Web Filtering Directive

Transcription

1 Office of the Prime Minister Central Information Management Unit Directive document CIMU D 0014:2003 Web Filtering Directive Version: 2.0 Effective date: 01 Oct 2003

2 Table of Contents 1. Purpose Who should know this Directive Scope of applicability Definitions Roles and Responsibilities Directive Supporting Documents References Modification history Maintenance and review cycle...7 Page 2

3 1. Purpose The objective of this Directive is to set up methods for controlled access to Internet Web sites based on Government needs. The Directive shall address legal risk to Government and the productivity of its employees. 2. Who should know this Directive Knowledge of this Directive should extend up and down the organisations concerned and be wide spread within them. CIMU Head DCSs / IMOs CIMU Communications Officer Heads of Government Departments Head of Agent Internet Account Holders Employees of the Agent operating Internet services 3. Scope of applicability The scope of applicability of this Directive is to introduce controlled access to Internet Web sites within Government. 4. Definitions Agent has the mandate by Government to provide Internet services to Government. Baseline a specification of Internet Web sites that are not related to Government needs initially issued by CIMU and updated by Heads of Government Departments. Compliance refers to the process performed by CIMU or an independent body to confirm that an Agent satisfies the criteria set in a reference document. Conformance refers to the correspondence by a service or product to the criteria set in a reference document. Declaration of Conformance refers to an attestation by the Agent that declares, under the Agent s sole responsibility, conformance to named Policies, Standards and Directives. This Declaration needs to be re-issued depending upon changes. Employee employees of Government irrespective of grade. Internet Account Holder - a person authorised to use Internet services using computers owned by Government or used for Government work and for which Government is responsible. Page 3

4 Service Level Agreement is a contractual agreement between the CIMU and an Agent, which stipulates and commits the Agent to a required level of service. An SLA should contain a numerically quantified level of service support options, enforcement or penalty provisions for services not provided, and a guaranteed level of system performance relating to downtime or uptime. Internet Web site - A site (location) on the Internet World Wide Web. The site may contain text, graphics, animations and videos as well as hypertext links. The links let users jump from page to page (hypertext) whether the pages are stored on the same server or on servers around the world. 5. Roles and Responsibilities For the purpose of this Directive, the following roles and responsibilities have been identified. Role Responsibility 01. CIMU i. to issue initial Baseline profile and maintain it to mandate Internet Web filtering by Agents i to verify the Declaration of Conformance issued by the Agent iv. to establish electronic request for changing the Baseline v. to maintain this Directive 02. CIMU Communications Officer 03. DCS / IMO / Head of Government Department i. to publish this Directive i. to implement this Directive within the Government Department to promote this Directive among Internet Account Holders i to direct requests to Agents to update the Baseline profile and copy CIMU 04. Internet Account Holders i. to direct requests to Ministries / Government Departments for the opening of specific Internet Web sites to direct requests to Ministries / Government Departments for the closure of specific Internet Web sites Page 4

5 05. Head of Agent i. to issue a Declaration of Conformance, and reissue after changes i to assist in compliance testing to instigate documented internal procedures to fully implement this Directive iv. to operate Internet services according to this Directive v. to implement electronic requests by Ministries / Government Departments related to Internet Web filtering vi. to operate and monitor the Internet Web filtering operation under its responsibility v to close corrective and preventive actions after audits 6. Directive The Central Information Management Unit shall: 01. maintain the Web filtering Policy and the Web filtering Directive. The Policy and the Directive mandate Internet Web filtering on Internet services to Government. Internet services shall be provided to the Government by an Agent. The CIMU manages the operational relationship with Agents. 02. specify the Baseline of what Internet Web content cannot be accessed across Government. The CIMU shall specify a Baseline profile, (see Definition), and publish it regularly on the CIMU Internet Web site, at. Agents. IMOs, and Heads of Government Department work from this Baseline profile. Being on the Internet Web site, the Baseline profile is also available to Internet Account Holders. The frequency of issue of this Baseline shall be published on the Web by the CIMU. 03. verify for compliance; CIMU shall maintain records. 04. sign Service Level Agreements with Agents covering Web filtering services. IMOs, Heads of Government Departments or their designated delegates shall: 01. follow the principle that what Internet Web content is allowed and what content is filtered to specific Ministries / Departments and to individual Account Holders shall depend on their roles within Government. 02. implement the Web filtering Policy within the Ministry / Department and shall promote the Policy and Directive among Account Holders across the Ministry / Department at all levels. Page 5

6 03. direct requests to Agents to update the Baseline profile and copy CIMU. IMOs / Heads of Government Department are empowered to direct requests to Agents to open or close specific Internet Web sites. IMOs / Heads of Government Department are also empowered to request Agents to open Internet Web sites specific to Ministries / Departments or individual Account Holders. Internet Account Holders shall: 01. be entitled to make requests to their respective IMOs / Heads of Government Department to be allowed access to Internet Web sites they think they need to have access to. This facility balances the invasive aspects of Internet Web filtering with requests to open specific Internet Web sites at the request of Account Holders. Heads of Agents or their designated delegates shall: 01. open or close specific Internet Web sites following requests by Ministries or Government Departments. 02. issue a Declaration of Conformance to CIMU attesting that the Internet Web filtering performed satisfies the requirements of the Policy and the Baseline profile; this Declaration needs to be re-issued depending upon changes. 03. discharge their responsibility by instigating documented internal procedures to fully implement the Web filtering Policy. Agents shall operate Internet services according to the Policy, select and operate an appropriate Web filtering tool, and monitor the Web filtering operation under its responsibility. Agents shall liaise with the CIMU and Heads of Government Department. 04. implement this Directive in the context of the Access Control Policy provisions of the standard MSA ISO/IEC 17799:2001, that nonetheless shall inspire other security aspects of the operation of the Agent. 05. at all times be in a position: i. to fully specify all the Web filtering it is doing to be able to replicate the Web filtering system if requested to 06. undertake internal audits on its operations, for conformance purposes. The Agent shall carry out timely and effective follow-up action to satisfactorily close items arising in the internal audits. The Agent shall maintain results of audits and of corrective and preventive actions. 07. carry out timely and effective follow-up action to satisfactorily close items arising during the verification for compliance. The Agent shall maintain results of audits and of corrective and preventive actions. 08. report on accessing activity; on the Baseline Profile and on management and technical statistics periodically, and upon ad hoc requests from the CIMU. Page 6

7 7. Supporting Documents The Web filtering Policy (CIMU P 0014:2003), instigated the need for the current Directive. 8. References 01. Data Protection Act Chapter Electronic Commerce Act Chapter Code of Practice for Internet Service Providers MSA ISO/IEC 17799: Modification history Version Date Changes Initial Release Scheduled review with no changes 10. Maintenance and review cycle The maintenance and review cycle of this Directive is set for six months after the initial release as indicated in the effective date. Subsequent review to this Directive will be based on a twelve month cycle. Signature and stamp Joseph R. Grima Permanent Secretary, Office of the Prime Minister Page 7