9.1 How will you decide, of your staff (support, development etc.) need access to the BBC system and data? How will you manage that access and what controls are in place, to ensure that privileged access rights, will be restricted and controlled? (Description) 9.2 Will the User/Privileged access rights for your staff, be regularly reviewed? (Yes/No) 9.3 What system functionality will be in place, to enable BBC staff to manage access to the BBC system and data, including, what controls are in place, to ensure that privileged access rights can be restricted and controlled? (Description) 9.4 Please state what system enforced password settings are active for: Password Minimum Length/Complexity Password Change Interval Lockout (after incorrect password entries) Password aging/history Can you also state, what additional measures will be in place, to secure administrator accounts. (e.g. stronger passwords, 2FA or crypto keys required to access systems)? Can you confirm all default passwords have been changed? (Description) (Description) (Description) (Description) (Description) (Yes/No) Cryptography 10.1 Will any, or all BBC data,be encrypted at rest within the system? If yes, provide details of what data will be encrypted and of the strength and type of encryption used. (Yes/No) (Description) 10.2 Will password hashing be used within the system; if so where, to what standard and will any salting be used? (Yes/No) (Description) 10.3 Will BBC data be encrypted whilst in transit? If yes, provide details of when data will be encrypted and of the strength and type of encryption used. (Yes/No) (Description) 10.4 In the case of web based applications, will users of the application be required to login? Will this be over a secure link – e.g. HTTPS? (Yes/No) (Description) 10.5 Please describe any other planned data transfers / connections, between the users' browsers and the web application? e.g. Cookies, Form submissions etc Please explain how these data transfers will be secured in transit (e.g. HTTPS - SSL/TLS etc)? (Description) (Description)
Physical and Environmental Security 11.1 What physical measures will be in place, to protect BBC data that is stored: At your offices/location? At the data centre? E.g. CCTV, Coded Locks, Guards. How will these controls be managed and monitored? (Description) (Description) (Description) 11.2 Where will the servers be located, which will hold the BBC data? All in the UK Some in the UK are the rest?) None in the UK (where are they?) Will the servers be held in secure Server Rooms? Will any hardware be stored outside of locked server rooms? (Description) (Description) (Description) Operations Security 12.1 Is there a documented standard procedure followed, for building and hardening host machines? (Yes/No and Description) 12.2 Are these procedures periodically reviewed and kept in line with current best practice? (Yes/No) 12.3 Please outline your planned approach, to security patching of operating systems and applications that form part of the system. Please confirm, that critical and important security patches will be up to date. (Description) (Yes/No) 12.4 Please outline any anti-malware (antivirus, etc.) tools, that will be used to protect the system. (Description) 12.5 What firewalls and network/host protection measures, (e.g. IDS or IPS) will be in to protect BBC data? Describe how you will configure, maintain the above and monitor alerts generated. (Description) (Description) 12.6 Will the application collect, and/or host, any User Generated Content (UGC)? If so – describe the UGC in detail and explain what moderation approach will be applied? (Yes/No) (Description)