Terminology Term Meaning/Application This term is used to state a Mandatory requirement of this policy This term is used to state a Recommended requirement of this SHOULD policy MAY This term is used to state an Optional requirement Policy The Information Security Policy outlines the approach, methodology and responsibilities for preserving the confidentiality, integrity and availability of <insert name of organisation> information. It is the overarching policy for information security and supported by specific technical security, operational security and security management policies. It supports the 7 Caldicott principles and 10 data security standards. This policy covers: Information Security Principles. Governance outlining the roles and responsibilities. – Supporting specific information security policies Technical Security, – Operational Security and Security Management. Compliance Requirements. [This section aims to outline why the policy is required and the main drivers for it.] Information Security Principles The core information security principles are to protect the following information/data asset properties: Confidentiality (C) protect information/data from breaches, unauthorised – disclosures, loss of or unauthorised viewing. Integrity (I) retain the integrity of the information/data by not allowing it to be – modified. Availability (A) maintain the availability of the information/data by protecting it – from disruption and denial of service attacks. In addition to the core principles of C, I and A, information security also relates to the protection of reputation; reputational loss can when any of the C, I or A properties are breached. The aggregation effect, by association or volume of data, can also impact upon the Confidentiality property. For the NHS, the core principles are impacted, and the effect aggregated, when any data breach relates to patient medical data. [This section describes the main information properties and the additional issues of the impact on confidentiality of aggregated data, either by association or volume, and the requirement to consider reputational impacts.]
Terminology Term Meaning/Application This term is used to state a Mandatory requirement of this policy SHOULD This term is used to state a Recommended requirement of this policy MAY This term is used to state an Optional requirement Policy The Information Security Policy outlines the approach, methodology and responsibilities for preserving the confidentiality, integrity and availability of <insert name of organisation> information. It is the overarching policy for information security and supported by specific technical security, operational security and security management policies. It supports the 7 Caldicott principles and 10 data security standards. This policy covers: Information Security Principles. Governance – outlining the roles and responsibilities. Supporting specific information security policies – Technical Security, Operational Security and Security Management. Compliance Requirements. [This section aims to outline why the policy is required and the main drivers for it.] Information Security Principles The core information security principles are to protect the following information/data asset properties: Confidentiality (C) – protect information/data from breaches, unauthorised disclosures, loss of or unauthorised viewing. Integrity (I) – retain the integrity of the information/data by not allowing it to be modified. Availability (A) – maintain the availability of the information/data by protecting it from disruption and denial of service attacks. In addition to the core principles of C, I and A, information security also relates to the protection of reputation; reputational loss can when any of the C, I or A properties are breached. The aggregation effect, by association or volume of data, can also impact upon the Confidentiality property. For the NHS, the core principles are impacted, and the effect aggregated, when any data breach relates to patient medical data. [This section describes the main information properties and the additional issues of the impact on confidentiality of aggregated data, either by association or volume, and the requirement to consider reputational impacts.]
information_security_-_example_policy_230517.docx