Author Click or tap to enter a date. Version X System Level Security Policy [Insert system name]

System Level Security Policy (template)

A system level security policy should be documented for all internally hosted systems on a NEL network that contain person identifiable information. The template below has been designed to help Information Asset Owner’s document the policy. – delete this paragraph once the template is completed.

1.	Governance and Roles
1.1	System Name
1.2	IAO and job title
1.3	IAA and job title
1.4	Caldicott Guardian
1.5	SIRO
1.6	Next review date	Review frequency
2.	Purpose of the system
2.1	Simple overview of the purpose of the system	Xxxxx system is used by NHS England xxxxx directorate/team for xxxxx
2.2	Scope/ access	The system has approximately 99 users. The systems is used by staff within xxxxx Data from the system is used to report activity to xxxxx
3.	Software
3.1	Details of software where applicable	The system is designed using xxxxx Licences are held by ? Number of licences ? A copy of the software is stored? at xxxxx…..
4.	Hardware
4.1	Details of hardware	The application is sited on xxxxx server which is located at xxxxxx
5.	Data Retention
5.1	Details of the data collected and recorded on the system	The data is required to be retained for xxxxx period. The information asset owner is responsible for ensuring that data is retained for the appropriate retention period and then deleted.
6.	Physical Security
6.1	Physical Security details	The server is located at xxxxx All users are required to comply with NHS England policies e.g. clear screen policy
7.	Access Control
7.1	Who is responsible for controlling access to the system	The xxxxx authorises all users to the system.
7.2	Who gives approval and what record is kept	Xxxxx. is responsible for setting up new users and this is recorded in xxxx
7.3	Are users given unique id’s/ Is there a system admin role	All users are given their own login and password. There are no generic codes.
7.4	Password length requirement	The minimum password length required is six characters. This is required to be a combination of xxxxx
7.5	Password changes	Users are forced to change their initial password Users are forced to change their password monthly
7.6	Inactivity log out	Users are automatically logged out after a period of inactivity
7.7	Procedure for when access is no longer required	Xxxxx is responsible for removing users who no longer require access
8.	Access Rights
8.1	Details of access rights	Access rights are documented and stored within a password protected document on xxxxx drive Different levels of access? Access rights will be reviewed on an annual basis by the Information Asset Owner.
9.	User Training
9.1	Details of any specific training	Xxxxx is responsible for user training Training will be provided xxxxx (frequency and content)
10.	Risk Assessment
10.1	Details of risk assessment and next review date	A risk assessment will be undertaken following the Information Asset Management procedure. This will be performed on an annual/ quarterly basis.
11.	Data Protection/Caldicott
11.1	Subject access requests/ functionality to respect objections/withdrawal of consent	Subject access requests can be met within 40 days in accordance with NHS England’s Data Protection Policy
11.2	Any specific requirements regarding consent and disclosures of information	Details of any consent forms etc.
12.	Relevant Legislation / Contractual Obligations
12.1	Details of any specific legislation e.g. Mental Capacity Act 2005, Children Act 2004
13.	Audit Trail
13.1	Details of any audit trails provided
14.	Data Quality
14.1	Details of any data quality requirements
15.	Data Backup
15.1	Details of any data backup arrangements
16.	Auditing Compliance
16.1	Details of who is responsible for auditing compliance. e.g. confidentiality audits	Audits are undertaken by xxxxx on a xxxxx basis.
17.	Security Incident Management and Reporting
17.1	Details of how to report an incident	All suspected or actual breaches of security regarding the system are to be reported to the Information Asset Owner who will report via NHS England’s incident reporting procedure if appropriate
18.	Business Continuity
18.1	Details of any business continuity plans.

Checklist for Third Party Supplier of Services

SUPPLIER INFORMATION
Supplier name:
Address:
Telephone number:
Name of key contact:
Telephone number and email address of key contact:
If your organisation is registered with the ICO please provide Data Protection Notification number:
Is your organisation compliant with the Information Governance Toolkit to Level 2: YES / NO
SERVICE TO BE SUPPLIED
Please describe the service which is to be provided:

CHECKLIST
1. What data will you be processing on our behalf?
2. Will you be processing at an NHS site? If so, where?
3. Will your staff have remote access to NHS England data? If yes, please explain.
4. Will you be storing any NHS England data in paper format for any length of time? If yes, how will the data be stored?
5. Will you be storing any NHS England data in electronic format?
6. If yes to Q5: - Do all users of your systems have their own log-in and password?
- How are access rights to systems controlled?
- Are back–ups encrypted?
- What protection do you have against malicious code?
- How often do you apply security patches?
- How often do you risk assess your security controls?
- What business continuity/disaster recovery plans do you have in place?
- Are USB ports/CD writers on staff equipment disabled?
- Will you be storing data outside the UK? If so, where? What information governance considerations have been taken into account?
- Will the data be linked with any other data collections? If so, how will the linkage be achieved?
7. What security controls do you have in place for your office premises?
8. What controls do you have in place for the security of your equipment?
9. Have you had any security incidents relating to data in the last three years? If so, please explain.
10. What policies do you have in relation to information security, data protection and incident reporting? Please provide copies.
11. Describe potential disciplinary actions for breach of policy.
12. What steps do you take to ensure that the people your recruit have the honesty and integrity to handle person identifiable data?
13. How do you ensure that your staff understand the importance of data security and how to keep person identifiable data secure?
14. How frequently do you provide your staff with any training on data security and confidentiality and is their learning tested?
15. Will you ever transfer NHS England data electronically? If so, how will it be transferred?
16. Will you ever transport any NHS England hard copy data? If so, what security controls will be in place?
17. Will you ever destroy any NHS England data? If so, how will this be done and what evidence of the destruction will you provide?
18. Will you ever sub-contract work in relation to NHS England data? If so, in what circumstances?
Date completed
Completed by
Telephone number and email address