Supporting DPIAs and breach management;
Maintaining related policies and procedures;
Coordinating progress towards Cyber Essentials certification.
All staff, councillors and system users are responsible for:
Complying with this policy and related procedures;
Protecting information they handle;
Reporting suspected security incidents or weaknesses immediately.
The Council adopts a risk-based approach to information security.
Security controls are informed by:
The nature and sensitivity of the information;
The potential impact of loss, unauthorised access or disruption;
The likelihood of threats and vulnerabilities;
Findings from DPIAs and incident reviews.
Access to Council information and systems is:
Restricted to authorised users only;
Based on role and business need;
Reviewed periodically.
Users must:
Use unique credentials;
Protect authentication details;
Log out or lock systems when unattended.
Personal email accounts must not be used for Council business. All Council business must be conducted using approved Council systems and email accounts.
The Council implements appropriate technical and organisational measures to protect devices and systems, including:
Secure configuration of Council-managed devices;
Patch management and updates;