Principle 8 - Control All Access to Data

Detail

All data should be assessed for sensitivity and risk, and appropriate controls must be implemented which adequately mitigate any identified risk. Risk mitigations to confidentiality, integrity or availability should be commensurate with the perceived level of impact of any compromise. This applies to all data whether stored, in memory or communicated between components of the service.

Consumer data transiting networks should be adequately protected against tampering and eavesdropping via a combination of network protection and encryption.

[expansion required]

Decision Evaluation Criteria:

• Has the proposed service undergone a detailed analysis of the Information Governance security requirements with respect to all data to be handled, processed or stored ?
• Has a Privacy Impact Assessment been completed and accepted by the SRO and SIRO identified in Principle 1
• Will proposed technology components support the security methods and approved algorithms appropriate to the identified control standards which relate to any data they be handling, processing or storing ?
• Are all the identified data security controls satisfactorily implemented in the delivered service ?

Basis

• NIST 9 - Protect information whilst be processed, in transit and in storage
• NIST 11 - Protect against all likely classes of 'attacks'
• GDS CSP 1 - Data in transit protection
• OWASP 7 - Cryptography at REST
• OWASP 9 - Data protection
• OWASP 10 - Communication protection