| This content is a version of the ICT Security Policy, November 2012. This is Legacy IA Policy. It is under review and likely to be withdrawn or substantially revised soon. Please contact us before using this on a new project: itpolicycontent@digital.justice.gov.uk. |
The objective of ICT security is to ensure business continuity and minimise damage by preventing and reducing the impact of ICT security incidents. This policy applies to all MoJ’s ICT systems, including those managed by ICT service providers. It covers:
The purpose of this policy and ICT Security Policy Framework as a whole is to:
This policy covers the areas of information security for which MoJ ICT is responsible. The elements of the MoJ covered by this policy are:
MoJ may require access to audit logs in investigating incidents (investigations may be of a purely technical nature such as a virus incident, but may also include investigations into malicious behaviour). MoJ will comply with all relevant legislation and MoJ HR policy in its monitoring and auditing activities. As such, the MoJ will exercise its rights to ensure that its computer equipment and systems are used in a legitimate and lawful manner. This applies equally to MoJ ICT service providers.
MoJ ICT Security Policies must be maintained and reviewed on a regular basis to a schedule determined by the ITSO – This is currently annually for all policies in this policy set.
The MoJ ICT security policy and any supporting ICT security guides will be reviewed by the ITSO according to the following schedule and criteria:
The Cabinet Office mandates that all central government department ICT systems (which process protectively marked data) must be accredited in accordance with HMG Information Assurance standards and HMG security policy. All ICT systems must be subject to (at least) an annual technical risk assessment in accordance to HMG Information Assurance standard No. 1 & 2 and documentary evidence that the security risks have been assessed in accordance with the accreditation or reaccreditation process.
Assessment and the risk management decisions made must be recorded in a Risk Management and Accreditation Documentation Set (RMADS), using HMG Information Assurance Standard No. 1 & 2 - Supplement. The submitted RMADS document must provide justification and accountability for any management decisions taken regarding risk management.
As part of the MoJ approach to risk management, the potential impact of a successful attack on the Confidentiality, Integrity and Availability of the asset/s supported or processed by an ICT system is assessed in terms of business impact. The definition of an asset is taken from HMG Information Assurance Standard No.1 & 2:
Anything that has value to the organisation, its business operations and its continuity.
In the context of an ICT system, this includes (but not limited to) data, hardware, software and business services provided by the system.
HMG Business Impact Levels should be used as the bases for conducting a business impact assessment. The MoJ Accreditation Framework provides guidance and further information on how to conduct a business impact assessment and guidance on whether a PIA is required.
Documentary evidence must be:
MoJ ICT IA is responsible for reviewing all RMADS submissions before system accreditation is considered. It is the responsibility of the ICT service provider/s and ICT system manager/s to ensure that an RMADS document is generated, factually correct, complete and includes all the information required for an accreditation decision to be made. This includes details of any risk mitigating controls and residual risks.
The Accreditor (or delegate) may require further information, clarification or further documentary evidence regarding the submitted RMADS.
The foundation of good Information Security is the establishment and operation of an effective Information Security Management System (ISMS). Establishing an effective ISMS involves clearly defining the security management structure and the roles and responsibilities which sit within it.
The ICT security management structure falls within the overall MoJ security management structure.
The Permanent Secretary, as Accounting Officer, has overall responsibility for all aspects of security. The Departmental Security Officer (DSO) and MoJ SIRO support the Permanent Secretary by providing advice on personal, physical and information security policy and procedure. The Chief IT Security Officer (CISO) supports the DSO by providing advice on ICT security policy.
Identification, authentication and authorisation security controls are implemented by both technical controls within the ICT system and by procedural controls which are followed by users and administrators of that ICT System.
Where these security controls are implemented within the ICT system, the ICT Security – Technical Controls Policy provides further detail on the MoJ policy in this area.
For procedural controls, the ICT Security - Acceptable Use Policy provides details on the MoJ policy with regards to the usage of ICT systems.
For both technical and procedural controls, the ICT Security - Information Classification and Handling Policy sets the MoJ policy on how information assets must be handled by ICT systems (including users of those systems) and provides the context for the application of those controls.
