1 Introductory Questions Please ensure a response is submitted for ALL questions (delete responses in blue as appropriate) Comments and Evidence 1.1 Which of the following most closely describes the service you provide to us? Professional Services Information and Communication Technology Business Process Outsourcing Estates, Facilities Management, Guarding and Support Services Transport / Mail Storage / Archive Operational Equipment and Office Other (Please detail) 1.2 Please provide details of the person responsible for the security of our information and / or the service you provide to us in your organisation. Name: Role: Contact details: 2 Delivery (delete responses in blue as appropriate in third column) 2.1 Are you involved in the manufacture / storage / handling of our Physical Assets? (e.g. Computer hardware, interior design material, fabrics etc) Produce Store Produce and Store None If none please go to Q2.2 2.2 Please advise what activities are used in relation to our Information.(e.g., build guides, design documents, source code, personal staff details, building information etc) Process Store Process and Store 2.3 In the delivery of your service which of the following types of our information do you store / process or produce for use by FCO Services? Personal Identifiable Data Specialist Category Data Commercial Data Technical Data
9.6 If yes to the above, by what method is the training given? Annual Security Awareness training Incorporated in induction process Module option in training programme Bespoke depending on role 9.7 Are training outcomes monitored? Yes No 9.8 Does your organisation offer Data Protection Legislation training? Yes No 9.9 If yes to the above, by what method is the training given? Annual Data Protection Awareness training Incorporated in induction process Module option in training programme Bespoke depending on role 9.10 Are training outcomes monitored? Yes No 10 Security and Breaches (delete responses in blue as appropriate in third column) 10.1 Has your Security Policy... Been reviewed in the last 12 months Yes No Been approved by the senior management Yes No Been made accessible to all staff Yes No 10.2 In the past 12 months have your organisation's information security controls, policies and procedures, been independently reviewed? Yes No If yes, please give details of outcome 10.3 Would any breaches in security that involved FCO Services data be reported to FCO Services? Yes No
If No, please describe how and who within your organisation is responsible for monitoring and recording any security. 10.4 How does your company monitor staff with access to ICT systems to ensure any breaches of its use are identified and dealt with? Please insert information here 10.5 On leaving your organisation, is there a process in place to ensure assets are returned and access rights revoked? Yes No If yes, please specify 11 Incident Management (delete responses in blue as appropriate in third column) 11.1 Do you have policies in place which set out how information security incidents, and breaches to the confidentiality of data, should be managed and who it should be escalated to? Yes No If yes, please provide a copy 11.2 If unable to provide a copy please detail how you would be able to comply with the Data Protection Regulations including roles and responsibilities to achieve compliance. 11.3 Have you experienced any data breach, whether reported to the ICO or not, within the last 5 years? If so, please provide details of incident. Yes No Details 12 Business Continuity (delete responses in blue as appropriate in third column) 12.1 Are you registered (certified) to any recognised Business Continuity Standard for the full range of products, services and works you provide? Yes Partial No
12.2 Do you have staff assigned to undertake Business Continuity Management (BCM) with clearly defined and documented roles and responsibilities? Yes Partial No 12.3 Have you assessed the risks to your operations and taken the necessary actions to protect your business? Yes Partial No 12.4 Do you identify and mitigate risks or threats to the business operations from specific events such as Olympics, warnings of heavy weather or localised flooding, power outages etc? Yes Partial No 12.5 Have you identified the activities that are essential for your delivery of the full range of your products, services and works? Yes Partial No 12.6 Do you have a business continuity strategy for; people, premises, technology, information, suppliers and stakeholders? Yes Partial No 12.7 Have you engaged with local emergency responders to develop plans for helping your organisation and your community during an emergency? Yes Partial No 12.8 Do you have regularly updated Business Continuity arrangement that include your incident management process, notification procedures, recovery strategy / procedures and the estimated recovery time for your products, services and works? Yes Partial No 12.9 Do you have a documented strategy for exercising the Business Continuity Plan? Yes Partial No