governed by the same policies and procedures and with identical controls in operation), then it is sufficient to state this at question 5.2.01 .

5.2.01 Please provide details of the organisation and environment in which the proposal seeks to store and use data. If these details have been provided in previous sections, you can reference the relevant section and question. You may list multiple environments (for example a network of physical or technical environments) provided that these are governed by the same policies and procedures and with identical controls in operation. If you propose to use multiple environments not governed by the same policies and procedures and with identical controls in operation, then you should complete the whole of section 5.2 for each environment. 5.2.01a If the data will be stored in a computing cloud please give information about who will host or provide that cloud storage and in what country the server is physically situated. If this the USA or somewhere outside the EEA, there may be further security information required as, under Data Protection Act UK 2018 / GDPR, personal data should not be sent outside the EEA, Please also provide IT security i8nforamtion that covers such cloud storage and what access the provider will have to the data stored therein. 5.2.02 Please indicate to what cybersecurity standards your organisation works. This could be ISO 27001, or Cyber Essentials or some other recognised industry standard that needs to be outlined here. Please give details and attach any evidence of approval and duration of that approval. 5.2.03 Please provide details of the relevant policy or procedures governing the proposed storage and use of data within the physical and technical environment listed in question 5.2.01. This will make reference to information security, and may exist within its own right, as part of a wider policy or procedure, or in more than one policy or procedure. Please reference the specific part, section, point or paragraph of the supporting documents provided as evidence for this question. 5.2.04 Please outline the policy and procedures in place to cover the implementation of up-to-date controls for the detection and prevention of malware within the environment in which data will be stored. Please make specific reference to the part, section, point or paragraph of the relevant supporting documents provided as evidence for this question. 5.2.05 Please outline the policy and procedures in place to cover access control and auditing of users and / or system administrator activity within this environment. Please reference the specific part, section, point or paragraph of the supporting documents provided as evidence for this question. 5.2.06 Please outline the policy and procedures in place for the production and control of backup copies of the data, within the storage environment. Please reference the specific part, section, point or paragraph of the relevant supporting documents provided as evidence for this question. 5.2.07 Please outline the policy and procedures in place to ensure business continuity, contingency planning and system restoration in the event of a critical system failure. Please reference the specific part, section, point or paragraph of the relevant supporting documents provided as evidence for this question. 5.2.08 Please outline the policy and procedures in place to prohibit unauthorised copying of data within the storage environment. Please reference the specific part, section, point or paragraph of the relevant supporting documents provided as evidence for this question. 5.2.09 Please outline the policy and procedures in place to describe the physical and site controls of the storage environment. Please reference the specific part, section, point or paragraph of the relevant supporting documents provided as evidence for this question. 5.2.10 Please outline the policy and procedures in place that cover hardware repair, replacement or disposal, and the protection of data from inappropriate access during such processes. Please