information or data for as long as may include establishing a required. process where the approval and associated information or data is either manually or automatically captured in a compliant information management system. Continue to Q2. Question Considerations Y/N For responses For responses ‘Yes’ ‘No’ 2 Encryption Encryption should only be used on a Ensure the policy and Continue to Q3. Will the approval and associated information limited where required, for procedures for decryption or data be encrypted? example with sensitive or high-risk are documented and processes, or as required by accessible. legislation. Encryption will typically take at a Ensure encrypted system level. You should speak with information or data is your ICT security advisor or system accessible to those who administrator if you are unsure if the require it by implementing approval and supporting information appropriate procedures and or data is or will be encrypted in the controls for data recovery in system. line with the Information If encryption is used, you must be Security Manual able to maintain access to the information on information or data for as long as cryptography. needed, including being able to decrypt at a later point. Continue to Q3. Metadata can verify the encryption and decryption process.
information or data for as long as required. may include establishing a process where the approval and associated information or data is either manually or automatically captured in a compliant information management system. Continue to Q2. Question Considerations Y/N For ‘Yes’ responses For ‘No’ responses 2 Encryption Will the approval and associated information or data be encrypted? Encryption should only be used on a limited where required, for example with sensitive or high-risk processes, or as required by legislation. Encryption will typically take at a system level. You should speak with your ICT security advisor or system administrator if you are unsure if the approval and supporting information or data is or will be encrypted in the system. If encryption is used, you must be able to maintain access to the information or data for as long as needed, including being able to decrypt at a later point. Metadata can verify the encryption and decryption process. Ensure the policy and procedures for decryption are documented and accessible. Ensure encrypted information or data is accessible to those who require it by implementing appropriate procedures and controls for data recovery in line with the Information Security Manual information on cryptography. Continue to Q3. Continue to Q3.
DigitalAuthorisationsFramework-August2018.docx