Incident Management is the ability to react to different types of security incidents in a controlled, pre-planned manner. Preparation and planning are key factors to successful information security management and it is important that ICT security incident management is considered for every MoJ ICT system.
Forensic investigation is a component of incident management and allows the MoJ to respond to security incidents which require the collection, storage, analysis and preparation of digital evidence that may be required in legal or disciplinary proceedings. All:
Some ICT systems at the MoJ make use of HMG supplied cryptographic material. These systems are generally those which provide functionality to connect to 3rd party systems or protect information at rest on mobile devices (e.g. laptops).
Note: Information Assurance Standard No. 4 states that if HMG cryptographic material is handled, Departments and Agencies must appoint a Communications Security Officer (COMSO). The COMSO is responsible to the SIRO and DSO for ensuring the MoJ’s compliance with the minimum HMG Comsec and cryptography requirements, and developing, implementing and maintaining organisational communications. For further details on the use of HMG cryptographic material can be found in the MoJ ICT Security – Use of HMG Cryptography Policy.
Remote working means any working away from the office, whether from home, another MoJ or government office, whilst travelling, at conferences, in hotels, etc, while using ICT equipment to access and connect to ICT systems and services.
Mobile computing is the use of portable computing equipment. Remote working will usually involve the use of portable computing equipment, usually a laptop computer, but portable computing equipment is evolving rapidly and now includes personal electronic devices (PEDs), such as personal digital assistants (PDAs), Blackberry devices, functionally rich mobile ‘phones and palmtop computers which may include the functionality of mobile ‘phones, digital cameras, voice recorders etc as well as email, web browsing and other computing functionality.
For the MoJ IA strategy to be effective, it must be extended to organisations working on behalf of the MoJ, or handling MoJ assets such as contractors, offshore or nearshore managed service providers and suppliers of ICT systems.
All ICT assets (e.g. computers, laptop and removable media), must be appropriately disposed off to ensure MoJ data is not compromised when ICT assets are either redeployed or decommissioned.
Further information on asset disposal, in particular the procedural controls are provided in ICT Security - Acceptable Use Policy.
MoJ business groups are required to maintain Business Continuity Plans (BCPs) to ensure the prompt and efficient recovery of key business activities in the event of a disaster or other disruption affecting its premises or assets (including both staff and information).
As ICT systems support the majority of MoJ business activities, business continuity needs to be considered in their design and operation. Business continuity itself in ICT is split between ICT Incident Management and ICT Disaster Recovery.
Further details can be found in the ICT Incident Management Policy [Ref, 4] and ICT Disaster Recovery Policy.
MoJ ICT is not directly responsible for the physical security and environment of MoJ sites. However, physical security controls and the environment in which MoJ ICT systems operate form part of a systems overall risk landscape which is considered during the accreditation process.
Further information is available from Corporate Security and Business Continuity Branch.
MoJ ICT is not directly responsible for personnel security; this is the responsibility of MoJ Corporate Security. This includes aspects such as employee (including contractors and agency staff) joining, moving and leaving, and, assessment of security clearance levels.
However, the security controls associated with personnel form part of the risk assessment of an ICT system and may lead to addition controls being required.
Line managers are responsible for personnel security (of their staff/contractors), including starting, ongoing, and leaver arrangements, under a policy framework set by MoJ HR (recruitment and exit policies) and Corporate Security (National Security Vetting).
Further information is available from Corporate Security and Business Continuity Branch.
The MoJ Information Security Education and Awareness strategy is to ensure that users are provided with the necessary training to assist the MoJ in meeting its security objectives of:
Note: The MoJ Information Security Education and Awareness strategy is the responsibility of the Corporate Security and Business Continuity Branch. The Central IA Branch leads on Information Assurance training; Corporate Security provides training for security liaison officers in HQ and ALBs which includes aspects of physical, personnel and information security.
The MoJ Chief IT Security Officer (CISO) is responsible for ICT security within MoJ. The CISO is responsible for maintaining this policy (and ICT Security Policy Framework) and providing advice and guidance on its implementation.