mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-07-25 10:29:14 -04:00
64 lines
2.6 KiB
HTML
64 lines
2.6 KiB
HTML
{% from "components/table.html" import mapping_table, row, text_field, edit_field, field %}
|
||
{% extends "withoutnav_template.html" %}
|
||
|
||
{% block per_page_title %}
|
||
Information risk management
|
||
{% endblock %}
|
||
|
||
{% block maincolumn_content %}
|
||
|
||
<div class="grid-row">
|
||
<div class="column-two-thirds">
|
||
<h1 class="heading-large">Approach to information risk management</h1>
|
||
|
||
<p>
|
||
The information risk management approach taken by GOV.UK Notify is aligned to the guidance provided by the
|
||
National Cyber Security Centre (NCSC) on GOV.UK.
|
||
</p>
|
||
|
||
<p>
|
||
The scope includes the risk assessment of:
|
||
</p>
|
||
|
||
<ul class="list list-bullet">
|
||
<li>the GOV.UK Notify technical solution, infrastructure and supporting operations</li>
|
||
<li>the text message, email, and letter service providers used by GOV.UK Notify</li>
|
||
</ul>
|
||
|
||
<p>
|
||
The ongoing information risk management activities include:
|
||
</p>
|
||
|
||
<ul class="list list-bullet">
|
||
<li>formal risk assessments using a methodology based on
|
||
<a href="http://www.iso.org/iso/catalogue_detail?csnumber=56742">ISO 27005</a>:2011
|
||
and supplemented by reference to NCSC standards and guidance documentation</li>
|
||
<li><a href="https://www.cesg.gov.uk/articles/check-fundamental-principles">CHECK</a>-based
|
||
IT Health Check (ITHC) testing (annual and on major change)</li>
|
||
<li>residual risk statement preparation and active management of the risk treatment plan</li>
|
||
<li>regular updates to the Privacy Impact Assessment</li>
|
||
<li>security impact assessments</li>
|
||
<li>legal reviews of the service’s Privacy Policy, Terms of Use and Data Sharing and Financial
|
||
Agreement to ensure Data Protection Act (‘DPA’) compliance</li>
|
||
<li>Office of the Government’s SIRO (OGSIRO) offshoring approvals to host data within the EEA</li>
|
||
<li>annual reviews of the risk acceptance status with the Cabinet Office Senior Information Risk Owner (SIRO)</li>
|
||
</ul>
|
||
|
||
<p>
|
||
Controls implemented for the GOV.UK Notify technical solution and operational support team include:
|
||
</p>
|
||
|
||
<ul class="list list-bullet">
|
||
<li>Data encryption in transit and at rest</li>
|
||
<li>Protective Monitoring</li>
|
||
<li>System administration staff SC cleared</li>
|
||
<li>Service subject to Cabinet Office and GDS security governance</li>
|
||
</ul>
|
||
|
||
<p>
|
||
Information within the GOV.UK Notify service is deemed to have a classification of ‘OFFICIAL’ under
|
||
the Government Security Classifications Policy.
|
||
</p>
|
||
|
||
{% endblock %}
|