Lauren Hamill, Information Governance Officer. Version Release Author/Reviewer Date Changes (Please identify page no.) 1.0 L.

Transcription

1 Document No: IG10d Version: 1.1 Name of Procedure: Third Party Due Diligence Assessment Author: Release Date: Review Date: Lauren Hamill, Information Governance Officer Version Control Version Release Author/Reviewer Date Changes (Please identify page no.) 1.0 L. Hamill L. Hamill Full content review. Change of format and name. This document supersedes all previous issues.

2 Contents Section Page 1. Introduction Purpose Scope Using the Assessment Questionnaire... 3 Appendix 1 Third Party Due Diligence Questionnaire. 4

3 1. Introduction Information is an important asset for the Trust in order to provide high quality services to patients and service users. In addition to this the requirement to ensure the confidentiality and security of both staff and patient information under the Data Protection Act 1998 necessitates that the Trust secures personal data to a high level. The Trust is committed to ensuring the security and confidentiality of all personal and confidential information that it holds. So that the Trust is able to do this and to comply with the necessary legal and regulatory requirements it is essential that we are assured that third party contractors have the necessary processes in place to secure this data. 2. Purpose The purpose of this procedure and accompanying assessment is to ensure that the Trust consistently meets its Information Governance requirements in relation to third party contracts (both clinical and non-clinical). 3. Scope The assessment at Appendix 1 should be used when engaging a new Third Party to provide services to the Trust which will involve the transfer of Trust data to the Third Party s premises. 4. Using the Assessment Questionnaire The assessment questionnaire should be provided to the Third Party for completion by Supplies, Projects or the relevant IAO/IAA who should ensure that it is completed and approved prior to the transfer of any Trust data. The completed assessment questionnaire will be reviewed and approved by the Information Governance Team and the Information Security Manager. A copy of the signed form will then be returned to the Supplies contact, Projects contact or relevant IAO/IAA as appropriate to confirm approval. The Information Governance Team and/or Information Security Manager may include comments or recommendations and may approve the assessment on the basis that any recommendations are in place prior to the transfer of Trust data. It is the responsibility of the Supplies contact, Projects contact and/or relevant IAO/IAA as appropriate to ensure that any such recommendations are met by the Third Party. The Third Party access/agreement should also be logged on the relevant IAO s Information Risk Management Tool.

4 Appendix 1 Third Party Due Diligence Assessment Organisation Name: Organisation Address: Service Provided: Organisation Contact: Information Asset Owner: (All systems/assets must have an Information Asset Owner (IAO). IAO s are normally the Assistant Divisional Managers and report to the SIRO) Name: Name: Title: Title: Department Project Manager / Department: / Location: Supplies Contact: Telephone: Telephone: Name: Information Asset Name: Title: Administrator: Title: (All systems / assets must have an Information Asset Administrator (IAA) who reports the IAO as stated above. IAA s are normally System Managers / Project Leads) Department: Department: Telephone: Telephone:

5 1. INFORMATION PROCESSED ON BEHALF OF THE TRUST Section Question Description/Comments 1.1. GENERAL Please describe the data processed by the organisation on behalf of the Trust Does the data consist of sensitive data as per the Data Protection Act? Yes No 1.2. TRANSFER OF DATA TO ORGANISATION How is Trust data transferred to the organisation? Electronic Hardcopy Both Please provide details of how Trust data is transferred e.g. , fax, courier, removable media etc. Please provide details of the security measures in place in relation to the transfer e.g. encrypted /removable media, safe haven fax, recorded courier and contracted service etc STORAGE OF TRUST DATA How is Trust data stored? Electronic Hardcopy Both If stored electronically, please name the systems on which the data is stored. Please provide details of the security measures in place in relation to the storage of Trust data e.g. locked filing cabinet, network and system security controls etc OUTSOURCING AND OVERSEAS TRANSFERS Is any activity involving Trust data or information assets outsourced to another third party? If so, please provide details including the relationship type (e.g. Data Controller Data Processor). Are any Trust data or information assets transferred outside of the EEA? If so, what, where and to whom? Are any Trust data or information assets transferred outside of the UK? If so, what, where and to whom? Yes No Yes No Yes No

6 2. INFORMATION SECURITY GOVERNANCE Section Question Yes/No/NA Description/Comments 2.1. GENERAL GOVERNANCE Does the organisation have a dedicated Information Security Policy? If so, how are all staff made aware of the Information Security Policy? Does the organisation have a dedicated Information Security Officer, department, or similar? Does the organisation hold any certificates or awards gained for quality, security or business continuity? E.g. BS 9000/9001, BS 7799/ISO 27001, BS If so, please provide the scope statement for any certificates If a non-nhs organisation, is the organisation registered with the Care Quality Commission (CQC)? If an NHS organisation or registered with CQC, please provide details of IG Toolkit compliance level where relevant DPA AND TRAINING & AWARENESS Is the organisation registered with the ICO under the Data Protection Act? If so, what is the notification number? Do all relevant staff undertake Data Protection and Confidentiality awareness training during induction and at least on annual basis? If so, please describe Do all relevant staff undertake Information Security awareness training during induction and at least on annual basis? If so, please describe Are staff in the organisation made aware of the Computer Misuse Act? Does the organisation maintain a register of breaches/incidents (including data protection) and if so, how frequently is the analysed? Is a response process in place to deal with breaches/incidents? (please describe) Has the organisation been subject to any action by the Information Commissioner s Office (including complaints)? If so, please provide details AUDIT Is there an internal audit function within the organisation?

7 Section Question Yes/No/NA Description/Comments Does the organisation engage external auditors? Are information security audits performed to measure compliance with policy? If so, please specify whether these are internal or external audits. 3. PHYSICAL & ENVIRONMENTAL SECURITY Section Question Yes/No/NA Description/Comments 3.1. GENERAL Is the building wholly owned / occupied by the organisation? 3.2. ACCESS TO PREMISES SECURITY Is there a formal reception area? Are there any other access controls in place? If so, what? Is the building manned 24 hours a day, 365 days a year? Are the premises protected by security guards? Do the security guards man the reception area? Do the security guards monitor alarms and CCTV? Do the security guards perform night time patrols? Do the security guard patrols include the interior of the premises as well as the exterior? 3.3. VISITORS Are all visitors required to sign in and out and issued with a visitor s pass during their visit? Are all visitors accompanied when in sensitive areas? 3.4. ACCESS CARDS & PIN CODES Are access cards issued to all staff? Is access restricted according to job role or function?

8 Section Question Yes/No/NA Description/Comments Do cards trigger a log entry when used? Are any doors protected by PIN codes (without access cards)? 3.5. CLEAR DESK AND SECURE STORAGE Does the organisation have a Clear Desk and Screen Policy? If so, are regular checks in place to ensure compliance? Are all documents containing Trust, personal or other confidential information locked away when unattended? If the organisation is processing large volumes of documents containing Trust, personal or other confidential information, are additional measures in place in the areas where this activity takes place? (please describe) 3.6. CCTV Is the building monitored continuously by CCTV both internally and externally? Are access points to computer/server rooms monitored by CCTV? Is CCTV footage backed up? 3.7. INTRUDER ALARMS Do the premises have an intruder alarm system? Is the alarm system regularly tested and maintained? Is the alarm system linked to an Alarm Receiving Centre (ARC) or automatically inform the Police? Are all ground access points alarmed (e.g. doors, windows, etc)? 3.8. FIRE ALARMS Do the premises have fire detection and alarm system? Is the fire detection and alarm system regularly tested and maintained? Is the fire detection and alarm system linked to emergency services, security organisation or similar? Have fire meeting points and fire marshals been established for the premises?

9 Section Question Yes/No/NA Description/Comments 3.9. COMPUTER / SERVER ROOM ACCESS & ENVIRONMENTAL CONTROLS Is access to computer / server rooms restricted to named authorised personnel and is all access logged? Are computer / server room access privileges reviewed / checked periodically? Are access points to computer / server rooms adequately secured? (please describe) Are all servers and other IT equipment housed in cabinets? If the computer / server room is shared, are all cabinets locked? Is computer / server room equipment protected by UPS devices? Are UPS devices subject to regular testing and maintenance? Have generators been installed? Are generators subject to regular testing and maintenance? Does the room have dedicated temperature control and air cooling? Does the room have a fire detection and suppression system installed? If gas suppression is installed, has the integrity of the room been tested? 4. HUMAN RESOURCES SECURITY Section Question Yes/No/NA Description/Comments 4.1. RECRUITMENT & VETTING Does the organisation follow a formal recruitment and vetting procedure for all applicants? Does the process include CRB checks for staff processing personal / sensitive information? Are previous employment references obtained for all staff? Are employee qualifications independently verified? Are all such checks completed prior to commencement of employment?

10 Section Question Yes/No/NA Description/Comments Is evidence obtained to justify any gaps in employment history of more than 3 months? Have all staff signed contracts which cover confidentiality? Are the same checks conducted for temporary staff, bank/agency staff and employees of third parties working on behalf of the organisation? Is there a process in place to carry out periodic follow-up checks on individuals working in high risk areas / processing personal or sensitive information? Does the organisation have procedures in place for revoking access (both physical and electronic) following termination or changes to employment? 4.2. DISCIPLINARY PROCESSES Do you have a formal documented disciplinary policy and procedure? 4.3. CLEANERS Are cleaners directly employed by the organisation? Is cleaning carried out during business hours? Are cleaners prevented from accessing secure areas unless accompanied? 5. LOGICAL ACCESS CONTROLS Section Question Yes/No/NA Description/Comments 5.1. DESKTOP FACILITIES Is there a desktop timeout (password protected screensaver) policy? Are users required to lock their workstations before leaving them unattended and is this monitored? 5.2. USER IDs AND PASSWORDS Is there a dedicated team/person responsible for user access management? Are access controls in place to restrict access to certain information e.g. access levels for particular levels, RBAC (role based access controls)? Are unique system credentials i.e. user IDs and passwords used to gain access to the network and other systems?

11 Section Question Yes/No/NA Description/Comments If so, can access be traced back to an individual and are such logs checked? Are parameters in place to enforce strong passwords (i.e. password length and regular changing of passwords)? Are passwords issued / disclosed securely to ensure adequate privacy? How often are access reviews carried out? 5.3. INTERNET & ACCESS Is there an Internet and Acceptable Usage Policy in place? Is the internet restricted or monitored? Are staff prevented from downloading non-work related content from the internet (e.g. games, screensavers and personal s)? 5.4. REMOTE ACCESS Is remote access restricted? Is remote access encrypted? 5.5. FIREWALLS & ANTIVIRUS Are firewalls in place? Are firewalls monitored? Are appropriate antivirus software measures in place? Are they routinely monitored and updated? Has penetration testing been carried out within the last 12 months? If so, was this conducted internally or by a third party? Have any weaknesses identified by penetration testing been addressed? 6. DATA AND INFORMATION SECURITY Section Question Yes/No/NA Description/Comments 6.1. INCIDENT MANAGEMENT Is there an incident management procedure for reporting, logging and investigating incidents? Is there an established procedure to inform customers (including the Trust) of any incidents?

12 6.2. STORED DATA Is/would Trust data be segregated from that of the organisation and other clients? Has/would access to Trust data be restricted to only authorised individuals with a specific need to access the data? Is/would administration access to any data environment be restricted or controlled? 7. BUSINESS CONTINUITY & DISASTER RECOVERY Section Question Yes/No/NA Description/Comments 7.1. BACKUPS How often are backups performed? What is the retention period for backups? Are backup tapes stored in a separate fire zone or off-site to production data? Is backup data protected to the same level as production data? Are backups encrypted? 7.2. BUSINESS CONTINUITY & DISASTER RECOVERY CAPABILITY Are there formal Business Continuity and Disaster Recovery Plans in place? Have the plans been tested successfully within the last 12 months? 7.3. WEBSITE SECURITY (This section only applies if a website or web service is used in connection with the service provided to the Trust) Is a DMZ used to secure the service? Has intrusion detection software been installed? Has application firewall technology been installed? Is the website/service monitored for availability? Are documented change-control procedures in place? Does the site use SSL certificates? Has penetration testing been carried out within the last 12 months and since any material change? Have all weaknesses identified by penetration testing been addressed?

13 Form completed by: Name: Title: Signature: Date: Information Governance Office Approval: Comments/Recommendations: Name: Title: Signature: Date: Information Security Manager Approval: Comments/Recommendations: Name: Title: Signature: Date: