Home working computer security policy

Transcription

1 Home working computer security policy Issue sheet Document reference NHSBSAIS005 Document location Title Author Issued to Reason issued Home working computer security Head of Security and Information Assurance All NHSBSA staff For information/action Last reviewed December 2017 Review cycle Annual Date of Equality Assessment March 2018 Date of Fraud Review March 2018 Revision details Version Date Amended by Approved by Details of amendments /01/2015 J. Belshaw J. Belshaw New document /02/2015 J. Belshaw J. Belshaw Business need and paper document disposal /07/2017 M Compton GDPR (section 3) and using landline telephone for business communications question (Annex 1) /12/2017 ISRS Reviewed for ISMS

2 Home working computer security 1. Scope This policy applies to all persons employed by the NHS Business Services Authority (NHSBSA) who may be required to, or have the opportunity to, work from home. In all cases homeworking should only be considered when there is a defined business need. The NHS BSA Acceptable Use Policy and the NHSBSA Mobile Computing Policy also applies to homeworking. The aim of the policy is to ensure that staff are given the relevant support to ensure they are aware of what is acceptable use of any computer system owned or operated by the NHSBSA and therefore can apply procedures accordingly. This policy applies to all business areas of the NHSBSA and compliance with its principles is mandatory for computer users accessing any computer system owned and / or operated by the NHSBSA or on its behalf by a third party. Its application extends to the use of all such equipment wherever situated and includes home workers. Home workers fall into two categories: Routine home workers - A home worker is an employee who routinely works from home normally for a minimum of one day a week. Occasional / ad hoc home workers - Employees who are not technically recognised as home workers but who may, when appropriate, request permission from their line manager to work from home on an ad hoc basis. In applying this procedure, care will need to be applied to the handling of paper documents. Where there is a business need for the home worker to print and/or handle paper documents which contain confidential information then the disposal needs of those documents also needs to be considered. Either the home worker will be required to bring these paper documents into the office for disposal or the home worker is supplied with the means to securely dispose of the paper documents i.e. using a NHSBSA supplied shredder. Under no circumstances should this type of waste paper be thrown away with normal rubbish. Shredded paper may then be disposed of with normal rubbish. In applying this policy, the NHSBSA will have due regard for the need to eliminate unlawful discrimination, promote equality of opportunity, and provide for good relations between people of diverse groups, in particular on the grounds of the

3 following characteristics protected by the Equality Act (2010); age, disability, gender, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, and sexual orientation, in addition to offending background, trade union membership, or political affiliation. In accordance with our Equality Analysis Procedure, an equality analysis has been undertaken on this policy. 2. Responsibilities The NHSBSA Senior Management Team is responsible for: ensuring that all arrangements for the computer security used by employees are risk assessed and are suitable and sufficient ensuring that the appropriate training and information is provided for employees maintaining any work equipment supplied by the NHSBSA Line managers are responsible for: ensuring that the requirements of this procedure are adequately implemented and maintained the provision of adequate supervision and management of home workers Employees working at home: As the supervision that can be exercised over an employee working from home is limited, home workers must ensure that they are aware of what is acceptable use of any computer system owned or operated by the NHSBSA and therefore can apply procedures accordingly. Employees working at home are responsible for: complying with risk control measures, training and instruction reporting any computer security concerns to their managers as soon as possible 3. References NHS BSA Acceptable Use Policy Computer Misuse Act 1990 (CMA) Copyright, Design & Patents Act 1998 Criminal Justice Act 1988 General Data Protection Regulation - GDPR Freedom of Information Act 2000 Obscene Publications Act 1959 Protection from Harassment Act 1997 Regulations of Investigatory Powers Act 2000 Telecommunications Act 1984

4 The Children Act 1978 The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 Equality Act (2010) 4. Appendix Home working computer security assessment checklist - Appendix 1 - has been developed to enable a consistent approach in these assessments across the business. The employee s line manager has the responsibility to ensure that the assessment is undertaken and all remedial actions are addressed prior to the employee starting to work from home. 4.2 The assessment of the proposed area of work and equipment (including NHSBSA equipment) in the employee s home shall be carried out to ensure the protection of the information assets (e.g. any computer system) owned and used by the NHSBSA, from all threats, whether internal or external, deliberate or accidental and to meet all regulatory and legislative requirements. This risk assessment can be a self-assessment if agreed between the employee and their manager. 4.3 Photographs of the work area and workstation must be provided by the employee to the line manager along with the completed assessment. The line manager is responsible for sign off / acceptance of the risk assessment and any remedial actions. 4.4 The assessment should be repeated if the work area within the home changes significantly i.e. the employee moves house or wishes to change the work area. The assessment should be reviewed on an annual basis by the line manager. 4.5 The employee should retain the original signed assessment within the home work area. The line manager must a signed scanned copy to the Security and Information Assurance Team at nhsbsa.informationsecurity@nhs.net. 4.7 If further information is required at any time, please contact the Security and Information Assurance Team. 4.8 Right to enter - As part of the home working arrangements the NHSBSA reserves the right to require reasonable access to an employee s home, to ensure it meets Acceptable Use Policy requirements and to install, maintain, check and collect equipment or material that belongs to the NHSBSA.

5 5.1 Insurance and additional costs Home workers working under this procedure, with the knowledge and consent of their line manager, are covered by the NHSBSA s insurance arrangements for any NHSBSA equipment Employees who receive approval to work from home are responsible for checking the arrangement with their home insurance provider and, if applicable, taking out an appropriate policy to cover any additional risks. Note: The majority of household insurance policies provide for home working that is classed as administrative The NHSBSA will not accept liability for damage caused to the home or its contents The NHSBSA shall not meet any additional costs of insurance or pay any additional lighting or heating costs etc Employees working from home are responsible for any tax, tenancy implications or mortgage agreements arising out of home working. It is strongly recommended that employees investigate any likely tax and mortgage implications and check any tenancy agreement prohibitions before they commence any home working arrangement Employees may be required by their line manager to provide confirmation that they have taken or have the appropriate insurance cover before they can commence working from home.

6 Appendix 2 Home workers computer security assessment checklist Complete the checklist and highlight any additional actions that may be required with your line manager. Your line manager is responsible for approving that all computer security requirements are complete before you start working from home. A copy of the assessment must be forwarded to the Information Governance (IG) Team at nhsbsa.informationsecurity@nhs.net Full name: Postal address: Managers name and contact number: Date of assessment: Home Tel: Building Construction 1. Is the work area in a building constructed of substantial materials, e.g. bricks and mortar? Door and Windows 2. Can access to the building be secured e.g. via locked doors with a thief resistant lock? 3. Are there locks on any easily accessible windows that can be opened? Work areas 4. Can the workstation be overlooked? 5. Is the work area left with a clear screen and desk when not occupied? 6. Do you have lockable storage to store confidential documents? Please tick Yes No Guidance/comments The building must be able to resist forced entry through walls, roof and floors otherwise it is not suitable for homeworking. The building should be secured when not occupied with doors fitted with thief resistant locks stamped with a British or European Standard Kitemark otherwise it is not suitable for homeworking The windows should be secured from the inside when the work area is not occupied. Window locks or latches should be thief resistant with a British or European Standard Kitemark otherwise it is not suitable for homeworking If the workstation can be overlooked by others then a screen filter must be used. You must be familiar with and apply the clear screen and desk policy as stipulated in NHSBSA Acceptable Use Policy The workstation (e.g. laptop or tablet) and any printed documents should be locked away in suitable storage when not in use. 7. Do you have a need for a printer? If your line manager has allowed you to use a home based printer then the printer should be used exclusively for the homeworker. If this is not possible then the homeworker must ensure they retrieve printed material immediately.

7 Work areas 8. Do you have a need for a shredder? Please tick Yes No Guidance/comments The disposal of waste paper which contains confidential information must be accomplished by either taking the documents into the office for disposal or shredded using a BSA supplied shredder. Under no circumstances should this type of waste paper be thrown away with normal rubbish. 9. Will you be using a landline telephone for business communications? All telephone sockets apart from the one used for business communications must be disconnected, except where use of the sockets could not take place unobserved Network Security 10. Does your workstation have upto-date antivirus software installed? 11. Does your workstation have remote access software software installed? Ensure that your workstation has antivirus software installed and the virus definitions are up to date before commencing homeworking duties. In order to access NHSBSA network drives (e.g. S: ) your workstation should have Cisco AnyConnect Secure Mobility Client and ActivIdentity Soft Token installed before commencing homeworking duties. No work should be undertaken at any point without a connection to the VPN. 12. Please enter any other comments you wish to make about your work activities or home work environment and attach a photograph of the home work area. Signed (employee): Date:

8 To be completed by line manager Line Manager Name: Job Title: Assessment acceptable YES NO Additional action: Action by: Date by: Complete: Controls/actions implemented to reduce the risk to an acceptable level YES NO Further Comments: Signed: Date: Review Date: