1 The ICT systems used in the proposed solution/service must be securely configured and maintained. Do you confirm that your company (and any 3rd parties used) comply with this requirement, and are able to evidence it? Yes No Ref Requirement: Protecting networks from internal and external attack Bidder’s Response 2 The networks used in the proposed solution/service must be protected from external and internal attack. Do you confirm that your company (and any 3rd parties used) comply with this requirement, and are able to evidence it? Yes No Ref Requirement: Account provisioning and approval process Bidder’s Response 3 The proposed solution/service must include a user account provisioning process (account approval, creation, maintenance and deactivation), and a means of controlling privileged access. Link: Further detail and control examples Do you confirm that your company (and any 3rd parties used) comply with this requirement, and are able to evidence it? Yes No
Possible scenarios may include: Self-employed or business (0 to 9 employees) Small business (10 – 49 employees) with no designated IT function Simple IT configuration – single device storing ECC data. Simple IT configuration plus use of cloud services such as webmail or cloud storage containing ECC data. Simple IT configuration plus a third party provider processing or storing ECC data. Possible scenarios may include: Medium business (50 to 249 employees) Large organisation (250 + employees) Any size organisation with a designated IT function Likely to include servers, networks, end user devices and firewalls. More complex IT configuration with central management of services. Private or corporately managed cloud services used to store ECC data. parties providing additional services and processing or storing ECC data. Securing data in the Cloud and checking third parties Business Category Corporate IT Category A wide range of online services require users to transfer data to remote computing facilities – commonly known as the cloud. Data being processed in the cloud represents a risk because the personal data you are responsible for leaves your network and be processed in systems managed by your cloud provider. It is therefore important to check that they have security measures in place: Make sure you know what data is stored in the cloud, as modern computing devices, especially those targeted at consumers, can have cloud backup or sync services switched on by default. Ensure you know in country your cloud service provider hosts its data and whether the locations they use comply with the requirements of the Data Protection Act 1998. Check whether your cloud service provider complies with the CESG Cloud Security Principles Ensure that the CESG Cloud Security Principles are being adhered to. The principles are: Data in transit protection Asset protection and resilience Separation between consumers Governance framework Operational security Personnel security Secure development Supply chain security Secure consumer management Identity and authentication External interface protection Secure service administration
phishing emails and other malware or alerting them to the risks involved in posting information relating to your business activities on social networks. Encourage general security awareness within the organisation. A security aware culture is likely to identify security risks. Keep your knowledge of threats up-to-date by reading security bulletins or newsletters from organisations relevant to your business. Provide training to staff so they recognise threats such as phishing emails and other malware, and risks involved in posting information relating to business activities on social networks, and if so, how Based on: and IT Security guides for Small business, plus best practice Define and implement a process on providing and maintaining security awareness Ensure all users are aware of their information security responsibilities Define and implement a staff induction processes Provide staff training on Information Security and the responsibilities (including refresher training) Monitor the effectiveness of security training Define and implement a process that covers communicating new Cyber threats to the staff Encourage to formally assess and validate their Information Assurance skills. Promote an incident reporting culture Source – (HM Government) Requirement 9 – Information Security Incident Response and Recovery Small Business Category Corporate IT Category You should consider what actions you should put into should you suffer a data breach. Good incident management can reduce the damage and distress caused to individuals. Please read key point 3 on page 1 before considering the following: Examples Create an incident management plan, stating the actions to be taken in the event of an information security incident This requirement requires appropriate information security incident management controls to have been implemented and maintained on an on-going basis. Please read key point 3 on page 1 before considering the following: Examples: Establish an incident management capability that can address the full range of incidents that may occur, and includes senior management backing