Information Security Incident Reporting & Investigation

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Information Security Incident Reporting & Investigation"

Transcription

1 Information Security Incident Reporting & Investigation Purpose: To ensure all employees, consultants, agency workers and volunteers are able to recognise an information security incident and know how to act on it, by reporting it correctly. Owner Director of Finance & Corporate Services Approved 18/05/2016 Policy IS/006 Number Review Date 17/05/2018 Change History Version Date Summary of Change Effective Date 18/05/2016 Page Page 1 of 9

2 This policy should be considered in conjunction with the following relevant linked policies; 1. Data Protection & Confidentiality 2. Information Governance 3. Information Security Systems 4. Usage 5. Information Security Classification 6. Internet Usage 7. Social Media 8. Requesting Access, Equipment & Services 9. Records Management & Retention Policy Contents Page 1) Introduction 3 2) Definition of a Security Incident 3 3) Reporting a Security Incident 6 4) Security Incident Investigation 7 5) Findings of Sabotage or Misuse 8 6) Policy Review 8 Appendix 1 Security Incident Reporting Form Effective Date 18/05/2016 Page Page 2 of 9

3 1 Introduction 1.1 The organisation is responsible for the security and integrity of all the data it holds. The purpose of this policy is to ensure all employees, consultants, agency workers and volunteers are able to recognise an information security incident and know how to act on it, by reporting it correctly. 1.2 The organisation must protect the data it holds using all means necessary by ensuring at all times that any incident, which could cause damage to the organisation s assets and reputation is prevented and/or minimised. 1.3 Raising awareness and fostering a culture of proactive incident reporting will help reduce the number of security incidents which often go unreported and/or unnoticed. 2 Definition of a Security Incident 2.1 There are many types of security incident, which could affect security these include (but are not limited to); Loss of confidential information Compromise of the integrity of information Denial of service Unauthorised access to systems Misuse of systems or information Theft or damage to systems Virus attacks Intrusion by hackers Loss of ID badge Missing correspondence/documents through the postal system Incorrect recipient or personal & sensitive information sent via unencrypted Exposure of uncollected print-outs Loss of mobile phones and devices Other incident types include, 2.2 Computers left unlocked when unattended users of the organisation s network are continually reminded of the importance of locking their computer screens when not in use or when leaving their computer unattended for any length of time. All employees, consultants, agency workers and volunteers must lock their screens without exception when not in use the quickest way to carry this out is to use the windows key and press L. Should an Effective Date 18/05/2016 Page Page 3 of 9

4 employee discover an unlocked computer, they should lock it and notify the individual of their action never send joke s from someone s account to make a point. Continual failure to lock their screen when not in use should be reported as an incident for further investigation and action. 2.3 Password disclosures Authorised users are issued with a logon of Username and Password combination to allow access to systems and data. It is imperative that individual passwords are not disclosed to others regardless of trust. If an individual needs access to a specific set of data or system then they must go through the correct procedures for access authorisation in their own right there are no exceptions to this. If anyone suspects that their or any other user s password has been disclosed, whether intentionally, inadvertently or accidentally then this must be reported as an incident. 2.4 Bogus s is a popular method for 3 rd parties to either trick an individual to disclose personal or sensitive data or introduce a virus/malware or malicious code into the organisation s network. All users of the organisation s IT systems are required to be vigilant and reduce the risk from attack. Traits to look out for to identify a bogus are; The message contains a mismatched URL The message contains poor spelling and grammar The message asks for personal information The offer seems too good to be true You didn't initiate the action The message makes unrealistic threats Something just doesn't look right 2.5 Bogus s containing macros or hyperlinks will contain a virus/malware and/or malicious code, which could disable the network and severely impact on business operations. Should a user receive such an it is absolutely vital that if they do inadvertently open the , they absolutely must not click any hyperlinks or enable macros. This should then be reported as an incident immediately. 2.6 As a reminder s from the following (but not limited to) HMRC Various Banks (in particular Santander ) especially if you are not in the finance team Tesco regarding a delivery Companies House PayPal (check the URL) A Nigerian Prince Effective Date 18/05/2016 Page Page 4 of 9

5 Anyone offering you a significant refund (inc. PPI) for a service you haven t used are bogus and should be deleted. If you are ever unsure about the legitimacy of an , seek advice from the IT section or Quality & Compliance Manager before you open the Media Loss Use of portable media such as CD, DVD, USB s, HD Drives etc for storing data requires the user to be fully aware of the responsibilities of using such devices. The use of laptops, tablets, smart phones and many other portable devices increases the potential for data to be exposed and vulnerable to unauthorised access. Any authorised user of a portable device (including portable media) who has misplaced or suspects damage (whether intentional or accidental) or theft must report it as an incident. 2.8 Data Loss/Disclosure the potential for data loss does not only apply to portable media but it also applies to data which is; Transmitted over the network and reaching an unintended, unauthorised recipient. Intercepted over the internet through non-secure channels Posting of data on the internet whether accidental or intentional Published on the organisation s website and identified as inaccurate or inappropriate Conversationally - information disclosed during conversation Press or media unauthorised disclosure by employees or an ill advised representative to the press or media Data which can no longer be located and is unaccounted for on an IT system Uncollected printouts Paper copies of data and information which can no longer be located Hard copies of information and data accessible from desks, unlocked filing cabinets and unattended areas. 2.9 All employees, consultants, agency workers and volunteers must act responsibly, professionally and be mindful of the importance of maintaining the security and integrity of organisational data at all times. Any loss of data and/or disclosure to unauthorised parties must be reported immediately. Effective Date 18/05/2016 Page Page 5 of 9

6 3 Reporting a Security Incident 3.1 All security incidents or suspected security incidents should be reported, with as much detail as possible, immediately. 3.2 To help understand who to report what type of security incident to please see the flowchart below; Is it a security incident? Not sure? Yes Speak to the Quality & Compliance Manager for further advice Does the incident involve IT Systems (inc. ) or mobile devices? No Yes Report the incident to the Quality & Compliance Manager Report the incident to the IT Section The Quality & Compliance Manager (depending on type & severity), notifies the Executive Team / DWP Security Team / Caldicott Guardian etc IT Section to notify the Quality & Compliance Manager Effective Date 18/05/2016 Page Page 6 of 9

7 3.3 When reporting a security incident, you must include as much information as possible including; What type of security incident it is When the incident happened If you think/know that customer data has been affected How it s thought the breach occurred Names of any other people involved/affected 3.4 The Security Incident form (appendix 1) should be completed as soon as possible and sent to the Quality & Compliance Manager however the incident should be reported verbally in the first instance as time is of the essence, especially with security incidents involving the network or IT systems. 3.5 IT users should be aware that security incidents which involve their IT account (inc. ) may lose access temporarily, until the scope of the incident and threat to the rest of the network and IT systems is established. 3.6 The Quality & Compliance Manager records all incidents on the Security Incident Register. This information is routinely reported to the Executive Team on a bi-annual basis. 3.7 The Quality & Compliance Manager will also notify the appropriate bodies following a security incident for example the Caldicott Guardian if the breach involves NHS data or the DWP Security Team. 4 Security Incident Investigation 4.1 The Quality & Compliance Manager (with support from the IT Section as appropriate) will carry out an investigation for security incidents in order to establish the scope of the breach or loss, damage caused, risk to the organisation and preventative actions required to stop future occurrences. 4.2 Where security incidents involve IT systems or the network then access to other accounts or I / U drives may be required. The organisation reserves the right to inspect any and all files stored in private areas of our network as part of a security incident investigation. 4.3 The organisation has software and systems in place to monitor and record all and internet usage. No employee, consultant, agency worker or volunteer should have any expectation of privacy as to their usage, IT account contents or internet usage via the organisations network. Effective Date 18/05/2016 Page Page 7 of 9

8 4.4 If access to another individuals account is required as part of an investigation then permission will be sought from a member of the Executive Team. When appropriate, employees will be notified of this action. 4.5 Once the investigation is complete, a report (if appropriate) will be submitted to the Executive Team for review and action. Other parties, such as the DWP Security Team, will also receive a copy of the report along with any corrective actions as appropriate. 5 Findings of Sabotage or Misuse 5.1 The organisation expects all users with access to customer personal & sensitive information to respect the need for confidentiality and to avoid improper use or transfer of such information. Inappropriate IT or data usage will be managed within the organisation s Disciplinary policy. Any user who fails to adhere to these principles will subject themselves to disciplinary action, up to and including, dismissal, in addition such unauthorised access is liable for prosecution as a criminal offence under Section 55 of the Data protection Act 1998 and/or legal action under the Computer Misuse Act Policy Review 6.1 This policy will be reviewed every two years unless there is a change of law, guidelines or contractual obligation and maybe subject to change. Effective Date 18/05/2016 Page Page 8 of 9

9 Appendix 1 Information Security Incident Report Form Please complete this form as fully as you are able as this will help with actions to contain and manage the incident to prevent further breach and/or loss. Name Team Location Date Line-Manager IT Section Verbally Notified? Yes/No* Quality & Compliance Manager Notified? Yes/No* Type of Security Incident please tick as appropriate; Loss of Confidential data Information integrity compromised Virus Attack Misuse of systems/data Unauthorised access to systems Denial of Service Loss of ID Badge Theft or damage to systems Intrusion by Hackers Data sent via unencrypted Missing Documents in Post system Uncollected printed documents Loss of mobile phone/device sent to incorrect recipient VDU unlocked & unattended Password Disclosures Bogus Media Loss (USB etc..) Unauthorised posting on the internet Data loss via conversation Data missing from IT system (folders etc) Hard copy data accessible from desks/unlocked Unauthorised disclosure to press / media filing cabinets etc.. Other please describe: Date of Incident Time of incident (if known) Type of data involved Customer* / Staff* / Financial* / Business* / NHS* / DWP* / Other* please state: Please describe the incident including any events leading up to it and/or actions taken by you *please delete as appropriate Please send this form to the Quality & Compliance Manager as soon as possible Effective Date 18/05/2016 Page Page 9 of 9

Policy and Procedure Document. Information Security Incident Management Policy and Procedure

Policy and Procedure Document. Information Security Incident Management Policy and Procedure Policy and Procedure Document Information Security Incident Management Policy and Procedure [23/08/2011] Page 1 of 9 Document Control Organisation Redditch Borough Council Title Information Security Incident

More information

INFORMATION SECURITY POLICY

INFORMATION SECURITY POLICY INFORMATION SECURITY POLICY Rev Date Purpose of Issue/ Description of Change Equality Impact Assessment Completed 1. June 2011 Initial Issue 2. 29 th March 2012 Second Version 3. 15 th April 2013 Third

