Assign appropriate security classifications to your information and label your information to reflect your agreed information classification scheme.
Options to consider:
- Take into account the requirements of confidentiality, integrity and availability of personal information when you assign classifications.
- Document security classifications within an applicable policy that you communicate to all staff.
- Assign accountability for classifications to Information Asset Owners.
- Review classifications to ensure they remain appropriate and keep a record of reviews.
- Conduct dip sampling to check whether you apply security classifications appropriately and feed results back to staff.
- Provide detailed guidance for staff on how to assign security classifications, including examples.
- Implement a procedure for information labelling that covers both physical and electronic information.
- Ensure electronic information records sufficient metadata that helps to identify, manage and control personal information.
- Provide training to staff on how to correctly label information.
- Conduct dip sampling to check whether you are labelling information correctly and feed results back to staff.
Use appropriate methods for deletion when disposing of electronic data containing personal information you no longer require.
Options to consider:
- Have a retention schedule for all electronic data and review it on a regular basis.
- Implement safeguards for technical changes that may prevent future access to long-term data (eg obsolete formats and the potential deterioration of storage media).
- Include clauses in contracts and agreements with third parties that cover the secure deletion of information when terminating the contract.
- Securely store and lock down information that you cannot delete due to system functionality restrictions.
- Use deletion software to ensure information is deleted securely and cannot be recovered by specialist recovery or forensic tools.
Have procedures in place to protect personal information processed through your employees’ own devices (BYOD).
Options to consider:
- Have a separate policy that covers the secure configuration and acceptable use of your employees’ own devices.
- Provide staff with clear instructions on the physical security of their devices and rules about:
- installing software;
- using endpoint device software;
- applying security updates; and
- connecting to public networks.
- Risk assess the use of BYOD before you implement it.
- Train all your staff on using BYOD.