AIMS To raise awareness of some of the issues To offer advice on solutions To identify what might be considered as ‘best practice’ To launch new Policies and guidelines I was asked to choose a password with at least 8 characters in it ………

New Policies Information security management policy Incorporating: –Portable media policy –Reporting Information Security Events Policy –5 point Data Protection Breach Management plan –Remote Access agreement And other guidance documents –New starters / induction procedures –3 rd party access to data –Disposal of redundant equipment

Scenario 1 A request for information about a pupil is made by a Police officer relating to an alleged serious offence. The request is made over the phone. Can you give the officer the requested information 1)Over the telephone 2)At all?

Scenario 3 Sharing a teacher login on a classroom PC. Is this a Data Protection breach? Sharing a teacher login to SIMS on a classroom PC. Is this a Data Protection breach?

Scenario 5 A teacher takes home an unencrypted memory stick containing teaching resources and lesson plans. The teacher loses the memory stick. What are the implications for the school?

Scenario 6 A class teacher has written pupil reports and saved them to an unencrypted USB memory stick. The stick is lost on the school premises. What happens next?

Scenario 9 A school secretary is asked to fax a list of pupil names, addresses, dates of birth to a travel company hosting a school exchange visit. Is this appropriate? What procedure should be followed?

Data Breach Management Plan 1 Fundamental details: Location, Contacts, Incident outline; 2 Containment & Recovery: Recovery plan, Incident response, Damage limitation; 3 Data Risk Assessment: What type of information, How sensitive, Who is affected, Number, Consequences – serious? substantial? potential harm; 4 Notifications Who has been notified and notification evaluations 5 Evaluation/Conclusion Effectiveness of response, investigation, mitigating factors, improvements to risk management This is all about minimising the potential £ine the ICO may levy. 4A 4B 6