## Section 5: Safe Data Processing and Security

#### 5.1 Access

This section details in what way the proposal aims to provide access to data, and controls in place to minimise risks associated with this. If you have answered 'Yes' to Q you have answered 'Yes' to Q 3.4.01 , then you do not need to complete this section or section 5.2, and should proceed directly to section 5.3.

Should your application require NHSCR flagging, even if you intend to use a regional Safe Haven you will need to fill in sections 5.1 and 5.2 and NHSCR require your application to undergo an IT security review by NRS prior to submission to HSC-PBPP.

This section requires specific details of the relevant policies and procedures in place to govern access to data as outlined in the proposal. General and repeated references to a whole policy (unless of a sufficiently narrow scope) should be avoided. This section requires to be repeated (on separate sheets if necessary) for each of the environments where data is to be accessed. Where the answers to each of the questions asked is identical for more than one environment (for example a network of physical or technical environments governed by the same policies and procedures and with identical controls in operation), then it is sufficient to state this at question 5.1.01.

5.1.01 Please provide details of the organisation and environment in which you seek to access data. If these details have been provided in previous sections, then you can provide a reference to the relevant section and question above. You may list multiple environments (for example a network of physical or technical environments) provided that these are governed by the same policies and procedures and with identical controls in operation. If you propose to use multiple environments not governed by the same policies and procedures, nor with identical controls in operation (e.g. NHS and University), then please complete the whole of section 5.2 for each environment. 5.1.02 Please provide details of the relevant security policy and procedures governing the proposed access to data within the physical and technical environment listed in question 5.1.01. These policy and procedures may reference any information security policies, and may exist within its own right, as part of a wider set of policies and procedures, or in more than one policy or procedure. Please make specific reference to the part, section, point or paragraph of the relevant supporting documents which act as evidence in response to the question. 5.1.03 Please confirm and provide details of the relevant policy and procedures that account for the implementation of robust password policy as a control to access of data. Please make specific reference to the part, section, point or paragraph of the relevant supporting documents which act as evidence in response to the question. 5.1.04 Please provide information on the processes for providing and removing access to the data to users and management of user accounts, including the removal of access to sensitive personal data. This question is to try to understand how the principle of least privilege (PoLP) is applied in this system, whereby users can only access the information and resources that are necessary to them. Please make specific reference to the part, section, point or paragraph of the relevant supporting documents which act as evidence in response to the question. 5.1.05 Please confirm whether access controls are associated with individual users accessing data, or whether shared user accounts or other access mechanisms are in use, and the controls in place to govern and manage the use of these. Please provide details of account management, including