Knowledgebase

1. Introduction

This policy is designed to be the overarching Information Management Policy for Mirata and is the primary policy under which all other technical and security policies reside.

The policy is designed to ensure that Mirata complies with all relevant compliance legislation in respect of information security. The policy will describe specific Mirata rules on information security and reference any subservient guidelines that will describe policy in more detail.

2. Policy Statement

The purpose and objective of this Information Management Policy is to protect Mirata information assets from all threats, whether internal or external, deliberate or accidental, it also describes measures to ensure business continuity, minimise damage and maximise return on investment. Information will be protected from a loss of: confidentiality, integrity and availability.

3. Scope

This policy is intended for all staff and any visitors using Mirata IT systems, data or any other information asset. For the purposes of this Policy the term “staff” will be taken to mean paid employees, volunteers, authorised associate members, honorary members and visitors to Mirata.

4. Roles and Responsibilities

• The Mirata Board is the designated owner of the Information Management Policy
• The Policy is approved by the Managing Directors of Mirata
• The Data Protection Officer for Mirata is Technical Director, Mark Remde
• The Information Management Manager for Mirata is Technical Director, Mark Remde
• The Information Guardian for Mirata is the Technical Director, Mark Remde
• The Caldicott Guardian for Mirata is the Director, Alyson Mayer
• The Data Controller for Mirata is the Director, Ian Mayer

Mirata is registered with The ICO, the UK’s independent body set up to uphold information rights:

• Registration Number: Z1558824

We will always supply copies of your data, free of charge; in a recognised open format should you require it.

• DUNS: 737160213 MIRATA LTD

• MIRATA LTD Organisation code: 8K993

We commit to the following five standards of data housekeeping:

• You can contact Mirata Ltd at any time, by phone, email, or in writing to request details of the data Mirata holds about you or your organisation
• You can make changes to, or delete, any of the data Mirata holds about you or your organization at any time
• We will only store your data for as long as is necessary, and we will delete your data once our relationship ends, or as long as is required legally
• We will always keep your data secure and maintain the highest security standards when managing and processing your data
• We will always document the way your data is updated, processed and controlled

5. Information Management Policy Ownership and Responsibility

The roles and responsibilities of the designated Information Security Manager are to manage information security and to provide advice and guidance on implementation of the Information Security Policy. The Designated Owner of the Information Security Policy has direct responsibility for maintaining and reviewing the Information Security Policy.

It is the responsibility of all staff to implement the Information Security Policy within their area of responsibility.

6. Audit and review

The Information Security Manager will be responsible for arranging and monitoring regular audits of all aspects of the Information Security Policy. The results of audits will be recorded and logged. Audits will be carried out no less than annually.

The Information Security Policy will be reviewed annually by the Information Security Manager and approved by the Mirata Board.

7. Regulatory and Legislative Requirements

The Information Security Policy is designed to ensure that all regulatory and legislative requirements will be met. Annex A provides a list of all relevant legislation and guidance to which this Policy refers.

8. Internet and Email Usage

All users of the Mirata network are required to be aware of the Mirata Policies and Business Guidelines available in the Mirata Knowledge base.

All Mirata staff and team members are expected to use IT resources in accordance with Policies and Business Guidelines available in the Mirata Knowledge base.

The use of email and the Internet within Mirata is overseen by the Information Security Manager. Every new member of staff will be required to meet with the Information Security Manager and have an IT induction before using Mirata systems.

All members of staff are expected to have read, understood and to adhere to this Policy. Breaches of any of the policy rules should be passed to the Information Security Manager.

9. Authentication and Authorisation

All members of staff will be issued with email accounts on the domain @mirata.ltd.uk. Staff, may apply for a server account subject to approval by the Information Security Manager. Passwords and accounts details must not be shared or disclosed to any third party. server accounts will only allow access to areas appropriate to the account holder’s job and responsibilities. Temporary visitors to Mirata will not be granted access to a server account. Physical access to the buildings and offices will only be allowed if accompanied by a member of the Mirata team.

10. Location Security

All external doors to Mirata working locations will be security locked at ALL times. Internal offices must be locked independently when not in use and offices that are involved in processing sensitive data will be subject to greater security processes, which will be detailed in individual project policy. Staff will be issued with USB cards and keys that are appropriate to their level of work. Staff are responsible for their keys and USB cards and to notify the Mirata admin team immediately in the event of loss. Staff must not share or give keys and USB cards to any third parties.

11. Network and Systems IT Security

The Mirata Information Security Manager audits and monitors the Mirata systems and has access to the administration systems. Full details of the structure, operation and responsibilities for the network and computer systems are contained in the Mirata Business Guidelines.

The Mirata Board will be responsible for authorising the System Level Security Policy and the Information Security Manager is responsible for ensuring that the systems are risk assessed, audited and tested.

12. Computers, Software and Hardware

Control measures for Mirata hardware and software are defined in the Mirata Business Guidelines. All staff are expected to have read and understood the Mirata IT Security Policy. Managers will ensure that their staff are adhering to the Mirata IT Security Policy. Any breaches will be reported in the first instance to the Information Security Manager.

13. Information Handling

All staff are required to understand and adhere to the Mirata confidentiality agreement when they commence employment. A copy of this agreement will be given to staff at the induction meeting. Staff are expected to comply with this agreement at ALL times.

The confidentiality agreement is enforceable in respect of both electronic and hard copy data files. Staff are expected at ALL times to observe due diligence and care when handling and processing ANY data.

All staff are required during the course of their employment to have taken part in self guided training in relation to the Data Protection Act 1998.

All projects will be subjected to a formal risk assessment which will include information and data handling.

Mirata provides cross cut shredders for the secure disposal of any hard-copy work that requires disposal.

14. Application Development and Validation

Any new software application should where practical be subject to validation and control. Proper risk assessment should be employed on all projects that are developing new applications.

15. Back-up and Archiving

All data must be archived appropriately when they are no longer required within Mirata.

Hard-copy data must be boxed, recorded and removed to offsite secure storage. The security level of offsite archive storage must be the subject of a risk assessment which takes into account the nature of the nature of the data to be stored.

Electronic data must not be archived unless all identifiers have been removed. Identifier data, if kept must be encrypted. The nature and security to be used on the archive data will be subject of a risk assessment and be of an appropriate level.

Back-up of all Electronic data is detailed in full in the Mirata Business Guidelines.

16. Exceptional Projects

Each project undertaken by Mirata will be subject to a full risk assessment both prior to start up and reviewed during the operation of the project. All Mirata projects will be subject to the level of Security as detailed in the Mirata Business Guidelines unless it is deemed upon risk analysis that the project requires a greater level of security.

Any Mirata project that is deemed to be “exceptional” will require a separate security policy and provision made to ensure that the data are secured appropriately. The Information Security Manager will be responsible for ensuring that the project specific security policy will be written, implemented, reviewed and tested.

Mirata staff must ensure that all projects are risk assessed and any exceptional requirements are notified to the Information Security Manager.

17. Encryption

Encryption will not be used on standard electronic storage unless a risk assessment highlights the need. If required Cryptographic controls will be complaint with the current international standards.

Staff wishing to take work away from Mirata for example taking a lecture to a conference will be required to store their work on an encrypted USB memory storage device.

No data of a sensitive nature and no personally identifiable data will be removed from Mirata systems under any circumstances.

18. Remote access and Home Working

Mirata staff are allowed to access non-sensitive data from approved locations. There is no access remotely to any of the drives that store sensitive data. Any member of staff wishing to work from home must fulfill the requirements supplied by the Information Security Manager.

19. Disaster Recovery and Business Continuity

Mirata has a disaster recovery plan in place and a risk assessment is in place and business continuity planning forms part of that plan. The plan will be reviewed annually.

20. Business Guidelines

The Mirata Knowledge website has been specifically designed to help you find the information you need. Whether you’re looking for detailed information about our business processes, live updates about our service status, or advice on developing web projects, then we are here to help you.

Annex A

Regulation and Governance: This policy was written with Reference to the following:

• The Computer Misuse Act (1990)
• The Data Protection Act (1998)
• The General Data Protection Regulation (GDPR) (EU) (2016)
• The Regulation of Investigatory Powers Act (2000)
• The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations (2000)
• The Freedom of Information Act (2000)