CITY UNIVERSITY OF HONG KONG
|
|
|
- Gervase Goodman
- 8 years ago
- Views:
Transcription
1 CITY UNIVERSITY OF HONG KONG (Approved by the Information Strategy and Governance Committee in December 2013; revision 1.1 approved by Chief Information Officer in September 2015) INTERNAL Date of Issue:
2 Document Control Document Owner Classification Publication Date OCIO PUBLIC Revision History Version Date Summary of Changes Initial Release Replaced IT Security Officer with Information Security Unit Allowed disclosure of information only if as required and permitted by the contract terms of the University Modified to allow asset/process owners to report noncompliance to University s management as well as ISU Distribution Copy Issued to Location Master Public
3 Contents 1 Policy Statement Roles and Responsibility Information Security Unit (ISU) Asset or Process Owners Legal Counsel All staff of the University Compliance Management for Legislation Applicable Legislations and Regulations New Legislation Update to Existing Legislation Monitoring Compliance Management for Contractual Requirement Establishment of Contractual Requirement for the University Contractual Requirement Required by Third Party Vendors Monitoring... 3
4 Page 1 of 3 1 Policy Statement The City University of Hong Kong ( University ) shall ensure full compliance with all legal, statutory, regulatory and contractual requirements that are applicable to the operations of the University. 2 Roles and Responsibility 2.1 Information Security Unit (ISU) Check for updates or additions to the relevant legal, statutory, regulatory or contractual requirements that the University needs to comply Coordinate with the asset or process owners of relevant University Units in the identification and implementation of compliance process within the University Develop, maintain and monitor implementation of Follow up on noncompliance and escalate to senior management of the University 2.2 Asset or Process Owners Inform the ISU of any updates or additions to relevant law, statutory, regulatory or contractual requirements that his or her responsible Unit needs to comply Update the inventory of contracts relevant to his or her responsible asset or process Communicate the responsibilities for compliance with relevant law, statutory, regulatory or contractual requirements to the staff, students or contractors under his or her responsible Unit Report any noncompliance to the University s management and/or ISU 2.3 Legal Counsel Provide professional advice regarding the compliance issues encountered by the University Assist the impact assessment of noncompliance or deviations noted around the compliance status of the University 2.4 All staff of the University Comply with all applicable legal, statutory, regulatory and contractual requirements 3 Compliance Management for Legislation 3.1 Applicable Legislations and Regulations The following is a list of legislations related to the protection of information security in the University: Legislation & Regulations Telecommunications Ordinance (Cap. 106) Unsolicited Electronic Messages Ordinance (Cap. 593) Personal Data (Privacy) Ordinance (Cap. 486) Copyright Ordinance (Cap. 528) Employment Ordinance (Cap. 57) Regulatory Bodies Communications Authority (CA) Communications Authority (CA) Privacy Commissioner for Personal Data (PCPD) Intellectual Property Department (IPD) Labour Department (LD)
5 Page 2 of 3 Crimes Ordinance (Cap. 200) Theft Ordinance (Cap. 210) Electronic Transactions Ordinance (Cap. 553) Department of Justice Department of Justice Office of the Government Chief Information Officer (OGCIO) Overseas units and offshore units of the University must also comply with all applicable laws and regulations from all applicable jurisdictions. 3.2 New Legislation Whenever there is a new legislation related to information security, the ISU shall perform an assessment of their applicability to the University. The ISU should seek clarification from the regulatory body as necessary. For the relevant legislations, the ISU shall initiate the implementation of the new standards. All members of the University shall be informed of the new legislation and the actions taken by the University to achieve compliance. The Management of the University shall be informed of any new legislations and reviews the corresponding actions taken by the University. 3.3 Update to Existing Legislation The ISU shall check for updates to the above legislation on a monthly basis. The ISU should regularly visit the web pages of relevant regulatory organizations, subscribe to relevant web sites or consult the Legal Counsel and relevant administrative units of the University. Upon identification of any changes to the above legislation, the ISU shall perform an assessment of their applicability to the University. The ISU should seek clarification from the regulatory body as necessary. For applicable changes, the ISU shall drive the implementation of the revised policies, standards, procedures and guidelines by coordination with respective University Units or third parties. The Management of the University shall be informed of any updates to the existing legislations and reviews the corresponding actions taken by the University. 3.4 Monitoring The Asset/Process Owners shall monitor the information security compliance status of the legislations applicable to their responsible area. The ISU shall provide guidance to relevant queries raised by the Asset/Process Owners and consult the Legal Counsel of the University when necessary. Any noncompliance noticed shall be reported to the University s management and/or ISU who will then escalate to the University s senior management and handle according to the Information Security Incident Management Standard.
