A conceptual model for classifying information based on its sensitivity, and the approaches required to protect it based on that classification.
All Decisive Analytical Systems employees who come into contact with sensitive internal information are expected to familiarize themselves with this data classification policy and to consistently apply it in their daily business activities.
Sensitive information is either Confidential or Restricted, both defined below. Although this policy provides overall guidance, Decisive Analytical Systems employees are expected to apply and extend these concepts to fit the needs of day-to-day operations. This document provides a conceptual model for classifying information based on its sensitivity, and an overview of the required approaches to protect information based on that classification.
Addresses Major Risks — this data classification system, combined with the policies defined in this document, protects information from unauthorized disclosure, use, modification, and deletion.
Applicable Information — this policy applies to all electronic information for which Decisive Analytical Systems is the custodian.
Need to Know — each requirement in this document is based on the concept of need to know. Where it's unclear how a requirement should apply to a particular circumstance, employees must conservatively apply the need-to-know concept: information is disclosed only to people who have a legitimate business need for it.
System Access Control — proper controls authenticate the identity of users and validate each user's authorization before allowing access to information or services. Data used for authentication is protected from unauthorized access, and only personnel with proper authorization and a need to know are granted access to systems and their resources. Remote access is controlled through identification and authentication mechanisms.
Access Granting Decisions — access to sensitive information is provided only after the written authorization of the Data Owner. Access requests are presented to the data owner using the Access Request template; custodians must refer all requests to the relevant Owners or their delegates. The list of individuals with access to Confidential or Restricted data is reviewed for accuracy by the relevant Data Owner in accordance with a system review schedule approved by the VP or Head of Infrastructure.
Owners & Production Information — all electronic information managed by Decisive Analytical Systems must have a designated Owner, typically at the VP level or above. Owners are responsible for assigning appropriate sensitivity classifications; they don't legally own the information, but act as stewards who supervise how it is used and protected.
Owners & Access Decisions — Data Owners decide who is permitted access to information and the uses to which it will be put, and must ensure appropriate controls are used in its storage, handling, distribution, and regular usage.
Storage media containing sensitive (restricted or confidential) information must be completely emptied before re-assigning to a different user or disposing of it — simply deleting the data is not sufficient; a method must be used that completely erases all data. Media that cannot be completely erased must be destroyed in a manner approved by the Head of Infrastructure.
Removable Media — staff may only use company removable media in their work computers, and may not connect it to non-company computers without explicit permission from InfoSec. Sensitive information stored on removable media must be encrypted in accordance with the Acceptable Encryption Policy. Exceptions may be requested on a case-by-case basis through company exception procedures.
Data Center Access — access to the data center must be physically restricted in a reasonable and appropriate manner.
Facility Access — all network equipment and servers located in the corporate office and other facilities must be secured (locked, denying access to unauthorized personnel) when no personnel or authorized contractors are present.
If Restricted information is stored on a personal computer, portable computer, personal digital assistant, or other single-user system, the system must conform to data access control safeguards approved by Decisive Analytical Systems and Corporate senior management. Users must not leave such a machine unattended without logging off, invoking a password-protected screen saver, or otherwise restricting access.
Data Encryption Software — employees and vendors must not install encryption software to encrypt files or folders without express written consent of Decisive Analytical Systems Security.
Transmission Over Networks — if Restricted data is transmitted over any external communication network (email systems, the Internet, etc.), it must be sent only in encrypted form, using a virtual private network or similar software approved by the Information Security Team.
Transfer to Another Computer — before Restricted information is transferred between computers, the person making the transfer must ensure the destination computer's access controls are commensurate with the originating computer's. If comparable security cannot be provided, the information must not be transferred.
Secure Storage of Object & Source Code — code for system software must be securely stored when not in use by the developer. Developers must not have access to modify program files that run in production; changes are implemented into production by Technical Operations. Unless access is routed through an application interface, no developer has more than read access to production data, and any changes must follow the change management process.
Testing — developers must at least perform unit testing; final testing is performed by the Quality Assurance team or the target user population.
Backup — sensitive data is backed up regularly, and backup media is stored in a secure environment.
Protection of Keys — public and private keys are protected against unauthorized modification and substitution.
Procedures — procedures are in place to ensure proper generation, handling, and disposal of keys, and destruction of outdated keying material.
Safeguarding of Keys — procedures are in place to safeguard all cryptographic material, including certificates; Decisive Analytical Systems Security is given copies of keys for safekeeping.