9.1 How will you decide, of your staff (support, (Description) development etc.) need access to the BBC system and data? How will you manage that access and what controls are in place, to ensure that privileged access rights, will be restricted and controlled? 9.2 Will the User/Privileged access rights for your staff, be (Yes/No) regularly reviewed? 9.3 What system functionality will be in place, to enable (Description) BBC staff to manage access to the BBC system and data, including, what controls are in place, to ensure that privileged access rights can be restricted and controlled? 9.4 Please state what system enforced password settings (Description) are active for: (Description) Password Minimum Length/Complexity Password Change Interval (Description) Lockout (after incorrect password entries) Password aging/history (Description) (Description) Can you also state, what additional measures will be in place, to secure administrator accounts. (e.g. stronger passwords, 2FA or crypto keys required to access systems)? (Yes/No) Can you confirm all default passwords have been changed? Cryptography 10.1 Will any, or all BBC data,be encrypted at rest within the (Yes/No) system? (Description) If yes, provide details of what data will be encrypted and of the strength and type of encryption used. 10.2 Will password hashing be used within the system; if so (Yes/No) where, to what standard and will any salting be used? (Description) 10.3 Will BBC data be encrypted whilst in transit? (Yes/No) If yes, provide details of when data will be encrypted (Description) and of the strength and type of encryption used. 10.4 In the case of web based applications, will users of the (Yes/No) application be required to login? (Description) Will this be over a secure link e.g. HTTPS? – 10.5 Please describe any other planned data transfers / (Description) connections, between the users' browsers and the web application? e.g. Cookies, Form submissions etc (Description) Please explain how these data transfers will be secured in transit (e.g. HTTPS - SSL/TLS etc)?
9.1 How will you decide, of your staff (support, development etc.) need access to the BBC system and data? How will you manage that access and what controls are in place, to ensure that privileged access rights, will be restricted and controlled? (Description) 9.2 Will the User/Privileged access rights for your staff, be regularly reviewed? (Yes/No) 9.3 What system functionality will be in place, to enable BBC staff to manage access to the BBC system and data, including, what controls are in place, to ensure that privileged access rights can be restricted and controlled? (Description) 9.4 Please state what system enforced password settings are active for: Password Minimum Length/Complexity Password Change Interval Lockout (after incorrect password entries) Password aging/history Can you also state, what additional measures will be in place, to secure administrator accounts. (e.g. stronger passwords, 2FA or crypto keys required to access systems)? Can you confirm all default passwords have been changed? (Description) (Description) (Description) (Description) (Description) (Yes/No) Cryptography 10.1 Will any, or all BBC data,be encrypted at rest within the system? If yes, provide details of what data will be encrypted and of the strength and type of encryption used. (Yes/No) (Description) 10.2 Will password hashing be used within the system; if so where, to what standard and will any salting be used? (Yes/No) (Description) 10.3 Will BBC data be encrypted whilst in transit? If yes, provide details of when data will be encrypted and of the strength and type of encryption used. (Yes/No) (Description) 10.4 In the case of web based applications, will users of the application be required to login? Will this be over a secure link – e.g. HTTPS? (Yes/No) (Description) 10.5 Please describe any other planned data transfers / connections, between the users' browsers and the web application? e.g. Cookies, Form submissions etc Please explain how these data transfers will be secured in transit (e.g. HTTPS - SSL/TLS etc)? (Description) (Description)
BBC_ISGC_Holding_Hosting_Form_v5_20140422.docx