reference the specific part, section, point or paragraph of the relevant supporting documents provided as evidence for this question. 5.2.11 Please describe the systems, software and security used to store and use data. This is your opportunity to provide a clear picture of how data is being stored and used, over and above the specific questions identified above. Some examples of what information is required: Is the host environment infrastructure actively vulnerability scanned and penetration tested? If so, is there a policy that covers this? Is the data suitably encrypted, where possible? Does the policy describe the organisations patch management policy? Are security updates installed within a suitable timeframe? This is applicable to both server environment hosting the data, as well as the device used to access the data. Your answer should be proportionate to the complexity of the storage and use of data proposed: where this is straightforward, this question will require less detail, with more detail necessary where more complex storage and use is proposed. Please reference the specific part, section, point or paragraph of the relevant supporting documents provided as evidence for this question. 5.2.12 Please confirm whether the use of outsourced IT is proposed. The definition of outsourced IT should be considered to be very wide in scope, and could include any use of IT infrastructure or systems which are beyond the control of the organisation listed in section 2.1, and the originators of the data. You should mention by name organisations or bodies such as safe havens, third party suppliers or arms-length organisations processing data on your behalf.

#### 5.3 Transfer

This section details with the procedures and controls in place for the transfer of data for this proposal. Transfer can include from person to person, system to system, between organisations or across divisions within the same organisation. It includes the movement, for example, of data from one storage media to another, whether for subsequent use, storage, or temporarily for transit. The section requires specific details of relevant policies and procedures in place for the proposed transfer of data. General and repeated references to a whole policy (unless of a sufficiently narrow scope) should be avoided.

5.3.01 Please provide details of the security policy or procedures governing the proposed transfer of data, such that it is protected from inappropriate or unauthorised access. Your answer should reflect the flow diagram for Q 3.1.11 and describe the transfer processes from the patient to its final destination including any intermediary stages. This may include controls as email encryption, secure file transfer protocols, device encryption, or physical controls. Please reference the specific part, section, point or paragraph of the relevant supporting documents provided as evidence in response to the questions. 5.3.02 Please describe any proposed time-intervals or triggers which will initiate the transfer of data. 5.3.03 Please indicate whether any personal (identifiable, pseudonymised or potentially identifiable) data will be transferred to or shared with any organisation within or beyond the UK (Yes/ No). 5.3.03a If 'No', go directly to question 5.3.04 . If 'Yes', please specify the organisation and country of destination to which you propose to transfer any personal data and provide details of the method of transfer, the proposed location and method of storage, and details of how the data will be handled and kept secure. 5.3.04 Please provide details of any required copying of data, other than that for initial transfers from source systems, and indicate why this is necessary, the method of copying, and the extent to which copied data will proliferate (multiple copies, dissemination etc.). Such processing should be detailed and justified in your answers to question 3.1.09.