Inventory of Assets

Inventory of Software and Hardware Assets

Ownership of Assets

All information and assets associated with information processing facilities will be owned by a designated individual within the organization. The asset owner will be clearly shown on the central asset register and be responsible for:

• Ensuring that information and associated assets are correctly classified
• Checking that access restrictions to the assets are being applied correctly.

Any risks to the asset are recorded and notified to the information security manager. Ownership for assets will be allocated to a nominated individual within the appropriate business area with responsibility for:

• A defined set of data
• An application
• A defined set of activities or processes

Acceptable Use Policy

Rules covering the acceptable use of assets will be clearly defined, documented and implemented. A separate Asset Management Policy document is available on the intranet to provide more detail on this subject.

Employees, contractors and third party suppliers using or having access to ThingLogix assets will be made aware of the acceptable use policy and will be responsible for their access to and use of those assets. The policy will cover all organizational assets and will specifically apply to:

• Electronic mail and internet usage
• The use of mobile devices and data taken outside of controlled premises

Classification guidelines

The assets will be classified into one of the categories stated in the tables below.

Information classification

Physical assets

Information assets

Information labelling and handling

All Protect or Restricted information should be marked in accordance with its classification so that it is clearly identifiable to staff handling it. Staff originating or receiving information from other organisations must ensure that it is correctly labelled as detailed in the table above. If there is any doubt then the question should be escalated, via line management, to the records and document management or information security teams.

Public

Although classed as ‘public’, this information should not be released without appropriate management approval and should normally only be published via the Marketing team

Protect

Information should not be released, discussed, shared or modified without appropriate authorisation.

No automatic ‘right of access’ to business sensitive information exists, all staff must consider the ‘need to know’ principle, and ensure it is applied.

Any anonymised or masked data, which is used for testing purposes, will be treated as business sensitive. The integrity of this data is paramount to ensure the results of testing undertaken are valid.

Restricted

No automatic ‘right of access’ to personal or sensitive information exists for any business team or function. Access to restricted data by staff is subject to appropriate authorisation and a legitimate business need or clinical relationship, also referred to as a Legitimate Relationship. Once the business need has been established for a team or department it may continue as a standing requirement, however this should be kept under review by senior management.

All sensitive information should (a single record can be as sensitive as a complete database) be handled in accordance with specific process and procedure documents which will apply as required. Each process/procedure will be subject to review and approval by the information security manager to ensure that the security controls applied are in line with Security policies.

Any electronic media or hard copy which includes restricted data should be clearly identified as such.

Restricted Data disclosure

Whilst restricted data is amongst the most sensitive information held and processed by Thinglogix, there may be occasions where it may or must be released to external individuals or authorities. Circumstances may include:

• To law enforcement agencies,
• As part of a Subject Access Request under the Data Protection Laws,
• By coroners offices,
• By individuals or teams responsible for safeguarding.

Data retention

1. ThingLogix does not processes any significant amount of data.
2. Whenever the retention schedule is used, the guidelines listed below should be followed:
   • Local business requirements/instructions must be considered before activating retention periods in the schedule.
   • Decisions should also be considered in the light of the need to preserve records, whose use cannot be anticipated fully at the present time, but which may be of value in the future.
   • Recommended minimum retention periods should be calculated from the end of the calendar or accounting year following the last entry on the document.