More information

Information Security Incident Management Policy. Information Security Incident Management Policy. Policy and Guidance. June 2013

Information Security Incident Management Policy. Information Security Incident Management Policy. Policy and Guidance. June 2013 Information Security Incident Management Policy Policy and Guidance June 2013 Project Name Information Security Incident Management Policy Product Title Policy and Guidance Version Number 1.2 Final Page

More information

Information Security Policy

Information Security Policy Central Bedfordshire Council www.centralbedfordshire.gov.uk Information Security Policy January 2016 Security Classification: Not Protected 1 Approval History Version No Approved by Approval Date Comments

More information

Information Security Policy September 2009 Newman University IT Services. Information Security Policy

Information Security Policy September 2009 Newman University IT Services. Information Security Policy Contents 1. Statement 1.1 Introduction 1.2 Objectives 1.3 Scope and Policy Structure 1.4 Risk Assessment and Management 1.5 Responsibilities for Information Security 2. Compliance 3. HR Security 3.1 Terms

More information

Information Security Incident Management Policy and Procedure

Information Security Incident Management Policy and Procedure Information Security Incident Management Policy and Procedure Version Final 1.0 Document Control Organisation Title Author Filename Owner Subject Protective Marking North Dorset District Council IT Infrastructure

More information

So the security measures you put in place should seek to ensure that:

So the security measures you put in place should seek to ensure that: Guidelines This guideline offers an overview of what the Data Protection Act requires in terms of information security and aims to help you decide how to manage the security of the personal data you hold.

More information

Please note this policy is mandatory and staff are required to adhere to the content

Please note this policy is mandatory and staff are required to adhere to the content Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the

More information

GUIDE TO MANAGING DATA BREACHES

GUIDE TO MANAGING DATA BREACHES 8 MAY 2015 CONTENT PURPOSE OF THE GUIDE 3 INTRODUCTION 4 HOW DATA BREACHES COULD OCCUR 5 RESPONDING TO A DATA BREACH 6 i. DATA BREACH MANAGEMENT PLAN 6 ii. CONTAINING THE BREACH 7 iii. ASSESSING RISK AND

More information

Information Security Policy

Information Security Policy Information Security Policy 1 Version and Review Summary Rev Date Author Approver Revision description 1.00 April 2009 T Monachello Formal Review 1.01 1 st June 2009 T.Monachello Information Governance

More information

SERVER, DESKTOP AND PORTABLE SECURITY. September 2014. Version 3.0

SERVER, DESKTOP AND PORTABLE SECURITY. September 2014. Version 3.0 SERVER, DESKTOP AND PORTABLE SECURITY September 2014 Version 3.0 Western Health and Social Care Trust Page 1 of 6 Server, Desktop and Portable Policy Title SERVER, DESKTOP AND PORTABLE SECURITY POLICY

More information

COVER SHEET OF POLICY DOCUMENT Code Number Policy Document Name

COVER SHEET OF POLICY DOCUMENT Code Number Policy Document Name COVER SHEET OF POLICY DOCUMENT Code Number Policy Document Name Introduction Removable Media and Mobile Device Policy Removable media and mobile devices are increasingly used to enable information access

More information

SECURITY POLICY REMOTE WORKING

SECURITY POLICY REMOTE WORKING ROYAL BOROUGH OF WINDSOR AND MAIDENHEAD SECURITY POLICY REMOTE WORKING Introduction This policy defines the security rules and responsibilities that apply when doing Council work outside of Council offices

More information

Information Incident Management Policy

Information Incident Management Policy Information Incident Management Policy Change History Version Date Description 0.1 04/01/2013 Draft 0.2 26/02/2013 Replaced procedure details with broad principles 0.3 27/03/2013 Revised following audit

More information

Information Security

Information Security Information Security A staff guide to the University's Information Systems Security Policy Issued by the IT Security Group on behalf of the University. Information Systems Security Guidelines for Staff

More information

Security Awareness. A Supplier Guide/Employee Training Pack. May 2011 (updated November 2011)

Security Awareness. A Supplier Guide/Employee Training Pack. May 2011 (updated November 2011) Security Awareness A Supplier Guide/Employee Training Pack May 2011 (updated November 2011) Contents/Chapters 1. How do I identify a DWP asset 2. Delivering on behalf of DWP - Accessing DWP assets 3. How

More information

INFORMATION GOVERNANCE AND SECURITY 1 POLICY DRAFTED BY: INFORMATION GOVERNANCE LEAD 2 ACCOUNTABLE DIRECTOR: SENIOR INFORMATION RISK OWNER

INFORMATION GOVERNANCE AND SECURITY 1 POLICY DRAFTED BY: INFORMATION GOVERNANCE LEAD 2 ACCOUNTABLE DIRECTOR: SENIOR INFORMATION RISK OWNER INFORMATION GOVERNANCE AND SECURITY 1 POLICY DRAFTED BY: INFORMATION GOVERNANCE LEAD 2 ACCOUNTABLE DIRECTOR: SENIOR INFORMATION RISK OWNER 3 APPLIES TO: ALL STAFF 4 COMMITTEE & DATE APPROVED: AUDIT COMMITTEE

More information

Incident reporting procedure

Incident reporting procedure Incident reporting procedure Responsible Officer Author Date effective from Aug 2009 Date last amended Aug 2009 Review date July 2012 Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance

More information

HFS DATA SECURITY TRAINING WITH TECHNOLOGY COMES RESPONSIBILITY

HFS DATA SECURITY TRAINING WITH TECHNOLOGY COMES RESPONSIBILITY HFS DATA SECURITY TRAINING WITH TECHNOLOGY COMES RESPONSIBILITY Illinois Department of Healthcare and Family Services Training Outline: Training Goals What is the HIPAA Security Rule? What is the HFS Identity

More information

Information Security Policy

Information Security Policy Information Security Policy 1 Issue Date: December 2014 Version: 3.0 DOCUMENT CONTROL...3 1 INTRODUCTION...4 2 WHAT MUST I KNOW?...4 3 HOW DO THE KEY PRINCIPLES RELATE TO ME?...5 2 Document Control Policy

More information

Information Security Incident Management Policy September 2013

Information Security Incident Management Policy September 2013 Information Security Incident Management Policy September 2013 Approving authority: University Executive Consultation via: Secretary's Board REALISM Project Board Approval date: September 2013 Effective

More information

Information Security Incident Management Policy

Information Security Incident Management Policy Information Security Incident Management Policy Version: 1.1 Date: September 2012 Unclassified Version Control Date Version Comments November 2011 1.0 First draft for comments to IT Policy & Regulation

More information

NHS Business Services Authority Information Security Incident Reporting Procedure

NHS Business Services Authority Information Security Incident Reporting Procedure NHS Business Services Authority Information Security Incident Reporting Procedure NHS Business Services Authority Corporate Secretariat NHSBSAIS002 Issue Sheet Document reference NHSBSAIS002 Document location

More information

COMMERCIALISM INTEGRITY STEWARDSHIP. Security Breach and Weakness Policy & Guidance

COMMERCIALISM INTEGRITY STEWARDSHIP. Security Breach and Weakness Policy & Guidance Security Breach and Weakness Policy & Guidance Document Control Document Details Author Adrian Last Company Name The Crown Estate Division Name Information Services Document Name Security Breach & Weakness

More information

KEELE UNIVERSITY IT INFORMATION SECURITY POLICY

KEELE UNIVERSITY IT INFORMATION SECURITY POLICY Contents 1. Introduction 2. Objectives 3. Scope 4. Policy Statement 5. Legal and Contractual Requirements 6. Responsibilities 7. Policy Awareness and Disciplinary Procedures 8. Maintenance 9. Physical

More information

Originator: Chris Parkin Date: 4 March 2015 Approved by: Senior Management Team Type: Policy. Computer Security Policy

Originator: Chris Parkin Date: 4 March 2015 Approved by: Senior Management Team Type: Policy. Computer Security Policy Originator: Chris Parkin Date: 4 March 2015 Approved by: Senior Management Team Type: Policy Computer Security Policy Contents 1 Scope... 3 2 Governance... 3 3 Physical Security... 3 3.1 Servers... 3 3.2

More information

HIPAA and Health Information Privacy and Security

HIPAA and Health Information Privacy and Security HIPAA and Health Information Privacy and Security Revised 7/2014 What Is HIPAA? H Health I Insurance P Portability & A Accountability A - Act HIPAA Privacy and Security Rules were passed to protect patient

More information

Data Protection Procedure

Data Protection Procedure Data Protection Procedure [QP2.28] Procedure Number: QP2.28 Revision Number: 3 Date of issue: January 2006 Status: Approved Date of approval: May 2006 Responsibility for procedure: Director of Information

More information

Senior School 1 PURPOSE 2 SCOPE 3 SCHOOL RESPONSIBILITIES

Senior School 1 PURPOSE 2 SCOPE 3 SCHOOL RESPONSIBILITIES Senior School 1 PURPOSE The policy defines and describes the acceptable use of ICT (Information and Communications Technology) and mobile phones for school-based employees. Its purpose is to minimise the

More information

Somerset County Council - Data Protection Policy - Final

Somerset County Council - Data Protection Policy - Final Organisation Title Author Owner Protective Marking Somerset County Council Data Protection Policy - Final Peter Grogan Information Governance Manager Unclassified POLICY ON A PAGE Somerset County Council

More information

Information Security Policy

Information Security Policy Information Security Policy Touro College/University ( Touro ) is committed to information security. Information security is defined as protection of data, applications, networks, and computer systems

More information

Data Protection and Information Security. Data Security - Guidelines for the use of Personal Data

Data Protection and Information Security. Data Security - Guidelines for the use of Personal Data Data Protection and Information Data - Guidelines for the use of Personal Data Page 1 of 10 Created on: 21/06/2013 Contents 1. Introduction... 3 2. Definitions... 3 4. Physical... 4 5 Electronic... 6 6

More information

Working Practices for Protecting Electronic Information

Working Practices for Protecting Electronic Information Information Security Framework Working Practices for Protecting Electronic Information 1. Purpose The following pages provide more information about the minimum working practices which seek to ensure that

More information

DATA PROTECTION AND DATA STORAGE POLICY

DATA PROTECTION AND DATA STORAGE POLICY DATA PROTECTION AND DATA STORAGE POLICY 1. Purpose and Scope 1.1 This Data Protection and Data Storage Policy (the Policy ) applies to all personal data collected and dealt with by Centre 404, whether

More information

INFORMATION SECURITY POLICY

INFORMATION SECURITY POLICY INFORMATION SECURITY POLICY Policy approved by: Audit and Governance Committee Date: 4 th December 2014 Next Review Date: December 2016 Version: 1 Information Security Policy Page 1 of 17 Review and Amendment

More information

Angard Acceptable Use Policy

Angard Acceptable Use Policy Angard Acceptable Use Policy Angard Staffing employees who are placed on assignments with Royal Mail will have access to a range of IT systems and mobile devices such as laptops and personal digital assistants

More information

Acceptable Use of ICT Policy. Staff Policy

Acceptable Use of ICT Policy. Staff Policy Acceptable Use of ICT Policy Staff Policy Contents INTRODUCTION 3 1. ACCESS 3 2. E-SAFETY 4 3. COMPUTER SECURITY 4 4. INAPPROPRIATE BEHAVIOUR 5 5. MONITORING 6 6. BEST PRACTICE 6 7. DATA PROTECTION 7 8.

More information

Information Security Incident Management Policy and Procedure. CONTROL SHEET FOR Information Security Incident Management Policy

Information Security Incident Management Policy and Procedure. CONTROL SHEET FOR Information Security Incident Management Policy Bolsover District Council North East Derbyshire District Council & Rykneld Homes Ltd Information Security Incident Management Policy September 2013 Version 1.0 Page 1 of 13 CONTROL SHEET FOR Information

More information

MANAGEMENT OF USER ACCOUNTS AND PASSWORD POLICY AUGUST 2011. Version 2.0

MANAGEMENT OF USER ACCOUNTS AND PASSWORD POLICY AUGUST 2011. Version 2.0 MANAGEMENT OF USER ACCOUNTS AND PASSWORD POLICY AUGUST 2011 Version 2.0 Western Health and Social Care Trust Page 0 of 6 Management of User Accounts Policy Policy Title MANAGEMENT OF USER ACCOUNTS AND

More information

Human Resources Policy documents. Data Protection Policy

Human Resources Policy documents. Data Protection Policy Policy documents Aims of the Policy apetito is committed to meeting its obligations under data protection law. As a business, apetito handles a range of Personal Data relating to its customers, staff and

More information

The Bishop s Stortford High School Internet Use and Data Security Policy

The Bishop s Stortford High School Internet Use and Data Security Policy Internet Acceptance Use and Data Security Policy Last Updated: 08/10/2012 Date of Next Review: 08/10/2015 Approved by GB: 10/10/2012 Responsible Committee: Student Welfare and Development Internet Acceptable

More information

Standard: Information Security Incident Management

Standard: Information Security Incident Management Standard: Information Security Incident Management Page 1 Executive Summary California State University Information Security Policy 8075.00 states security incidents involving loss, damage or misuse of

More information

CCG LAPTOP AND PORTABLE DEVICES AND REMOTE ACCESS POLICY

CCG LAPTOP AND PORTABLE DEVICES AND REMOTE ACCESS POLICY CCG LAPTOP AND PORTABLE DEVICES AND REMOTE ACCESS POLICY (for Cheshire CCGs) Version 3.2 Ratified By Date Ratified November 2014 Author(s) Responsible Committee / Officers Issue Date November 2014 Review

More information

This policy applies to University staff, students and authorised consultants

This policy applies to University staff, students and authorised consultants Document Title: Document Category: IT Systems: Acceptable Use Policy Policy Version Number: 1 Status: Reason for development: Scope: Author / developer: Owner Approved Change in legislation This policy

More information

INFORMATION SECURITY QUESTIONS AND ANSWERS Market Research Industry

INFORMATION SECURITY QUESTIONS AND ANSWERS Market Research Industry INFORMATION SECURITY QUESTIONS AND ANSWERS Market Research Industry OVERVIEW This presentation provides an awareness of information security and its impact on the market research industry based on a risk

More information

Quick Guide To Information Governance Policies

Quick Guide To Information Governance Policies Quick Guide To Information Governance Policies Data Protection The Data Protection Act 1998 established principles and rights in relation to the collection, use and storage of personal information by organisations.

More information

Mobile Devices and Remote Working Policy

Mobile Devices and Remote Working Policy Mobile Devices and Remote Working Policy Document Reference Information Version 1.0 Status Final Author/Lead Risk and IG Manager Date Effective February 2015 Date of Next Formal Review January 2017 Version

More information

HFS DATA SECURITY TRAINING

HFS DATA SECURITY TRAINING HFS DATA SECURITY TRAINING WITH TECHNOLOGY COMES RESPONSIBILITY Illinois Department of Healthcare and Family Services Training Outline: Training Goals What is the HIPAA Security Rule? What is the HFS Identity

More information

Information Security Policy

Information Security Policy Information Security Policy Author: Responsible Lead Executive Director: Endorsing Body: Governance or Assurance Committee Alan Ashforth Alan Lawrie ehealth Strategy Group Implementation Date: September

More information

ROYAL BOROUGH OF WINDSOR AND MAIDENHEAD SECURITY POLICY INFORMATION HANDLING

ROYAL BOROUGH OF WINDSOR AND MAIDENHEAD SECURITY POLICY INFORMATION HANDLING ROYAL BOROUGH OF WINDSOR AND MAIDENHEAD SECURITY POLICY INFORMATION HANDLING Introduction and Policy Aim The Royal Borough of Windsor and Maidenhead (the Council) recognises the need to protect Council

