Security impact
High.
Description
Information should be
classified as Strictly Confidential when unauthorised disclosure,
alteration or destruction could result in either personal (or sensitive
personal) or internal service configuration data being divulged; this equates
to the University being at risk from Information Commissioner’s Office
sanctions under the Data Protection Act 2018 and should be considered as a high
risk.
A significant level of security controls should
be applied to Strictly Confidential information.
Examples
Payroll; student grades; disability,
health and wellbeing information; emergency contact details; notes relating to
disciplinary processes; research data containing
personal or high-value information; medical (including tissue) or clinical trial
research data (any other research data stipulated by contract or agreement to
be handled with utmost care); commercially sensitive business operations and
strategies.
Access control
Access controls must
be enforced from creation to destruction.
Viewing:
Limited to members of the
University, partner organisations (where covered by data sharing agreements)
and individuals, as authorised by Information Asset Owners (or their delegate)
on the basis that the individual requires such access in order to perform their
job (‘need-to-know’).
Cannot be disclosed to the
general public.
Unless only one person needs access to the data
(in itself an information risk), access must be granted to those individuals who
require it via security groups (role-based access).
Printing and copying:
Limited. Printing and
copying is only permitted by individuals in order to perform their duties and
where appropriate controls are in place to protect the hard copy from creation
to destruction.
Modification:
Limited. Authorisation
for modification by Information Asset Owner (or their delegate) required and
access granted as above for viewing.
Storage
Electronic:
Working copies of
documents can reside on an individual’s computer or mobile device (e.g., a
laptop computer). The device must be
encrypted using whole-disk encryption. Final or approved copies of documents
must be stored within a document management system or a shared storage area
with appropriate permissions added to prevent unauthorised access.
Cannot be stored in any personal cloud account.
Can be stored in the
University’s public cloud (i.e., Microsoft 365 environment) where not
contravening any license or contractual arrangements, with restrictions on who
can access the materials.
Cannot be shared publicly.
Can
be shared with partners with a non-disclosure agreement or contractual
confidentiality terms in effect between all of the relevant parties.
Sharing permissions must be approved by the
Information Asset Owner or their delegate.
Paper/hard copy:
In a locked or
otherwise secured storage unless it is in use.
Transmission and collaboration
Document or file encryption
required for electronic transmission. The University public cloud (Microsoft
365 services) provide encryption in transmission.
Any distributed documents
(electronic or paper) must be watermarked as ‘STRICTLY CONFIDENTIAL’
and the intended recipients clearly indicated; if watermarking is not possible
‘STRICTLY CONFIDENTIAL’ must be included in the document header, aligned
to the right of the page or within the document metadata.
Printed copies to be delivered in sealed envelopes
marked ‘Personal’ or ’Strictly Confidential’.
Retention
All information must be retained for the legally or
contractually required minimum and maximum periods of time. This will vary
depending on the type of information under consideration. Importantly, if you are unsure of the
retention period, please refer to the University’s Records Retention Schedule.
Disposal
Electronic:
Must comply with Retention
Schedule (see above).
On decommissioning of equipment used to store
the information, the storage must be securely sanitised following NCSC guidelines. An accompanying certificate of
destruction shall be obtained and stored by the person facilitating the
destruction.
Paper/hard copy:
Printed copies should
be cross-cut shred to DIN 66399
P-3 standard and
disposed of in confidential waste (blue) bags.
Training
General data
protection and information security awareness training mandatory for all
University and affiliate staff.
Refresher training
carried out every two years.
Applicable policy and
regulation training required.
User devices
Password protection required,
locked when not in use. Encryption required.
