darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-07 18:58:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

streamline navs & menus

Browse Source
This commit is contained in:
stvnrlly
2022-11-01 15:27:29 -04:00
parent a2f5bd2616
commit 14a8afee12
10 changed files with 52 additions and 195 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
app/templates/views/security.html
View File

@@ -23,22 +23,22 @@
</ul>
<p class="govuk-body">Any recipient data you upload is only held for 7 days.</p>
<p class="govuk-body">If you <a class="govuk-link govuk-link--no-visited-state" href="/features/email#send-files">send a file by email</a>, the file will be available for the recipient to download for 18 months.</p>
<p class="govuk-body">The Cabinet Office acts as data processor for Notify. Your organisation is the data controller.</p>
<h3 class="heading-small">Data Protection Act</h3>
<!-- <p class="govuk-body">The Cabinet Office acts as data processor for Notify. Your organisation is the data controller.</p> -->
<!-- <h3 class="heading-small">Data Protection Act</h3>
<p class="govuk-body">Notify complies with data protection law. To make sure it stays compliant, there are regular legal reviews of the service’s:</p>
<ul class="list list-bullet">
<li>privacy policy</li>
<li>terms of use</li>
<li>approach to data sharing</li>
</ul>
</ul> -->
<h2 class="heading-medium" id="technical-security">Technical security</h2>
<p class="govuk-body">Other technical security controls on Notify include:</p>
<!-- <p class="govuk-body">Other technical security controls on Notify include:</p>
<ul class="list list-bullet">
<li>compliance with National Cyber Security Centre (NCSC) Cloud Security Principles</li>
<li>protective monitoring to record activity, and raise alerts about any suspicious activity</li>
<li>using JSON Web Tokens, to avoid sending API keys when your service talks to Notify</li>
</ul>
</ul> -->
<h3 class="heading-small">Protect sensitive information</h3>
<p class="govuk-body">Some messages include sensitive information like security codes or password reset links.</p>
@@ -54,16 +54,16 @@
</ul>
<p class="govuk-body">If signing in with a text message is a problem for your team, <a class="govuk-link govuk-link--no-visited-state" href="{{ url_for('main.support') }}">contact us</a> to find out about using an email link instead.</p>
<h2 class="heading-medium" id="information-risk-management">Information risk management</h2>
<!-- <h2 class="heading-medium" id="information-risk-management">Information risk management</h2>
<p class="govuk-body">Our approach to information risk management follows NCSC guidance. It assesses:</p>
<ul class="list list-bullet">
<li>how Notify is built</li>
<li>the infrastructure Notify is built upon</li>
<li>support for the Notify service</li>
</ul>
<p class="govuk-body">This approach also applies to the service providers Notify uses to send messages.</p>
<p class="govuk-body">This approach also applies to the service providers Notify uses to send messages.</p> -->
<h2 class="heading-medium" id="how-we-manage-risk">How we manage risks on Notify</h2>
<!-- <h2 class="heading-medium" id="how-we-manage-risk">How we manage risks on Notify</h2>
<p class="govuk-body">Things we do to manage risks on Notify include:</p>
<ul class="list list-bullet">
<li>formal risk assessments based on <a class="govuk-link govuk-link--no-visited-state" href="http://www.iso.org/iso/catalogue_detail?csnumber=56742">ISO 27005:2011</a> and National Cyber Security Centre guidance</li>
@@ -71,15 +71,15 @@
<li>residual risk statement preparation and active management of the risk treatment plan</li>
<li>regular updates to the Privacy Impact Assessment</li>
<li>security impact assessments</li>
</ul>
</ul> -->
<h2 class="heading-medium" id="cabinet-office-approval">Cabinet Office approval</h2>
<!-- <h2 class="heading-medium" id="cabinet-office-approval">Cabinet Office approval</h2>
<p class="govuk-body">Notify has been assessed and approved by the Cabinet Office Senior Information Risk Officer (SIRO). The SIRO checks this approval once a year.</p>
<p class="govuk-body">Notify also has approval from the Office of the Government’s SIRO to host data within the EEA.</p>
<h2 class="heading-medium" id="classifications-and-security-vetting">Classifications and security vetting</h2>
<p class="govuk-body">You can use Notify to send messages classified as ‘OFFICIAL’ or ‘OFFICIAL-SENSITIVE’ under the <a class="govuk-link govuk-link--no-visited-state" href="https://www.gov.uk/government/publications/government-security-classifications">Government Security Classifications</a> policy.</p>
<p class="govuk-body">Notify does not process data classified as ‘SECRET’ or ‘TOP SECRET’.</p>
<p class="govuk-body">The Notify team has Security Check (SC) level clearance from <a class="govuk-link govuk-link--no-visited-state" href="https://www.gov.uk/government/organisations/united-kingdom-security-vetting">United Kingdom Security Vetting</a> (UKSV).</p>
<p class="govuk-body">The Notify team has Security Check (SC) level clearance from <a class="govuk-link govuk-link--no-visited-state" href="https://www.gov.uk/government/organisations/united-kingdom-security-vetting">United Kingdom Security Vetting</a> (UKSV).</p> -->
{% endblock %}