6 Page 3 of 3 4 Compliance Management for Contractual Requirement 4.1 Establishment of Contractual Requirement for the University When sensitive information is provided to third party vendors, the written contractual requirement shall include the following terms at minimum: Require all contractors, consultants, or external vendors to observe laws and the University s policies for privacy, copyright and security; Prevent disclosure of sensitive information to other third parties including subcontractors, except as required and permitted by the contractual terms of the University; Require a plan for the handling, return and destruction of sensitive information upon completion of the contractual requirements in accordance with the University s Information Classification and Handling Standard ; Require access or authorization permissions for the fulfillment of contractual requirements to be specified. These permissions should be terminated once the contractual obligations have been completed; and Require compensation plan for any noncompliance noted. 4.2 Contractual Requirement Required by Third Party Vendors When the third party vendors sensitive information is provided to the University, the Asset/Process Owner shall initiate the review of relevant contractual requirements in relation to the protection of such information. The Asset/Process Owner and the ISU shall determine whether the University s information security policies, standards and procedures (e.g. Information Classification and Handling Standard ) are sufficient to fulfill such contractual requirements, or whether any additional actions should be taken. 4.3 Monitoring The Asset/Process Owners shall monitor the information security compliance status of the contractual requirements applicable to their responsible area. The ISU shall provide guidance to relevant queries raised by the Asset/Process Owners and consult the Legal Counsel of the University when necessary. Any noncompliance noticed shall be reported to the University s management and/or ISU, who will then escalate to the University s senior management, and handle according to the requirements established in Information Security Incident Management Standard.
CITY UNIVERSITY OF HONG KONG
CITY UNIVERSITY OF HONG KONG (Approved by the Information Strategy and Governance Committee in December 2013) PUBLIC Date of Issue: 2013-12-24 Document Control Document Owner Classification Publication
Guideline for Roles & Responsibilities in Information Asset Management
ISO 27001 Implementer s Forum Guideline for Roles & Responsibilities in Information Asset Management Document ID ISMS/GL/ 003 Classification Internal Use Only Version Number Initial Owner Issue Date 07-08-2009
Guidance Note on Recognition of Certification Authorities and Certificates under the Electronic Transactions Ordinance (Cap. 553)
Guidance Note on Recognition of Certification Authorities and Certificates under the Electronic Transactions Ordinance (Cap. 553) Published in February 2012 (Version 4.0) Office of the Government Chief
http://www.pcpd.org.hk/english/publications/files/gn_insurance_e.pdf
Briefing Data privacy regulation: Spotlight on Hong Kong insurers Summary Two recent regulatory initiatives will place the Hong Kong insurance industry s use and handling of personal data under greater
The CIPM certification is comprised of two domains: Privacy Program Governance (I) and Privacy Program Operational Life Cycle (II).
Page 1 of 7 The CIPM certification is comprised of two domains: Privacy Program Governance (I) and Privacy Program Operational Life Cycle (II). Domain I provides a solid foundation for the governance of
Information Integrity & Data Management
Group Standard Information Integrity & Data Management Serco recognises its responsibility to ensure that any information and data produced meets customer, legislative and regulatory requirements and is
Hong Leong Asia Ltd.
Hong Leong Asia Ltd. Personal Data Protection Policy The protection of your Personal Data is important to us. This Personal Data Protection Policy ( PDP Policy ) outlines how we manage your personal data,
INFORMATION TECHNOLOGY SECURITY STANDARDS
INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL
University of Sunderland Business Assurance Information Security Policy
University of Sunderland Business Assurance Information Security Policy Document Classification: Public Policy Reference Central Register Policy Reference Faculty / Service IG 003 Policy Owner Assistant
GUIDANCE NOTE ON OUTSOURCING
GN 14 GUIDANCE NOTE ON OUTSOURCING Office of the Commissioner of Insurance Contents Page I. Introduction.. 1 II. Application...... 1 III. Interpretation.... 2 IV. Legal and Regulatory Obligations... 3
Align Technology. Data Protection Binding Corporate Rules Processor Policy. 2014 Align Technology, Inc. All rights reserved.
Align Technology Data Protection Binding Corporate Rules Processor Policy Confidential Contents INTRODUCTION TO THIS POLICY 3 PART I: BACKGROUND AND ACTIONS 4 PART II: PROCESSOR OBLIGATIONS 6 PART III:
Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance 1
Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance 1 It is common for members of the public to receive unsolicited telephone calls,
University of Sunderland Business Assurance Over-arching Information Governance Policy
University of Sunderland Business Assurance Over-arching Information Governance Policy Document Classification: Public Policy Reference Central Register IG001 Policy Reference Faculty / Service IG 001
Manage Compliance with External Requirements
Manage Compliance with External Requirements Description IT is subject to requirements that are highly complex and constantly changing. The school jurisdiction s senior leadership is ultimately accountable
Information Governance Policy
Information Governance Policy Version: Revised: Consultation: Ratified by: 1.0 Information Governance Committee Governance Committee Date ratified: 19 March 2008 Name of originator/author: David McGrath
Personal Data & Privacy Policy Statement
Personal Data & Privacy Policy Statement Your Privacy Hong Kong Broadband Network Limited ("we" or the "Company") respect the privacy rights of visitors to all our company websites (the Websites ) and
University of Sunderland Business Assurance. Over-arching Information Governance Policy. Document Classification: Public
University of Sunderland Business Assurance Over-arching Information Governance Policy Document Classification: Public Policy Reference Central Register IG001 Policy Reference Faculty / Service IG 001
CITY UNIVERSITY OF HONG KONG
PUBLIC Version: 1.1 CITY UNIVERSITY OF HONG KONG (Approved by the Information Strategy and Governance Committee in December 2013; revision 1.1 approved by Chief Information Officer in September 2015) PUBLIC
Consultation Document on Review of the Personal Data (Privacy) Ordinance
Consultation Document on Review of the Personal Data (Privacy) Ordinance August 2009 Contents Page Foreword Executive Summary i iii Chapter One : Introduction 1 Chapter Two : An Overview of the Personal
QUOTATION REQUEST WESTERN AUSTRALIA. How long has the business been in the WA? New 1 4 Yrs 5 8 Yrs 8 Yrs Plus
QUOTATION REQUEST WESTERN AUSTRALIA CUSTOMER DETAILS Contact Name: Business Phone: E-mail Address: Position / Title: Fax Number: Mobile: Full Name of Company / Sole Proprietor / Partnership / Trust / Other
Department of the Premier and Cabinet Circular. PC030 Protective Security Policy Framework
Department of the Premier and Cabinet Circular PC030 Protective Security Policy Framework February 2012 PROTECTIVE SECURITY MANAGEMENT FRAMEWORK TABLE OF CONTENTS TABLE OF CONTENTS 2 1. PURPOSE 3 2. SCOPE
QUOTATION REQUEST TASMANIA. How long has the business been in the TAS? New 1 4 Yrs 5 8 Yrs 8 Yrs Plus. Current Insurer: Expiry Date: / /
QUOTATION REQUEST TASMANIA CUSTOMER DETAILS Contact Name: Business Phone: E-mail Address: Position / Title: Fax Number: Mobile: Full Name of Company / Sole Proprietor / Partnership / Trust / Other (Legal
POLICY 5.9 CORNELL UNIVERSITY POLICY LIBRARY. Information technology data will be disclosed only according to the procedures outlined in this policy.
CORNELL UNIVERSITY POLICY LIBRARY Chapter: 9, Access to Information Data and Monitoring Network Policy/WCMC Information technology data will be disclosed only according to the procedures outlined in this
INFORMATION SECURITY MANAGEMENT POLICY
INFORMATION SECURITY MANAGEMENT POLICY Security Classification Level 4 - PUBLIC Version 1.3 Status APPROVED Approval SMT: 27 th April 2010 ISC: 28 th April 2010 Senate: 9 th June 2010 Council: 23 rd June
Professional Solutions Insurance Company. Business Associate Agreement re HIPAA Rules
Professional Solutions Insurance Company Business Associate Agreement re HIPAA Rules I. Purpose of Agreement This Agreement reflects Professional Solutions Insurance Company s agreement to comply with
University of Liverpool
University of Liverpool Information Security Policy Reference Number Title CSD-003 Information Security Policy Version Number 3.0 Document Status Document Classification Active Open Effective Date 01 October
Information Security Management System Policy
Information Security Management System Policy Public Version 3.3 Issued Document Name Owner P079A ISMS Security Policy Information Security Security Policies, Standards and Procedures emanate from the
technical factsheet 176
technical factsheet 176 Data Protection CONTENTS 1. Introduction 1 2. Register with the Information Commissioner s Office 1 3. Period protection rights and duties remain effective 2 4. The data protection
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One Information Security- Perspective for Management Information Security Management Program Concept
Supervisory Policy Manual
This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue
TELECOMMUNICATIONS ORDINANCE (Chapter 106) CLASS LICENCE. Section 8(1)(aa) of the Telecommunications Ordinance OFFER OF TELECOMMUNICATIONS SERVICES
TELECOMMUNICATIONS ORDINANCE (Chapter 106) CLASS LICENCE Section 8(1)(aa) of the Telecommunications Ordinance OFFER OF TELECOMMUNICATIONS SERVICES The Telecommunications Authority, in exercise of the powers
Privacy and Cloud Computing for Australian Government Agencies
Privacy and Cloud Computing for Australian Government Agencies Better Practice Guide February 2013 Version 1.1 Introduction Despite common perceptions, cloud computing has the potential to enhance privacy
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8.
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 1 Table of Contents Overview /Standards: I. Information Security Policy/Standards Preface...5 I.1 Purpose....5
Council Policy. Records & Information Management
Council Policy Records & Information Management COUNCIL POLICY RECORDS AND INFORMATION MANAGEMENT Policy Number: GOV-13 Responsible Department(s): Information Systems Relevant Delegations: None Other Relevant
How To Protect Decd Information From Harm
Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the
Personal Data Protection Policy and Practices ( the Policy )
Personal Data Protection Policy and Practices ( the Policy ) FWD Life Insurance Company (Bermuda) Limited ("the Company") is committed to implementation and compliance with the provisions of the Personal
POSITION DESCRIPTION, PERFORMANCE MEASURES AND TARGETS
POSITION DESCRIPTION, PERFORMANCE MEASURES AND TARGETS Attachment 1 Position Title: Programs & Client Relations Manager Responsible to: Chief Executive Officer Responsibility: Programs Management and Client
Privacy Incident and Breach Management Policy
Privacy Incident and Breach Management Policy Privacy Office Document ID: 2480 Version: 2.1 Owner: Chief Privacy Officer Sensitivity Level: Low Copyright Notice Copyright 2014, ehealth Ontario All rights
Cloud Computing. Introduction
Cloud Computing Introduction This information leaflet aims to advise organisations which are considering engaging cloud computing on the factors they should consider. It explains the relationship between
This procedure is associated with BCIT policy 6700, Freedom of Information and Protection of Privacy.
Privacy Breach No.: 6700 PR2 Policy Reference: 6700 Category: Information Management Department Responsible: Privacy and Records Management Current Approved Date: 2012 May 01 Objectives This procedure
Policy-Standard heading. Fraud and Corruption Policy
Policy-Standard heading Fraud and Corruption Policy September 2013 Table of contents Introduction 3 Purpose 3 Scope 3 Related Policies and Processes 3 Definition of Fraud and Corruption 4 Policy 4 Code
The Impact on Marketing-Related Activities of the Data Protection Act and Related Legislation
The Impact on Marketing-Related Activities of the Data Protection Audience 1. This guidance is intended for all University staff who maintain or use database of contacts for marketing purposes, including
A Best Practice Guide
A Best Practice Guide Contents Introduction [2] The Benefits of Implementing a Privacy Management Programme [3] Developing a Comprehensive Privacy Management Programme [3] Part A Baseline Fundamentals
Guidance Note on Actuarial Review of Insurance Liabilities in respect of Employees Compensation and Motor Insurance Businesses
Guidance Note on Actuarial Review of Insurance Liabilities in respect of Employees Compensation and Motor Insurance Businesses GN9 Introduction Under the Insurance Companies Ordinance (Cap. 41) ( Ordinance
Information Security Program
Stephen F. Austin State University Information Security Program Revised: September 2014 2014 Table of Contents Overview... 1 Introduction... 1 Purpose... 1 Authority... 2 Scope... 2 Information Security
(a) the kind of data and the harm that could result if any of those things should occur;
Cloud Computing This information leaflet aims to advise organisations on the factors they should take into account in considering engaging cloud computing. It explains the relevance of the Personal Data
The taxation treatment of Australian financial products is not the same as for New Zealand financial products.
Overseas distribution No action has been taken to register or qualify the offer of Units under this PDS, or to otherwise permit a public offering of Units, in any jurisdiction outside Australia and New
Issue 1.0. UoG/ILS/IS 001. Information Security and Assurance Policy. Information Security and Compliance Manager
Document Reference Number Date Title Author Owning Department Version Approval Date Review Date Approving Body UoG/ILS/IS 001 January 2016 Information Security and Assurance Policy Information Security
GOVERNANCE AND MANAGEMENT OF CITY COMPUTER SOFTWARE NEEDS IMPROVEMENT. January 7, 2011
APPENDIX 1 GOVERNANCE AND MANAGEMENT OF CITY COMPUTER SOFTWARE NEEDS IMPROVEMENT January 7, 2011 Auditor General s Office Jeffrey Griffiths, C.A., C.F.E. Auditor General City of Toronto TABLE OF CONTENTS
INFORMATION PRIVACY POLICY FOR WORKERS
INFORMATION PRIVACY POLICY FOR WORKERS February 2015 INFORMATION PRICACY FEBRUARY 2014 Information Privacy Policy for Workers SITA Australia Pty Ltd (ACN 002 902 650) This Information Privacy Policy for
ISO27001 Controls and Objectives
Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the
PROCEDURE. The permission rights assigned to allow data custodians to view, copy, enter, download, update or query data.
Section: Subject: Administration (AD) Data Governance AD.3.3.1 DATA GOVERNANCE PROCEDURE Legislation: Alberta Evidence Act, RSA 2000, c.a-18; Electronic Transactions Act, SA 2001, c.e- 5.5; Freedom of
Information Security Program CHARTER
State of Louisiana Information Security Program CHARTER Date Published: 12, 09, 2015 Contents Executive Sponsors... 3 Program Owner... 3 Introduction... 4 Statewide Information Security Strategy... 4 Information
ISO 27001 Controls and Objectives
ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements
Who Should Know This Policy 2 Definitions 2 Contacts 3 Procedures 3 Forms 5 Related Documents 5 Revision History 5 FAQs 5
Information Security Policy Type: Administrative Responsible Office: Office of Technology Services Initial Policy Approved: 09/30/2009 Current Revision Approved: 08/10/2015 Policy Statement and Purpose
Information Security Policy
Information Security Policy Touro College/University ( Touro ) is committed to information security. Information security is defined as protection of data, applications, networks, and computer systems
Code of Practice On Person-to-Person Marketing Calls
Issued on 30 May 2014 Code of Practice On Person-to-Person Marketing Calls Preamble 1. This Code of Practice ( CoP ) is issued jointly by the Hong Kong Association of Banks ( HKAB ) and the DTC Association
How has outsourcing affected public service delivery in Hong Kong? Illustrate with relevant cases.
How has outsourcing affected public service delivery in Hong Kong? Illustrate with relevant cases. By Brenda Chan, David Wong, Hooly Leung, Olga Chan and Boris Siu Outsourcing through the eyes of Government
Data Protection Policy
1 Data Protection Policy Version 1: June 2014 1 2 Contents 1. Introduction 3 2. Policy Statement 3 3. Purpose of the Data Protection Act 1998 3 4. The principles of the Data Protection Act 1998 4 5 The
4 Guidelines on Administration Charges for Reporting of Site Accidents
4 Guidelines on Administration Charges for Reporting of Site Accidents Version 1 August 2008 Disclaimer This publication is prepared by the Construction Industry Council (CIC) to report findings or set
1 LAWS of MINNESOTA 2015 Ch 67, s 2. CHAPTER 67--S.F.No. 86 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
1 LAWS of MINNESOTA 2015 Ch 67, s 2 CHAPTER 67--S.F.No. 86 An act relating to data practices; classifying data related to automated license plate readers and requiring a governing policy; requiring a log
Bring Your Own Device (BYOD) Policy
Bring Your Own Device (BYOD) Policy Version: 1.0 Last Amendment: N/A Approved by: Executive Committee Policy owner/sponsor: Director, Digital Library Services and CIO Policy Contact Officer: Manager, ICT
I S O I E C 2 7 0 0 2 2 0 1 3 I N F O R M A T I O N S E C U R I T Y A U D I T T O O L
15.1 ESTABLISH SECURITY AGREEMENTS WITH SUPPLIERS 15.1.1 EXPECT SUPPLIERS TO COMPLY WITH RISK MITIGATION AGREEMENTS Do you clarify the information security risks that exist whenever your suppliers have
Data Protection Policy June 2014
Data Protection Policy June 2014 Approving authority: Consultation via: Court Audit and Risk Committee, University Executive, Secretary's Board, Information Governance and Security Group Approval date:
Align Technology. Data Protection Binding Corporate Rules Controller Policy. 2014 Align Technology, Inc. All rights reserved.
Align Technology Data Protection Binding Corporate Rules Controller Policy Contents INTRODUCTION 3 PART I: BACKGROUND AND ACTIONS 4 PART II: CONTROLLER OBLIGATIONS 6 PART III: APPENDICES 13 2 P a g e INTRODUCTION
Document Management in the FIPPA Era
Document Management in the FIPPA Era Kathryn Frelick DISCLAIMER This Coffee Talk presentation is provided as an information service and is not meant to be taken as legal opinion or advice. Please do not
Document Title: System Administrator Policy
Document Title: System REVISION HISTORY Effective Date:15-Nov-2015 Page 1 of 5 Revision No. Revision Date Author Description of Changes 01 15-Oct-2015 Terry Butcher Populate into Standard Template Updated
West Midlands Police and Crime Commissioner Records Management Policy 1 Contents
West Midlands Police and Crime Commissioner Records Management Policy 1 Contents 1 CONTENTS...2 2 INTRODUCTION...3 2.1 SCOPE...3 2.2 OVERVIEW & PURPOSE...3 2.3 ROLES AND RESPONSIBILITIES...5 COMMISSIONED
EXECUTIVE ORDERS ON OFFSHORE OUTSOURCING ISSUED IN OTHER STATES
EXECUTIVE ORDERS ON OFFSHORE OUTSOURCING ISSUED IN OTHER STATES Alaska AO 216 (2004) Directs the Chief Procurement Officer to: Develop and implement policies addressing the consideration of the use of
Information Security Management System Information Security Policy
Management System Policy Version: 3.4 Issued Document Name: Owner: P079A - ISMS Security Policy Classification: Public Security Policies, Standards and Procedures emanate from the Policy which has been
Guidance for Data Users on the Collection and Use of Personal Data through the Internet 1
Guidance for Data Users on the Collection and Use of Personal Data through the Internet Introduction Operating online businesses or services, whether by commercial enterprises, non-government organisations
Information & ICT Security Policy Framework
Information & ICT Security Framework Version: 1.1 Date: September 2012 Unclassified Version Control Date Version Comments November 2011 1.0 First draft for comments to IT & Regulation Group and IMG January
Proposal Form. Information Technology Combined Professional and Public & Technology Products Liability. Page 1 of 13
Information Technology Combined Professional and Public & Technology Products Liability Page 1 of 13 Information Technology Combined Professional and Public & Technology Products Liability IMPORTANT NOTICE
Highland Council Information Security Policy
Highland Council Information Security Policy Document Owner: Vicki Nairn, Head of Digital Transformation Page 1 of 16 Contents 1. Document Control... 4 Version History... 4 Document Authors... 4 Distribution...
CITY UNIVERSITY OF HONG KONG. Information Security PUBLIC Internal Assessment Standard
CITY UNIVERSITY OF HONG KONG Internal Assessment Standard (Approved by the Information Strategy and Governance Committee in December 2013) PUBLIC Date of Issue: 2013-12-24 Document Control Document Owner
Initial Audit Engagements Opening Balances
HKSA 510 Issued September 2009; revised July 2010, June 2014* Effective for audits of financial statements for periods beginning on or after 15 December 2009 Hong Kong Standard on Auditing 510 Initial
Third Party Security Requirements Policy
Overview This policy sets out the requirements expected of third parties to effectively protect BBC information. Audience Owner Contacts This policy applies to all third parties and staff, including contractors,
Cyber Risks in the Boardroom
Cyber Risks in the Boardroom Managing Business, Legal and Reputational Risks Perspectives for Directors and Executive Officers Preparing Your Company to Identify, Mitigate and Respond to Risks in a Changing
Information and Compliance Management Information Management Policy
Aurora Energy Group Information Management Policy Information and Compliance Management Information Management Policy Version History REV NO. DATE REVISION DESCRIPTION APPROVAL 1 11/03/2011 Revision and
Newcastle University Information Security Procedures Version 3
Newcastle University Information Security Procedures Version 3 A Information Security Procedures 2 B Business Continuity 3 C Compliance 4 D Outsourcing and Third Party Access 5 E Personnel 6 F Operations
HIPAA Privacy Rule Policies
DRAFT - Policies and Procedures PRIVACY OFFICE ASSIGNMENT AND RESPONSIBILITIES APPROVED BY: SUPERCEDES POLICY: Policy #1 ADOPTED: REVISED: REVIEWED: Purpose This policy is designed to assure the establishment
CITY UNIVERSITY OF HONG KONG. Information Classification and
CITY UNIVERSITY OF HONG KONG Handling Standard (Approved by the Information Strategy and Governance Committee in December 2013) PUBLIC Date of Issue: 2013-12-24 Document Control Document Owner Classification
La Trobe University is committed to maintaining a comprehensive and effective Compliance Framework.
La Trobe University Compliance Framework Introduction The Compliance Framework documents the system and Compliance Process through which La Trobe University can monitor, review and comply with its legislative
INITIAL APPROVAL DATE INITIAL EFFECTIVE DATE
TITLE AND INFORMATION TECHNOLOGY RESOURCES DOCUMENT # 1107 APPROVAL LEVEL Alberta Health Services Executive Committee SPONSOR Legal & Privacy / Information Technology CATEGORY Information and Technology
Issue #5 July 9, 2015
Issue #5 July 9, 2015 Breach Response Plans by Lyndsay A. Wasser, CIPP/C, Co-Chair Privacy Privacy breaches can occur despite an organization s best efforts to prevent them. When such incidents arise,
Information Governance Standards in Relation to Third Party Suppliers and Contractors
Information Governance Standards in Relation to Third Party Suppliers and Contractors Document Summary Ensure staff members are aware of the standards that should be in place when considering engaging
HORIZON OIL LIMITED (ABN: 51 009 799 455)
HORIZON OIL LIMITED (ABN: 51 009 799 455) CORPORATE CODE OF CONDUCT Corporate code of conduct Page 1 of 7 1 Introduction This is the corporate code of conduct ( Code ) for Horizon Oil Limited ( Horizon
FSPFCC04(SQA Unit Code-F88P 04) Ensure you comply with regulations in your financial services environment
Ensure you comply with regulations in your financial services Overview This Standard is about working within the regulatory of the financial services industry. Most organisations within financial services
Johnson Electric Group Code of Ethics and Business Conduct
Johnson Electric Group Code of Ethics and Business Conduct Chairman s Message Johnson Electric strives to conduct its business with honesty and integrity, both within the Group and in dealing with business
Corporate ICT & Data Management. Data Protection Policy
90 Corporate ICT & Data Management Data Protection Policy Classification: Unclassified Date Created: January 2012 Date Reviewed January Version: 2.0 Author: Owner: Data Protection Policy V2 1 Version Control
The Cyprus mobile operators Code of Practice for the responsible and secure use of mobile services. Final version for publication
The Cyprus mobile operators Code of Practice for the responsible and secure use of mobile services. Final version for publication The Cyprus mobile operators code of practice for the responsible and secure
IP Considerations in Outsourcing Agreements
IP Considerations in Outsourcing Agreements Speakers: Moderator: Diana Mansour, Associate, Gardner Roberts LLP Mathew Snell, GTS Canada Senior Counsel, IBM Canada Ildiko Mehes, VP and General Counsel,
ACE Insurance Limited ELITE II PROFESSIONAL INDEMNITY INSURANCE POLICY
ELITE II PROFESSIONAL INDEMNITY INSURANCE POLICY Renewal Proposal Form - Miscellaneous ABN 23 001 642 020 AFSL 239687 Page 1 of 8 ACE ELITE II PROFESSIONAL INDEMNITY INSURANCE RENEWAL PROPOSAL FORM Miscellaneous
Data Protection Breach Management Policy
Data Protection Breach Management Policy Please check the HSE intranet for the most up to date version of this policy http://hsenet.hse.ie/hse_central/commercial_and_support_services/ict/policies_and_procedures/policies/
CITY UNIVERSITY OF HONG KONG. Inventory and Ownership Standard
CITY UNIVERSITY OF HONG KONG Inventory and Ownership Standard (Approved by the Information Strategy and Governance Committee in December 2013; revision 1.1 approved by Chief Information Officer in September
MERCHANT SHIPPING (LIMITATION OF SHIPOWNERS LIABILITY) (AMENDMENT) ORDINANCE 2005
A7 MERCHANT SHIPPING (LIMITATION OF SHIPOWNERS 2005 CONTENTS Section Page 1. Short title and commencement... A9 2. Interpretation... A9 3. Convention to have force of law... A11 4. Application... A13 5.