Do you ensure that staff and councillors have anti-virus software loaded and active on their devices at all times? Do you have appropriate policies regarding use of external hard drives or USB drives? Do you conduct regular penetration tests and / or red teaming, with appropriate analysis of results? Third parties Do you properly understand risks arising from third party service providers? Do you undertake due diligence before engaging third party service providers? Do you assess third parties for cyber security or data protection risks? Do you have obligations in your contracts with third parties requiring them to take steps to keep data secure? If you use cloud storage, do you have contractual rights to be notified quickly of potential security issues? Remote access/BYOD Do you require multifactor authentication where appropriate? Do you allow remote access? If so, do you have the right software and controls in place to ensure it is secure? Do you have policies to secure mobile devices? Is data encrypted on mobile devices? Can mobile devices be remotely wiped? If you use BYOD, do you apply restrictions to maintain security? User accounts / passwords Do you require unique user accounts? Do you require multifactor authentication where appropriate? Do you restrict administrator accounts to the minimum necessary? Do you require strong, hard to guess, passwords? Do you automatically prevent use of common passwords?
Do you ensure that staff and councillors have anti-virus software loaded and active on their devices at all times? Do you have appropriate policies regarding use of external hard drives or USB drives? Do you conduct regular penetration tests and / or red teaming, with appropriate analysis of results? Third parties Do you properly understand risks arising from third party service providers? Do you undertake due diligence before engaging third party service providers? Do you assess third parties for cyber security or data protection risks? Do you have obligations in your contracts with third parties requiring them to take steps to keep data secure? If you use cloud storage, do you have contractual rights to be notified quickly of potential security issues? Remote access/BYOD Do you require multifactor authentication where appropriate? Do you allow remote access? If so, do you have the right software and controls in place to ensure it is secure? Do you have policies to secure mobile devices? Is data encrypted on mobile devices? Can mobile devices be remotely wiped? If you use BYOD, do you apply restrictions to maintain security? User accounts / passwords Do you require unique user accounts? Do you require multifactor authentication where appropriate? Do you restrict administrator accounts to the minimum necessary? Do you require strong, hard to guess, passwords? Do you automatically prevent use of common passwords?
GDPR-TOOLKIT-NALC-February-2018-1.docx