More information

Remote Access and Home Working Policy London Borough of Barnet

Remote Access and Home Working Policy London Borough of Barnet Remote Access and Home Working Policy London Borough of Barnet DATA PROTECTION 11 Document Control POLICY NAME Remote Access and Home Working Policy Document Description This policy applies to home and

More information

ICT SECURITY POLICY. Strategic Aim To continue to develop and ensure effective leadership, governance and management throughout the organisation

ICT SECURITY POLICY. Strategic Aim To continue to develop and ensure effective leadership, governance and management throughout the organisation ICT SECURITY POLICY Strategic Aim To continue to develop and ensure effective leadership, governance and management throughout the organisation Responsibility Assistant Principal, Learner Services Jannette

More information

Information Security Handbook for Employees

Information Security Handbook for Employees Information Security Handbook for Employees Providing our patients with excellence in healthcare includes protecting their information This handbook was prepared by Tom Walsh Consulting, LLC for the Kansas

More information

PAPER RECORDS SECURE HANDLING AND TRANSIT POLICY

PAPER RECORDS SECURE HANDLING AND TRANSIT POLICY PAPER RECORDS SECURE HANDLING AND TRANSIT POLICY CORPORATE POLICY Document Control Title Paper Records Secure Handling and Transit Policy Author Information Governance Manager ** Owner SIRO/CIARG Subject

More information

Data Protection Policy

Data Protection Policy Data Protection Policy Responsible Officer Author Date effective from July 2009 Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance Manager Date last amended December 2012 Review

More information

Conditions of Use of IT Facilities at the LSE

Conditions of Use of IT Facilities at the LSE Conditions of Use of IT Facilities at the LSE By accessing and/or using the IT Facilities, you agree to be bound by these Conditions of Use including all documents referred to in them, and you agree to

More information

ENISA s ten security awareness good practices July 09

ENISA s ten security awareness good practices July 09 July 09 2 About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European

More information

USE OF PERSONAL MOBILE DEVICES POLICY

USE OF PERSONAL MOBILE DEVICES POLICY Policies and Procedures USE OF PERSONAL MOBILE DEVICES POLICY Date Approved by Information Strategy Group Version Issue Date Review Date Executive Lead Information Asset Owner Author 15.04.2014 1.0 01/08/2014

More information

IT ACCESS CONTROL POLICY

IT ACCESS CONTROL POLICY Reference number Approved by Information Management and Technology Board Date approved 30 April 2013 Version 1.0 Last revised Review date March 2014 Category Owner Target audience Information Assurance

More information

HIPAA PRIVACY AND SECURITY TRAINING P I E D M O N T COMMUNITY H EA LT H P L A N

HIPAA PRIVACY AND SECURITY TRAINING P I E D M O N T COMMUNITY H EA LT H P L A N HIPAA PRIVACY AND SECURITY TRAINING P I E D M O N T COMMUNITY H EA LT H P L A N 1 COURSE OVERVIEW This course is broken down into 4 modules: Module 1: HIPAA Omnibus Rule - What you need to know to remain

More information

Mobile Computing Policy

Mobile Computing Policy Mobile Computing Policy Overview and Scope 1. The purpose of this policy is to ensure that effective measures are in place to protect against the risks of using mobile computing and communication facilities..

More information

Non ASPH Trust Staff - DATA ACCESS REQUEST Page 1/3

Non ASPH Trust Staff - DATA ACCESS REQUEST Page 1/3 Paper 9 Non ASPH Trust Staff - DATA ACCESS REQUEST Page 1/3 Please ensure that all THREE pages of this contract are returned to: Information Governance Manager, Health Informatics, Chertsey House, St Peter

More information

School Information Security Policy

School Information Security Policy School Information Security Policy Created By: Newport Education Service Date Created: 22 December 2009 Version: V1.0 Contents Background... 3 IT Infrastructure... 3 IT Access... 3 Acceptable use policy...

More information

Islington ICT Physical Security of Information Policy A council-wide information technology policy. Version 0.7 June 2014

Islington ICT Physical Security of Information Policy A council-wide information technology policy. Version 0.7 June 2014 Islington ICT Physical Security of Information Policy A council-wide information technology policy Version 0.7 June 2014 Copyright Notification Copyright London Borough of Islington 2014 This document

More information

Data Protection Act 1998. Bring your own device (BYOD)

Data Protection Act 1998. Bring your own device (BYOD) Data Protection Act 1998 Bring your own device (BYOD) Contents Introduction... 3 Overview... 3 What the DPA says... 3 What is BYOD?... 4 What are the risks?... 4 What are the benefits?... 5 What to consider?...

More information

Information Systems Security Policy

Information Systems Security Policy Information Systems Security Policy University of South Alabama Computer Services Center University of South Alabama 5840 USA Drive South 251-460- 6161 5/19/2014 Outline 1 Introduction... 2 Data Retrieval

More information

Information Governance

Information Governance Information Governance Information for Patients Information Governance (IG) Contents: Identifying the IG Lead for the Practice. This identifies the main people responsible for Information Governance Policy.

More information

NHS Waltham Forest Clinical Commissioning Group Information Governance Strategy

NHS Waltham Forest Clinical Commissioning Group Information Governance Strategy NHS Waltham Forest Clinical Commissioning Group Governance Strategy Author: Zeb Alam, CCG IG Lead, (NELCSU) David Pearce, Head of Governance, WFCCG Version 3.0 Amendments to Version 2.1 Annual Review Reference

More information

HAZELDENE LOWER SCHOOL

HAZELDENE LOWER SCHOOL HAZELDENE LOWER SCHOOL POLICY AND PROCEDURES FOR MONITORING EQUIPMENT AND APPROPRIATE ICT USE WRITTEN MARCH 2015 SIGNED HEADTEACHER SIGNED CHAIR OF GOVERNORS DATE.. DATE. TO BE REVIEWED SEPTEMBER 2016

More information

Data Protection and Information Security. Procedure for reporting a breach of data security. April 2013

Data Protection and Information Security. Procedure for reporting a breach of data security. April 2013 Data Protection and Information Security Procedure for reporting a breach of data security April 2013 Page 1 of 6 Created on: 01/04/2009 Contents 1 Introduction... 3 2 Data Classification... 3 3 What Is

More information

John Leggott College. Data Protection Policy. Introduction

John Leggott College. Data Protection Policy. Introduction John Leggott College Data Protection Policy Introduction The College needs to keep certain information about its employees, students and other users to allow it to monitor performance, achievements, and

More information

Summary Electronic Information Security Policy

Summary Electronic Information Security Policy University of Chichester Summary Electronic Information Security Policy 2015 Summary Electronic Information Security Policy Date of Issue 24 December 2015 Policy Owner Head of ICT, Strategy and Architecture

More information

The potential legal consequences of a personal data breach

The potential legal consequences of a personal data breach The potential legal consequences of a personal data breach Tue Goldschmieding, Partner 16 April 2015 The potential legal consequences of a personal data breach 15 April 2015 Contents 1. Definitions 2.

More information

LSE PCI-DSS Cardholder Data Environments Information Security Policy

LSE PCI-DSS Cardholder Data Environments Information Security Policy LSE PCI-DSS Cardholder Data Environments Information Security Policy Written By: Jethro Perkins, Information Security Manager Reviewed By: Ali Lindsley, PCI-DSS Project Manager Endorsed By: PCI DSS project

More information

Acceptable Use of Information Systems Policy

Acceptable Use of Information Systems Policy Information Governance & Management Framework Acceptable Use of Information Systems Policy Version 1.3 Produced by: Customer Services & Business Transformation Inverclyde Council Municipal Buildings GREENOCK

More information

STFC Monitoring and Interception policy for Information & Communications Technology Systems and Services

STFC Monitoring and Interception policy for Information & Communications Technology Systems and Services STFC Monitoring and Interception policy for Information & Communications Technology Systems and Services Issue 1.0 (Effective 27 June 2012) This document contains a copy of the STFC policy statements outlining

More information

Data Processing Agreement

Data Processing Agreement Data Processing Agreement BETWEEN GP Name and practice address (Hereinafter known as the Data Controller) AND Coventry & Rugby Clinical Commissioning Group, of Christchurch House, Greyfriars Lane, Coventry,

More information

Ixion Group Policy & Procedure. Remote Working

Ixion Group Policy & Procedure. Remote Working Ixion Group Policy & Procedure Remote Working Policy Statement The Ixion Group (Ixion) provide laptops and other mobile technology to employees who have a business requirement to work away from Ixion premises

More information

CITY OF YORK COUNCIL

CITY OF YORK COUNCIL CITY OF YORK COUNCIL INFORMATION SYSTEMS SECURITY AND ACCEPTABLE USE POLICY PAGE 1 OF 10 Table of Contents 1. PURPOSE... 3 2. SCOPE... 3 3. PRINCIPLES... 4 4. ROLES AND RESPONSIBILITIES... 4 5. ALL USERS

More information

Central Bedfordshire Council. IT Acceptable Use Policy. Version 1.7 January 2016 Not Protected. Not Protected Page 1 of 11

Central Bedfordshire Council. IT Acceptable Use Policy. Version 1.7 January 2016 Not Protected. Not Protected Page 1 of 11 Central Bedfordshire Council IT Acceptable Use Policy Version 1.7 January 2016 Not Protected Not Protected Page 1 of 11 Policy Approval Central Bedfordshire Council acknowledges that information is a valuable

More information

ABERDARE COMMUNITY SCHOOL

ABERDARE COMMUNITY SCHOOL ABERDARE COMMUNITY SCHOOL IT Security Policy Drafted June 2014 Revised on....... Mrs. S. Davies (Headteacher) Mr. A. Maddox (Chair of Interim Governing Body) IT SECURITY POLICY Review This policy has been

More information

HIPAA Security Training Manual

HIPAA Security Training Manual HIPAA Security Training Manual The final HIPAA Security Rule for Montrose Memorial Hospital went into effect in February 2005. The Security Rule includes 3 categories of compliance; Administrative Safeguards,

More information

INFORMATION SECURITY POLICY

INFORMATION SECURITY POLICY Information Security Policy INFORMATION SECURITY POLICY Introduction Norwood UK recognises that information and information systems are valuable assets which play a major role in supporting the companies

More information

Information Security Policy for Associates and Contractors

Information Security Policy for Associates and Contractors Policy for Associates and Contractors Version: 1.12 Status: Issued Date: 30 July 2015 Reference: 61418080 Location: Livelink Review cycle: Annual Contents Introduction... 3 Purpose... 3 Scope... 3 Responsibilities...

More information

PSN Acceptable Usage Policy and Personal Commitment Statement

PSN Acceptable Usage Policy and Personal Commitment Statement PSN Acceptable Usage Policy and Personal Commitment Statement December 2013 Document Version 5.0 Document Status Owner Name Owner Job Title Published Martyn Ward Head of ICT Business Delivery Document

More information

IT Security Policy - Information Security Management System (ISMS)

IT Security Policy - Information Security Management System (ISMS) IT Security Policy - Information Security Management System (ISMS) Responsible Officer Contact Officer Vice-President, Finance & Operations Chief Digital Officer Superseded Documents IT Security Policy,

More information

Not Protectively Marked

Not Protectively Marked TITLE CCMT Sponsor Department/Area Section/Sector INFORMATION SECURITY POLICY Deputy Chief Constable Professional Standards Department Force Security 1.0 Rationale 1.1 This policy sets out the approach

More information

MONMOUTHSHIRE COUNTY COUNCIL DATA PROTECTION POLICY

MONMOUTHSHIRE COUNTY COUNCIL DATA PROTECTION POLICY MONMOUTHSHIRE COUNTY COUNCIL DATA PROTECTION POLICY Page 1 of 16 Contents Policy Information 3 Introduction 4 Responsibilities 7 Confidentiality 9 Data recording and storage 11 Subject Access 12 Transparency

More information

HUMAN RESOURCES POLICIES & PROCEDURES

HUMAN RESOURCES POLICIES & PROCEDURES HUMAN RESOURCES POLICIES & PROCEDURES Policy title Application IT systems and social networking policy All employees and students CONTENTS PAGE Introduction and scope 2 General points 2 Authorisation to

More information

Procedures on Data Security Breach Management Version Control Date Version Reason Owner Author 16/09/2009 Draft 1 Outline Draft Jackie Groom

Procedures on Data Security Breach Management Version Control Date Version Reason Owner Author 16/09/2009 Draft 1 Outline Draft Jackie Groom Procedures on Data Security Breach Management Version Control Date Version Reason Owner Author 16/09/2009 Draft 1 Outline Draft Jackie Groom Indirani 02/11/2009 Draft 2 Include JG s comments Jackie Groom

More information

Data Protection Policy

Data Protection Policy Data Protection Policy Date approved by Heads of Service 3 June 2014 Staff member responsible Director of Finance and Corporate Services Due for review June 2016 Data Protection Policy Content Page 1 Purpose

More information

APPENDIX 1: SUPPLIER INSTRUCTIONS FOR THE PROCESSING OF PERSONAL DATA

APPENDIX 1: SUPPLIER INSTRUCTIONS FOR THE PROCESSING OF PERSONAL DATA APPENDIX 1: SUPPLIER INSTRUCTIONS FOR THE PROCESSING OF PERSONAL DATA Purpose SOS International has legal and contractual obligations on the matters of data protection and IT security. As a part of these

More information

Corporate Information Security Policy

Corporate Information Security Policy Corporate Information Security Policy. A guide to the Council s approach to safeguarding information resources. September 2015 Contents Page 1. Introduction 1 2. Information Security Framework 2 3. Objectives

More information

DATA PROTECTION POLICY

DATA PROTECTION POLICY Title Author Approved By and Date Review Date Mike Pilling Latest Update- Corporation May 2008 1 Aug 2013 DATA PROTECTION ACT 1998 POLICY FOR ALL STAFF AND STUDENTS 1.0 Introduction 1.1 The Data Protection

More information

Information Security Policy. Appendix B. Secure Transfer of Information

Information Security Policy. Appendix B. Secure Transfer of Information Information Security Policy Appendix B Secure Transfer of Information Author: Data Protection and Information Security Officer. Version: 0.7 Date: March 2008 Document Control Information Document ID Document

More information

SECURITY INCIDENT REPORTING AND MANAGEMENT. Standard Operating Procedures

SECURITY INCIDENT REPORTING AND MANAGEMENT. Standard Operating Procedures SECURITY INCIDENT REPORTING AND MANAGEMENT Standard Operating Procedures Notice: This document has been made available through the Police Service of Scotland Freedom of Information Publication Scheme.

More information

University of Liverpool

University of Liverpool University of Liverpool Information Security Policy Reference Number Title CSD-003 Information Security Policy Version Number 3.0 Document Status Document Classification Active Open Effective Date 01 October

More information

Information Systems Security Policy

Information Systems Security Policy Information Systems Security Policy University of South Alabama Computer Services Center University of South Alabama 5840 USA Drive South 251-460- 6161 12/12/2016 Outline 1 Outline... 1 Introduction...

More information

BCS IT User Syllabus IT Security for Users Level 2. Version 1.0

BCS IT User Syllabus IT Security for Users Level 2. Version 1.0 BCS IT User Syllabus IT for Users Level 2 Version 1.0 June 2009 ITS2.1 System Performance ITS2.1.1 Unwanted messages ITS2.1.2 Malicious ITS2.1.1.1 ITS2.1.1.2 ITS2.1.2.1 ITS2.1.2.2 ITS2.1.2.3 ITS2.1.2.4

More information

Harper Adams University College. Information Security Policy

Harper Adams University College. Information Security Policy Harper Adams University College Information Security Policy Introduction The University College recognises that information and information systems are valuable assets which play a major role in supporting

More information