any specific reference to the part, section, point or paragraph of any relevant supporting documents which act as evidence in response to the question. 5.1.06 Please indicate whether access to data will be done by people working off-site and remotely from the data (Yes / No) 5.1.06a If 'No' then go directly to question 5.1.07. If Yes, please clarify what device will be used to access the data externally and whether this is a personal device provided by the user, or provided by the organisation. If a personal device, please explain how this would comply with organisation IT security policies. 5.1.06b This question is to determine where the data will be held for remote working, whether it will remain in the host environment or whether it will be taken off-site too. If the data remain on-site, the remote access technology in place to give the person access to the data must be outlined here. Please provide any supporting evidence that will give details of policies and procedures of how these data will be accessed securely. If the data are taken off-site, the measures that are in place to maintain the security of the data (e.g. device encryption or data encryption) must be outlined here. What would happen if the device was lost? Or the data accidently deleted? 5.1.07 This question is for the use of any moveable device for any part of the application. At any point in the proposal, will moveable devices be used? This could include using iPads for patients to answer questions or provide specific in a clinic, the collection of patient information, e.g. during an interview, on a USB stick or laptop or separate recording device which would then be combined with a bigger database elsewhere. (Yes / No). 5.1.07a If No, please go directly to Q 5.1.08. If yes, please provide details of any mobile device management solution that is in place to manage such devices, including whether the device can be remotely wiped clean of any data, in the event of any device being lost or stolen. Please provide details of the relevant policy or procedure in place to facilitate and monitor such device. Please provide any specific reference to the part, section, point or paragraph of any relevant supporting documents which act as evidence in response to the question. 5.1.08 Does your organisation have a clear desk and / or clear screen policy? This is to understand whether, at the end of a day, all papers that might contain any personal data will be cleared away, and whether, during the day, any screen is locked so that anything on screen cannot be accidently seen when it is unattended, even for a short space of time. 5.1.09 Please provide any further additional detail which provides assurances regarding the control of access to data which is proposed.

#### 5.2 Storage & Use

This section details how the proposal aims to store and use data, and the controls in place to minimise risks associated with this storage and use. If you have answered 'Yes' to question 3. 4.01 you have answered 'Yes' to question 3. 4.01 above (that your proposal seeks to store and use data exclusively through a recognised safe haven), t hen you do not need to complete this section or section, and should proceed directly to section 5.3. The section requires specific details of relevant policies and procedures which are in place to govern storage and use of data as outlined in the proposal. General and repeated references to a whole policy (unless of a sufficiently narrow scope) should be avoided. This section requires to be repeated for each of the environments where data is to be stored or used. Where the answers to each of the questions asked is identical for more than one environment (for example a network of physical or technical environments