications Technology Procedures Nazareth Catholic College Student Acceptable Use of Information and Communications Technology Procedures 1. Introduction Nazareth Catholic College acknowledges the increasing use of Information and Communication

More information

Newcastle University Information Security Procedures Version 3

Newcastle University Information Security Procedures Version 3 Newcastle University Information Security Procedures Version 3 A Information Security Procedures 2 B Business Continuity 3 C Compliance 4 D Outsourcing and Third Party Access 5 E Personnel 6 F Operations

More information

TONBRIDGE & MALLING BOROUGH COUNCIL INTERNET & EMAIL POLICY AND CODE

TONBRIDGE & MALLING BOROUGH COUNCIL INTERNET & EMAIL POLICY AND CODE GENERAL STATEMENT TONBRIDGE & MALLING BOROUGH COUNCIL INTERNET & EMAIL POLICY AND CODE 1.1 The Council recognises the increasing importance of the Internet and email, offering opportunities for improving

More information

ITEC Malpractice & Maladministration Policy

ITEC Malpractice & Maladministration Policy ITEC Malpractice & Maladministration Policy Version 3 1 Contents Malpractice & Maladministration Policy 3 Introduction 3 Centre s Responsibility 3 Review Arrangements 4 Definition of Malpractice 4 Definition

More information

POLICY SERVICE CHILDREN S EDUCATION. Security Incident Reporting Information) Issued November An Agency of the Ministry of Defence

POLICY SERVICE CHILDREN S EDUCATION. Security Incident Reporting Information) Issued November An Agency of the Ministry of Defence SERVICE CHILDREN S EDUCATION POLICY Security Incident Reporting Information) Issued November 2011 The purpose of this document is to describe the procedures for identifying, reporting, responding to, and

More information

Standard: Information Security Incident Management

Standard: Information Security Incident Management Standard: Information Security Incident Management Page 1 Executive Summary California State University Information Security Policy 8075.00 states security incidents involving loss, damage or misuse of

More information