Ulster University Standard Cover Sheet
|
|
|
- Penelope Young
- 5 years ago
- Views:
Transcription
1 Ulster University Standard Cover Sheet Document Title Portable Devices Security Standard 1.5 Custodian Approving Committee Deputy Director of Finance and Information Services (Information Services) Information Services Directorate (ISD) Policy approved date Policy effective from date Policy review date Changes to previous version Page 4 Added for staff
2 INTRODUCTION AND BACKGROUND The purpose of this document is to define University standards for the security of portable devices - both University owned and supplied (UOS), or Privately Owned (PO) that connect to the University s data networks, systems and services, or that store University sensitively classified information. Portable devices taken outside secure University environments are subject to special security risks: they may be lost or stolen and may be exposed to unauthorised access or tampering. Portable devices taken abroad may also be at risk of being confiscated by airport security, police or customs officials. Portable devices include: Laptops Tablets, slates and pads Netbooks Smartphones PDAs and MP3 players E-Book readers The loss of a portable device may mean not only the loss of availability of the device and its data, but may also lead to the disclosure of University sensitively classified information. This loss of information will often be considered more serious than the loss of the physical asset. Further information on ISD policies, standards and guidelines is available at: RELEVANT LEGISLATION The University will comply with all legislation and statutory requirements relevant to information and information systems, including: Computer Misuse Act 1990 Data Protection Act 1998 Communications Act 2003 Copyright, Designs and Patents Act 1988 Freedom of Information Act 2000 Human Rights Act 1998 Regulation of Investigatory Powers Act 2000 The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 ( the Lawful Business Regulations ) Page 1 of 5
3 AIMS, PURPOSE AND SCOPE OF THE STANDARD This standard aims to protect University sensitively classified information accessed or stored through the use of UOS or PO portable devices. The scope of the standard includes UOS, and PO portable devices that connect to the University s data networks, systems and services, or that store University sensitively classified information. DEFINITIONS AND CLARIFICATION The term: 1. University owned and supplied (UOS) refers to those portable devices purchased, owned and supplied by the University. Whether out of a general or project-related budget. 2. Privately Owned (PO) refers to privately owned portable devices not purchased, owned or supplied by the University. 3. University sensitively classified information refers to University information with a protective marking other than OPEN (ie. classified PROTECT or CONTROL). 4. Booting refers to the process that starts operating systems when the user turns on a computer system. The boot sequence is the initial set of operations that the computer performs when power is switched on. 5. ActiveSync and Microsoft Exchange ActiveSync (EAS) refer to the Microsoft Exchange facility that allows the synchronization of messages, calendars and contact lists with portable devices. PROCEDURE Even when protected by disk encryption, unauthorised access and tampering with a portable device, particularly if there are repeated opportunities for access, may: lead to compromise, possibly continuing and/or undetected, of information on the device lead to compromise, continuing and/or undetected, of information assets to which the device is connected, for example through stored file share links, cached passwords etc. undermine security measures (including encryption); intended to protect information on the device in the event of loss or theft IMPLEMENTATION PHYSICAL SECURITY 1. Users shall assure possession and physical control of all portable devices: a. Reasonable steps shall be taken to minimise risk of device theft. When travelling and not in use, users shall ensure that portable devices are stored securely. For example, when travelling by car, ensure portable Page 2 of 5
4 devices are not visible and/or locked in the boot. Devices left on display and unattended will inevitably attract attention and are likely to be stolen. b. Portable devices should not be left in the care of any person who is not trusted to protect the information it contains c. Portable devices should not be left unattended 2. Use anonymous bags or cases. It is good practice to carry laptops in protective anonymous bags or cases (i.e. those without manufacturer logos on them) when not in use. 3. Lost or stolen devices shall be reported immediately Portable devices that store University sensitively classified information that are lost or stolen should be immediately reported to the ISD Service Desk for escalation. In particular, smartphones that use ActiveSync or otherwise store e- mail need to be reported immediately and require to be disabled remotely. Due to their inherent mobility and vulnerabilities, smartphones should be regarded as uncontrolled endpoints, whether UOS or PO. 4. Secure storage and portable device encryption The requirement and detail for encryption of portable devices containing University information is given in the document Secure Storage and Archival Code of Practice. 5. Labelling Tamper-proof labels should be fitted to UOS portable devices for asset identification. 6. Minimise sensitive information on portable devices University sensitively classified information stored on portable devices should be kept to the minimum required for effective business use in order to minimise the risks and impacts should a security breach occur. 7. Eavesdropping Users shall be aware that when viewing confidential or sensitive information, others may be able to view screen contents. SOFTWARE SECURITY 1. Booting of devices from portable storage Portable Devices capable of booting from portable storage should have this ability disabled. Such devices should be configured to boot from the local hard disk or network only. Page 3 of 5
5 2. synchronisation Microsoft Exchange ActiveSync (EAS) shall be the sole protocol supported for portable device synchronisation with the University service. 3. Portable device security requirements Portable devices used to access: University using the Microsoft Exchange ActiveSync protocol; Networked information stores containing University sensitively classified information; Locally stored University sensitively classified information; shall be required to support and implement for staff: 1. Remote device locking This is the ability to send a command to a device which will remotely lock the device. 2. Remote wipe/data removal This is the ability to send a command to a device which will remotely erase all data from the device. 3. Device access control by password/pin protection A password/pin shall be required to access the device which will comply with a minimum password length, timeout and maximum number of password attempts configuration parameters. 4. Encryption Data on the device shall be encrypted. 5. Security and Anti-Malware The latest security and anti-malware updates shall be configured and installed. NETWORK SECURITY The use of portable devices will be monitored: To ensure acceptable use; To safeguard integrity, security and availability; To facilitate capacity planning and optimize performance; To assist in fault investigation and incident handling; To investigate any suspected or actual breaches of University policy, unauthorised use or criminal activity; To gather evidence for investigative or disciplinary purposes; To facilitate any other legal and security purposes. Page 4 of 5
6 Details of monitoring for acceptable use are contained in the University s IT Monitoring Policy and IT Monitoring Code of Practice. OTHER RELEVANT POLICIES Acceptable Use Code of Practice Secure Storage and Archival Code of Practice Protective Marking Standard IT Monitoring Policy IT Monitoring Code of Practice CONTACTS AND FURTHER INFORMATION Portable devices that store University information classified PROTECT or CONTROL that are lost or stolen should be immediately reported to the ISD Helpdesk for escalation. Page 5 of 5
University of Ulster Standard Cover Sheet
University of Ulster Standard Cover Sheet Document Title AUTHENTICATION STANDARD 2.0 Custodian Approving Committee ISD Heads ISD Committee Policy approved date 2011 10 13 Policy effective from date 2011
Data Handling Security Policy
Data Handling Security Policy May 2018 Newark Orchard School Data Handling Security Policy May 2018 Page 1 Responsibilities for managing IT equipment, removable storage devices and papers, in the office,
PS 176 Removable Media Policy
PS 176 Removable Media Policy December 2013 Version 2.0 Statement of legislative compliance This document has been drafted to comply with the general and specific duties in the Equality Act 2010; Data
Mobile Computing Policy
Mobile Computing Policy Overview and Scope 1. The purpose of this policy is to ensure that effective measures are in place to protect against the risks of using mobile computing and communication facilities..
Bring Your Own Device Policy
Bring Your Own Device Policy 2015 City of Glasgow College Charity Number: SCO 36198 Page 1 of 9 Table of Contents 1. Introduction... 3 2. Purpose and Aims... 4 3. Scope... 4 4. Policy Statement... 5 4.1
Data Encryption Policy
Data Encryption Policy Document Control Sheet Q Pulse Reference Number Version Number Document Author Lead Executive Director Sponsor Ratifying Committee POL-F-IMT-2 V02 Information Governance Manager
INFORMATION TECHNOLOGY SECURITY POLICY
INFORMATION TECHNOLOGY SECURITY POLICY Author Responsible Director Approved By Data Approved September 15 Date for Review November 17 Version 2.3 Replaces version 2.2 Mike Dench, IT Security Manager Robin
TARGET2-SECURITIES INFORMATION SECURITY REQUIREMENTS
Target2-Securities Project Team TARGET2-SECURITIES INFORMATION SECURITY REQUIREMENTS Reference: T2S-07-0270 Date: 09 October 2007 Version: 0.1 Status: Draft Target2-Securities - User s TABLE OF CONTENTS
Remote Working & Mobile Devices Security Standard
TRUST-WIDE NON-CLINICAL DOCUMENT Remote Working & Mobile Devices Security Standard Standard Number: Scope of this Document: Recommending Committee: Approving Committee: SS02 All Staff Joint Information
UCL Policy on Electronic Mail ( )
LONDON S GLOBAL UNIVERSITY UCL Policy on Electronic Mail (EMAIL) Information Security Policy University College London Document Summary Document ID Status Information Classification Document Version TBD
University of Liverpool
University of Liverpool Information Security Policy Reference Number Title CSD-003 Information Security Policy Version Number 3.0 Document Status Document Classification Active Open Effective Date 01 October
INFORMATION SECURITY AND RISK POLICY
INFORMATION SECURITY AND RISK POLICY 1 of 12 POLICY REFERENCE INFORMATION SHEET Document Title Document Reference Number Information Security and Risk Policy P/096/CO/03/11 Version Number V02.00 Status:
A practical guide to IT security
Data protection A practical guide to IT security Ideal for the small business The Data Protection Act states that appropriate technical and organisational measures shall be taken against unauthorised or
Company Policy Documents. Information Security Incident Management Policy
Information Security Incident Management Policy Information Security Incident Management Policy Propeller Studios Ltd is responsible for the security and integrity of all data it holds. Propeller Studios
Policy. London School of Economics & Political Science. Remote Access Policy. IT Services. Jethro Perkins. Information Security Manager.
London School of Economics & Political Science IT Services Policy Remote Access Policy Jethro Perkins Information Security Manager Summary This document outlines the controls from ISO27002 that relate
ICT Portable Devices and Portable Media Security
ICT Portable Devices and Portable Media Security Who Should Read This Policy Target Audience All Trust Staff, contractors, and other agents, who utilise trust equipment and access the organisation s data
Computer Security Policy
Administration and Policy: Computer usage policy B 0.2/3 All systems Computer and Rules for users of the ECMWF computer systems May 1995 Table of Contents 1. The requirement for computer security... 1
PS Mailing Services Ltd Data Protection Policy May 2018
PS Mailing Services Ltd Data Protection Policy May 2018 PS Mailing Services Limited is a registered data controller: ICO registration no. Z9106387 (www.ico.org.uk 1. Introduction 1.1. Background We collect
Date Approved: Board of Directors on 7 July 2016
Policy: Bring Your Own Device Person(s) responsible for updating the policy: Chief Executive Officer Date Approved: Board of Directors on 7 July 2016 Date of Review: Status: Every 3 years Non statutory
Employee Security Awareness Training Program
Employee Security Awareness Training Program Date: September 15, 2015 Version: 2015 1. Scope This Employee Security Awareness Training Program is designed to educate any InComm employee, independent contractor,
Information Security Controls Policy
Information Security Controls Policy Classification: Policy Version Number: 1-00 Status: Published Approved by (Board): University Leadership Team Approval Date: 30 January 2018 Effective from: 30 January
INFORMATION SECURITY POLICY
Open Open INFORMATION SECURITY POLICY OF THE UNIVERSITY OF BIRMINGHAM DOCUMENT CONTROL Date Description Authors 18/09/17 Approved by UEB D.Deighton 29/06/17 Approved by ISMG with minor changes D.Deighton
Data Protection Policy
Data Protection Policy Data Protection Policy Version 3.00 May 2018 For more information, please contact: Technical Team T: 01903 228100 / 01903 550242 E: info@24x.com Page 1 The Data Protection Law...
Information Security Policy
Information Security Policy Author: Responsible Lead Executive Director: Endorsing Body: Governance or Assurance Committee Alan Ashforth Colin Sloey Implementation Date: September 2010 Version Number:
Information Security Policy for Associates and Contractors
Information Security Policy for Associates and Contractors Version: 1.13 Date: 11 October 2016 Reference: 67972761 Location: Livelink Contents Introduction... 3 Purpose... 3 Scope... 3 Responsibilities...
Information Security Strategy
Security Strategy Document Owner : Chief Officer Version : 1.1 Date : May 2011 We will on request produce this Strategy, or particular parts of it, in other languages and formats, in order that everyone
GM Information Security Controls
: Table of Contents 2... 2-1 2.1 Responsibility to Maintain... 2-2 2.2 GM s Right to Monitor... 2-2 2.3 Personal Privacy... 2-3 2.4 Comply with Applicable Laws and Site Specific Restrictions... 2-3 2.5
Information Security Data Classification Procedure
Information Security Data Classification Procedure A. Procedure 1. Audience 1.1 All University staff, vendors, students, volunteers, and members of advisory and governing bodies, in all campuses and locations
Information Security Policy
Information Security Policy Title: Information Security Reference: IS-01 Status: Approved Version: 1.1 Date: July 2017 Classification: Non-Sensitive/Open Author(s) Head of Information Assurance Approved
Virginia State University Policies Manual. Title: Information Security Program Policy: 6110
Purpose Virginia State University (VSU) uses information to perform the business services and functions necessary to fulfill its mission. VSU information is contained in many different mediums including
Name of Policy: Computer Use Policy
Page: Page 1 of 5 Director Approved By: Approval Date: Reason(s) for Change Responsible: Corporate Services Leadership April 22, Reflect current technology and practice Corporate Services Leadership Leadership
Information Technology Standards
Information Technology Standards IT Standard Issued: 9/16/2009 Supersedes: New Standard Mobile Device Security Responsible Executive: HSC CIO Responsible Office: HSC IT Contact: For questions about this
Element Finance Solutions Ltd Data Protection Policy
Element Finance Solutions Ltd Data Protection Policy CONTENTS Section Title 1 Introduction 2 Why this Policy Exists 3 Data Protection Law 4 Responsibilities 5 6 7 8 9 10 Data Protection Impact Assessments
DIRECTIVE ON INFORMATION TECHNOLOGY SECURITY FOR BANK PERSONNEL. June 14, 2018
DIRECTIVE ON INFORMATION TECHNOLOGY SECURITY FOR BANK PERSONNEL June 14, 2018 A. Overriding Objective 1.1 This Directive establishes the rules and instructions for Bank Personnel with respect to Information
Donor Credit Card Security Policy
Donor Credit Card Security Policy INTRODUCTION This document explains the Community Foundation of Northeast Alabama s credit card security requirements for donors as required by the Payment Card Industry
SYSTEMKARAN ADVISER & INFORMATION CENTER. Information technology- security techniques information security management systems-requirement
SYSTEM KARAN ADVISER & INFORMATION CENTER Information technology- security techniques information security management systems-requirement ISO/IEC27001:2013 WWW.SYSTEMKARAN.ORG 1 www.systemkaran.org Foreword...
Bring Your Own Device (BYOD) Policy
SH IG 58 Information Security Suite of Policies Bring Your Own Device (BYOD) Policy Version 1 Summary: Keywords (minimum of 5): (To assist policy search engine) Target Audience: Next Review Date: This
Physical Safeguards Policy July 19, 2016
Physical Safeguards Policy July 19, 2016 SCOPE This policy applies to Florida Atlantic University s Covered Components and those working on behalf of the Covered Components (collectively FAU ) for purposes
Data Breach Notification Policy
Data Breach Notification Policy Policy Owner Department University College Secretary Professional Support Version Number Date drafted/date of review 1.0 25 May 2018 Date Equality Impact Assessed Has Prevent
Information Security Incident
Good Practice Guide Author: A Heathcote Date: 22/05/2017 Version: 1.0 Copyright 2017 Health and Social Care Information Centre. The Health and Social Care Information Centre is a non-departmental body
Privacy Policy. I. How your information is used. Registration and account information. March 3,
Privacy Policy This Privacy Policy describes how and when we collect, use and share your information across our App. When using our App you consent to the collection, transfer, storage, disclosure, and
BHIG - Mobile Devices Policy Version 1.0
Version 1.0 Authorised by: CEO Endorsed By: Chief Operations Officer 1 Document Control Version Date Amended by Changes Made 0.1 20/01/2017 Lars Cortsen Initial document 0.2 29/03/2017 Simon Hahnel Incorporate
Digital Computing Asset Management
Document title: Digital Computing Asset Management Approval date: Purpose of document: This document is to keep the AUC community aware of the existence of security requirements to protect the digital
Data Loss Assessment and Reporting Procedure
Data Loss Assessment and Reporting Procedure Governance and Legal Services Strategy, Planning and Assurance Directorate Approved by: Data Governance & Strategy Group Approval Date: July 2016 Review Date:
BYOD Policy (bring your own device)
BYOD Policy (bring your own device) Version 1.0 (December 2016) ITPOL010. Bring your own device Policy v1.0 (13-1-17) Contents DOCUMENT CONTROL... 3 1 POLICY STATEMENT... 4 2 SCOPE... 4 3 BYOD REQUIREMENTS...
Apex Information Security Policy
Apex Information Security Policy Table of Contents Sr.No Contents Page No 1. Objective 4 2. Policy 4 3. Scope 4 4. Approval Authority 5 5. Purpose 5 6. General Guidelines 7 7. Sub policies exist for 8
Creative Funding Solutions Limited Data Protection Policy
Creative Funding Solutions Limited Data Protection Policy CONTENTS Section Title 1 Introduction 2 Why this Policy Exists 3 Data Protection Law 4 Responsibilities 5 6 7 8 9 10 Data Protection Impact Assessments
Mobile Computing Policy
Mobile Computing Policy Issue sheet Document reference NHSBSAIS004 Document location Title NHS Business Services Authority Mobile computing policy Author Head of Security and Information Assurance Issued
IAM Security & Privacy Policies Scott Bradner
IAM Security & Privacy Policies Scott Bradner November 24, 2015 December 2, 2015 Tuesday Wednesday 9:30-10:30 a.m. 10:00-11:00 a.m. 6 Story St. CR Today s Agenda How IAM Security and Privacy Policies Complement
Section 3.9 PCI DSS Information Security Policy Issued: November 2017 Replaces: June 2016
Section 3.9 PCI DSS Information Security Policy Issued: vember 2017 Replaces: June 2016 I. PURPOSE The purpose of this policy is to establish guidelines for processing charges on Payment Cards to protect
Annual Report on the Status of the Information Security Program
October 2, 2014 San Bernardino County Employees Retirement Association 348 W. Hospitality Lane, Third Floor San Bernardino, CA 92415-0014 1 Table of Contents I. Executive Summary... 3 A. Overview... 3
NEOMED OPERATIONAL POLICY
(A) PURPOSE Mobile computers allow NEOUCOM faculty and staff to have computing resources at hand in meetings/classes, enable those who travel on University business to be maximally functional and productive
Remote Working Policy
[Type text] [Type text] [Type text] Information Management & Policy Services (IMPS) Remote Working Policy 1 Scope and definitions 1.1 This policy applies to all staff who use or access University systems
Computing Policies / Procedures
(TIEHH) 1207 GILBERT DRIVE * LUBBOCK, TX 79416 * 806-885-4567 (tel) * 806-885-2132 (fax) Computing Policies / Procedures Contents PURPOSE... 2 REVIEW... 2 POLICY/PROCEDURE... 3 1. Acceptable Use Policy...
<Criminal Justice Agency Name> Personally Owned Device Policy. Allowed Personally Owned Device Policy
Policy Title: Effective Date: Revision Date: Approval(s): LASO: CSO: Agency Head: Allowed Personally Owned Device Policy Every 2 years or as needed Purpose: A personally owned information system or device
Information Security BYOD Procedure
Information Security BYOD Procedure A. Procedure 1. Audience 1.1 This document sets out the terms of use for BYOD within the University of Newcastle. The procedure applies to all employees of the University,
GDPR Draft: Data Access Control and Password Policy
wea.org.uk GDPR Draft: Data Access Control and Password Policy Version Number Date of Issue Department Owner 1.2 21/01/2018 ICT Mark Latham-Hall Version 1.2 last updated 27/04/2018 Page 1 Contents GDPR
University of Pittsburgh Security Assessment Questionnaire (v1.7)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.7) Directions and Instructions for completing this assessment The answers provided
October 2016 Issue 07/16
IPPF: NEW IMPLEMENTATION GUIDES - IG 1100, IG 1110, IG 1111, IG 1120 and IG 1130 The IIA has released new Implementation Guides (IG) addressing the following standards: Standard 1100: Independence and
Controls Electronic messaging Information involved in electronic messaging shall be appropriately protected.
I Use of computers This document is part of the UCISA Information Security Toolkit providing guidance on the policies and processes needed to implement an organisational information security policy. To
INFORMATION SYSTEMS SECURITY POLICY (ISSP)
INFORMATION SYSTEMS SECURITY POLICY (ISSP) Policy Number & Category IG 02 Information Governance Version Number & Date Version 3.7 February 2009 Ratifying Committee Date Approved March 2009 Next Review
Terms and Conditions 01 January 2016
Terms and Conditions 01 January 2016 thehealthsource: Terms and Conditions Page 1 of 7 This Agreement (the Agreement ) is entered into by and between thehealthsource (Pty) Ltd and the entity agreeing to
Sample BYOD Policy. Copyright 2015, PWW Media, Inc. All Rights Reserved. Duplication, Reproduction or Distribution by Any Means Prohibited.
Sample BYOD Policy Copyright 2015, PWW Media, Inc. All Rights Reserved. Duplication, Reproduction or Distribution by Any Means Prohibited. SAMPLE BRING YOUR OWN DEVICE POLICY TERMS OF USE This Sample Bring
ORA HIPAA Security. All Affiliate Research Policy Subject: HIPAA Security File Under: For Researchers
All Affiliate Research Policy Subject: HIPAA File Under: For Researchers ORA HIPAA Issuing Department: Office of Research Administration Original Policy Date Page 1 of 5 Approved by: May 9,2005 Revision
Internet, , Social Networking, Mobile Device, and Electronic Communication Policy
TABLE OF CONTENTS Internet, Email, Social Networking, Mobile Device, and... 2 Risks and Costs Associated with Email, Social Networking, Electronic Communication, and Mobile Devices... 2 Appropriate use
Institute of Technology, Sligo. Information Security Policy. Version 0.2
Institute of Technology, Sligo Information Security Policy Version 0.2 1 Document Location The document is held on the Institute s Staff Portal here. Revision History Date of this revision: 28.03.16 Date
E-Security policy. Ormiston Academies Trust. James Miller OAT DPO. Approved by Exec, July Release date July Next release date July 2019
Ormiston Academies Trust E-Security policy Date adopted: Autumn Term 2018 Next review date: Autumn Term 2019 Policy type Author Statutory James Miller OAT DPO Approved by Exec, July 2018 Release date July
Acceptable Usage Policy (Student)
Acceptable Usage Policy (Student) Author Arthur Bogacki Date 18/10/2017 Version 1.1 (content sourced and consolidated from existing Email and Electronic Communication, and User Code of Practice policies.)
Date of Next Review: May Cross References: Electronic Communication Systems- Acceptable Use policy (A.29) Highway Traffic Act
Date Approved: January 27, 2010-Board Date of Next Review: May 2023 Dates of Amendments: May 17, 2018 Cross References: Electronic Communication Systems- Acceptable Use policy (A.29) Highway Traffic Act
DETAILED POLICY STATEMENT
Applies To: HSC Responsible Office: HSC Information Security Office Revised: New 12/2010 Title: HSC-200 Security and Management of HSC IT Resources Policy POLICY STATEMENT The University of New Mexico
Information technology security and system integrity policy.
3359-11-10.3 Information technology security and system integrity policy. (A) Need for security and integrity. The university abides by and honors its long history of supporting the diverse academic values
Cardiff University Security & Portering Services (SECTY) CCTV Code of Practice
Cardiff University Security & Portering Services (SECTY) CCTV Code of Practice Document history Author(s) Date S Gamlin 23/05/2018 Revision / Number Date Amendment Name Approved by BI annual revision Date
ISC10D026. Report Control Information
ISC10D026 Report Control Information Title: General Information Security Date: 28 January 2011 Version: v3.08 Reference: ICT/GISP/DRAFT/3.08 Authors: Steve Mosley Quality Assurance: ISSC Revision Date
Juniper Vendor Security Requirements
Juniper Vendor Security Requirements INTRODUCTION This document describes measures and processes that the Vendor shall, at a minimum, implement and maintain in order to protect Juniper Data against risks
3 rd Party Certification of Compliance with MA: 201 CMR 17.00
3 rd Party Certification of Compliance with MA: 201 CMR 17.00 The purpose of this document is to certify the compliance of Strategic Information Resources with 201 CMR 17.00. This law protects the sensitive
IT Security Standard Operating Procedure
IT Security Standard Operating Procedure Notice: This document has been made available through the Police Service of Scotland Freedom of Information Publication Scheme. It should not be utilised as guidance
Cyber Security Program
Cyber Security Program Cyber Security Program Goals and Objectives Goals Provide comprehensive Security Education and Awareness to the University community Build trust with the University community by
Data Privacy Breach Policy and Procedure
Data Privacy Breach Policy and Procedure Document Information Last revision date: April 16, 2018 Adopted date: Next review: January 1 Annually Overview A privacy breach is an action that results in an
Access Control Policy
Access Control Policy Version Control Version Date Draft 0.1 25/09/2017 1.0 01/11/2017 Related Polices Information Services Acceptable Use Policy Associate Accounts Policy IT Security for 3 rd Parties,
Network Security Policy
Network Security Policy Date: January 2016 Policy Title Network Security Policy Policy Number: POL 030 Version 3.0 Policy Sponsor Policy Owner Committee Director of Business Support Head of ICU / ICT Business
Gramm Leach Bliley Act 15 U.S.C GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev.
Gramm Leach Bliley Act 15 U.S.C. 6801-6809 GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 11/30/2016 1 Objectives for GLBA Training GLBA Overview Safeguards Rule
Policy General Policy GP20
Email Policy General Policy GP20 Applies to All employees Committee for Approval Quality and Governance Committee Date of Approval September 2012 Review Date June 2014 Name of Lead Manager Head of Technology
The GDPR toolkit. How to guide for Executive Committees. Version March 2018
The GDPR toolkit How to guide for Executive Committees Version 1.0 - March 2018 Contents Document Purpose... 3 What s included... 3 Step 1 - How to assess your data... 5 a) What is GDPR?... 5 b) Video
A Homeopath Registered Homeopath
A Homeopath Registered Homeopath DATA PROTECTION POLICY Scope of the policy This policy applies to the work of homeopath A Homeopath (hereafter referred to as AH ). The policy sets out the requirements
Checklist: Credit Union Information Security and Privacy Policies
Checklist: Credit Union Information Security and Privacy Policies Acceptable Use Access Control and Password Management Background Check Backup and Recovery Bank Secrecy Act/Anti-Money Laundering/OFAC
Seven Requirements for Successfully Implementing Information Security Policies and Standards
Seven Requirements for Successfully Implementing and Standards A guide for executives Stan Stahl, Ph.D., President, Citadel Information Group Kimberly A. Pease, CISSP, Vice President, Citadel Information
SECURITY & PRIVACY DOCUMENTATION
Okta s Commitment to Security & Privacy SECURITY & PRIVACY DOCUMENTATION (last updated September 15, 2017) Okta is committed to achieving and preserving the trust of our customers, by providing a comprehensive
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud Introduction The Criminal Justice Information Security (CJIS) Policy is a publically accessible document that contains
Standard for Security of Information Technology Resources
MARSHALL UNIVERSITY INFORMATION TECHNOLOGY COUNCIL Standard ITP-44 Standard for Security of Information Technology Resources 1 General Information: Marshall University expects all individuals using information
UT HEALTH SAN ANTONIO HANDBOOK OF OPERATING PROCEDURES
ACCESS MANAGEMENT Policy UT Health San Antonio shall adopt access management processes to ensure that access to Information Resources is restricted to authorized users with minimal access rights necessary
PCA Staff guide: Information Security Code of Practice (ISCoP)
PCA Staff guide: Information Security Code of Practice (ISCoP) PCA Information Risk and Privacy Version 2015.1.0 December 2014 PCA Information Risk and Privacy Page 1 Introduction Prudential Corporation
Mobile Working Policy. Item 15.3
Mobile Working Policy Item 15.3 Authorship: Committee Approved: Chris Wallace, Information Governance Manager, North Yorkshire & Humber Commissioning Support Unit Management Team Approved date: Review
Data Protection Privacy Notice
PETA Limited Page 1 of 7 Data Protection Privacy Notice PETA Limited provides a range of services to both members of the public and to those employed within business. To enable us to provide a service,
Advent IM Ltd ISO/IEC 27001:2013 vs
Advent IM Ltd ISO/IEC 27001:2013 vs 2005 www.advent-im.co.uk 0121 559 6699 bestpractice@advent-im.co.uk Key Findings ISO/IEC 27001:2013 vs. 2005 Controls 1) PDCA as a main driver is now gone with greater
INFORMATION TECHNOLOGY ( IT ) GOVERNANCE FRAMEWORK
INFORMATION TECHNOLOGY ( IT ) GOVERNANCE FRAMEWORK 1. INTRODUCTION The Board of Directors of the Bidvest Group Limited ( the Company ) acknowledges the need for an IT Governance Framework as recommended
Information Security Management
Information Security Management BS ISO/ IEC 17799:2005 (BS ISO/ IEC 27001:2005) BS 7799-1:2005, BS 7799-2:2005 SANS Audit Check List Author: Val Thiagarajan B.E., M.Comp, CCSE, MCSE, SFS, ITS 2319, IT
Data Breach Incident Management Policy
Data Breach Incident Management Policy Policy Number FCP2.68 Version Number 1 Status Draft Approval Date: First Version Approved By: First Version Responsible for Policy Responsible for Implementation
POLICY FOR DATA AND INFORMATION SECURITY AT BMC IN LUND. October Table of Contents
POLICY FOR DATA AND INFORMATION SECURITY AT BMC IN LUND October 2005 Table of Contents Introduction... 1 Purpose Of This Policy... 1 Responsibility... 1 General Policy... 2 Data Classification Policy...
Mobile Working Policy
Mobile Working Policy Date completed: Responsible Director: Approved by/ date: Ben Westmancott, Director of Compliance Author: Ealing CCG Governing Body 15 th January 2014 Ben Westmancott, Director of
NEW DATA REGULATIONS: IS YOUR BUSINESS COMPLIANT?
NEW DATA REGULATIONS: IS YOUR BUSINESS COMPLIANT? What the new data regulations mean for your business, and how Brennan IT and Microsoft 365 can help. THE REGULATIONS: WHAT YOU NEED TO KNOW Australia: