Document Control

Revision 1.2, Author: Martin Keen, Date: 22 June 2021

Purpose

This ‘top level’ information security policy sets out areas of risk which all School IT Service Providers should review and address, to ensure that appropriate information security policies and procedures are in place across the School.

This policy does not stipulate the content of any policy or procedure, but rather the outcomes which they should deliver.  This should provide the School with sufficient assurance that appropriate and effective information security measures are in place, whilst allowing for each institution to take those measures they deem appropriate under their own responsibility.

Scope

Where data is held on systems regarded as Data Safe Havens (e.g., The Secure Data Hosting Service (SDHS)) that are subject to further compliance standards, e.g., NHS Toolkit, ISO:27001, then the legislation and policies of the relevant standard should apply.

Responsibilities

Institutions have a responsibility to put in place appropriate and proportionate measures to comply with the UK and EU data protection legislation, contracts the University has with data providers (e.g., NHS Digital) or the Trust, and research grant provisions.  Against that they have to balance their responsibility to facilitate research, teaching, and administration, and uphold the University and School’s core values of freedom of thought and expression.

Users have a responsibility to comply with any policies, procedures or working practices which their Institution puts in place to protect the systems and data under its care.

Requirements

All School IT providers should have policies and procedures to address the following areas of information security risk.  Each requirement could be covered by a specific policy, or as one element of a larger policy.

– Acceptable Use

To protect users and data from harm caused by misuse of Institution IT Systems, a definition of acceptable and unacceptable behaviour on the network should be defined in policy.  Any local policy should comply with the Rules Made by the Information Services Committee[1], and the terms of the provision of the JANET service[2].  There should be some process through which all users are made aware of this policy, if possible with their explicit acceptance of the policy being recorded.

– Access Control

To ensure that proper care has been taken to protect data and systems, policy elements should define how access to systems and data is granted, monitored and revoked.  As far as possible the principle of least privilege should be followed, bearing in mind the relative freedoms required by Academic Research staff in the course of their work.

Due regard should be paid to the Data Protection Act 2018  Principles[3] and any other legislation which may be applicable to the research activity of the institution.  It may be appropriate to include information about how unauthorised access is prevented, detected and responded to.

– Authentication

To comply with the most fundamental principles of information security[4], and the Rules made by the Information Services Committee[5], users with access to systems and data should be authenticated.  Policy elements should address how users authenticate themselves, and what controls are put in place to manage the risks associated with authentication methods. 

Any local policy should define a password policy which addresses the risk of credentials being used by someone other than the intended party (either through being compromised, shared between users, or re-used on non-University systems which are then compromised).

Where appropriate, two factor authentication may also be stipulated in policy to protect data or systems which are particularly sensitive.

– Data Handling

General best practice in handling administrative and research data should be embedded within the conditions of grant funded research, administrative processes or other local guidance.  However, the measures which should be taken to protect data being received, captured, created, stored and processed by an institution should be defined.

Appropriate locations should be defined for different categories of data according to their sensitivity and value.  The more sensitive or valuable data is the more care should be taken in the way it is handled.  Specific attention should be paid to use of portable storage (encrypted and unencrypted), single copy storage on local disk, and central storage.

– Compliance with Legislation

Data which is defined as “sensitive personal data” under Part 1 Section 2 of the Data Protection Act 1998 (incorporating the General Data Protection Regulation (GDPR) (EU) 2016/679) [6] must be only be stored where appropriate protections can be applied (specifically access control, authentication and monitoring and logging), which typically would not include local storage on a PC.

Data defined as “personal confidential data” in Figure 1, Section 6.3 of the Information Governance Review[7] (also referred to as “Patient Identifiable Data” or “Participant Identifiable Data”) must only be stored in accordance with the School’s Information Governance Policy[8].

For more specific information on compliance with legislation, please consult the following: