• ISO 27001 at Oxford Brookes University

    We are working to achieve the globally recognised certification ISO 27001, with the scope of the project including all information created and held across the University.

    The benefits of the ISO 27001 framework include:

    • colleagues, students and parents can be confident that all University information captured and stored is validated by an internationally recognised framework
    • it ensures that a common set of policies, procedures and controls are in place to manage any risks to information security and to reduce the number of data breaches
    • it illustrates the University’s commitment to information security at all levels
    • improving the auditing and organisation of University information, making the operation more efficient
    • a training and awareness programme to help all colleagues, students and key stakeholders understand their responsibilities when handling personal or University data.

  • Information classification

    When creating any form of information on behalf of the University, content owners need to assign it one of the following categories:

    Information classed as public

    This information can be readily shared and made publicly available with no adverse consequences for any organisation or individual. Typical content might be:

    • news and updates
    • external website content
    • most policy documents
    • published research
    • published accounts
    • most personal correspondence.

    Information classed as restricted

    This information can be shared appropriately with a limited audience, usually but not exclusively within the University. Some of the features attributed to “Confidential” information apply, yet the implications associated with sharing this information are less serious. This information could be financial or commercial value, or be subject to intellectual property, trademark or other legal protection. It would be likely to include what is now called “Personal” Data. Typical content might be:

    • most professional correspondence
    • individual student marks and feedback
    • emails and documents containing limited personal data
    • policy, procedure and planning documents with technical or commercially sensitive information
    • non-confidential meeting agenda and minutes
    • pre-publication research data
    • most financial data.

    Information classed as confidential

    This information has a significant value for Oxford Brookes University, another organisation or individual. Wrongful disclosure could impact the reputation or standing of an organisation or an individual, the safety of an individual or could cause significant financial loss. Information of this type is shared on a “need to know basis” only.  This classification will include Special Category of Personal Data as defined in Data Protection Law. Large amounts of datasets of information which would otherwise be classified as “Restricted” were it a smaller amount, may become classified as “Confidential” by merit of the quantity of data involved. If in doubt as to whether a dataset is large, query this with the Information Security team by email using info.sec@brookes.ac.uk  Typical content might be:

    • emails and documents containing large amounts (200+ records) of student personal data - grades, names and addresses.
    • HR records
    • student wellbeing records
    • emails and documents that include special category personal data of staff and students - race, ethnicity, religion, health, political beliefs, genetic or biometric data, trade union membership, criminal convictions and sexual orientation.
    • materials received from third-parties that are proactively marked as ‘confidential’.

    • Information handling guidelines - typical senarios

      Please take a look at some typical senarios for classifying work-related information:

    • SCENARIO PUBLIC RESTRICTED CONFIDENTIAL
      Internal access Unrestricted dissemination via email or hard copy. Dissemination only to appropriate staff and affiliates. Access restricted to named individuals only.
      External access Unrestricted dissemination providing this doesn't violate any laws. Oxford Brookes should be identified as the source of the material. Information should be provided to third parties about who is allowed access to the information. Access restricted to named individuals only.
      SCENARIO PUBLIC RESTRICTED CONFIDENTIAL
      Storage  No restrictions. If appropriate to retain, information should be stored out of sight when not in use. Should not be stored in publicly accessible areas. Information should be stored in a securely locked drawer or cabinet when not in use.
      Sharing No restriction providing this doesn't violate any laws or regulations (eg copyright laws). Use internal mail system. Consider use of special or tracked delivery for external sharing. Use of sealed envelopes with recipient clearly named for internal post, consider use of hand delivery if appropriate. Courier or tracked delivery must be used for external sharing.
      SCENARIO PUBLIC RESTRICTED CONFIDENTIAL
      Internal  No security restrictions, communications or local procedures may apply. Ensure correct recipients are selected. Consider use of shared links to files instead of attachments if access control is required. Only send to colleagues @brookes.ac.uk addresses. Double check correct recipients are selected.  Local procedures may require checking by a second person. Email should be proactively labelled as 'confidential'. Only send to colleagues @brookes.ac.uk addresses. Use bcc where appropriate. Bulk confidential information should not be displayed in the body text of the email, use a password-protected attachment or Google Drive file link instead.
      External  No security restrictions, communications or local procedures may apply.

      Ensure correct recipients are selected. Non-disclosure or information sharing agreement may be required for sharing bulk data via email.

       

      Consider whether sharing such information by email is appropriate. Double check correct recipients are selected.  Email should be proactively labelled as 'confidential'. Use bcc where appropriate. Attached files must be encrypted and passwords communicated by a separate medium (eg by phone or text to a trusted mobile phone number.)

      Bulk confidential information must not be displayed in the body-text of the email.

      Consider use of secure (encrypted) email service, service should be approved by IT Services prior to use
      Bulk emailing Please read the bulk emailing guidelines.

      Please read the bulk emailing guidelines.

      Bulk emailing of confidential information should be avoided and must be approved by IT Services.
      SCENARIO PUBLIC RESTRICTED CONFIDENTIAL
      Internal storage No restrictions although local procedures may apply.

      Use access-controlled network shared drives or Google Drive. Information should not be stored on local computer drives (i.e. C: drive of laptop or desktop computer).



      		 Use network shared drives or Google Drive, access to files must be confirmed and regularly reviewed. Consider use of password protection / encryption for highly confidential documents. Further related guidance.

      External storage

      No restrictions although local procedures may apply. Use of centrally managed University services is recommended.

      Only use external / cloud hosted services approved by IT Services.

      Only use external / cloud hosted services approved by IT Services. Use of personal cloud storage accounts to store confidential data is strictly forbidden.
      File sharing No restrictions although local procedures may apply. Use of University email or centrally managed services ie Google Drive is recommended.

      Only use commercial or third-party file sharing services approved by IT Services. Contracts, non-disclosure or information sharing agreements may be required for sharing confidential data with third parties. Please check first with IT Services.

      Only use commercial or third-party file sharing services approved by IT Services. Contracts, non-disclosure or information sharing agreements are required for sharing confidential data with third parties.
      SCENARIO PUBLIC RESTRICTED CONFIDENTIAL
      Laptops No restrictions, data may be stored on University-owned or personal devices. Information should not be stored on local laptop drives unless necessary for business reasons and approved by the faculty or directorate data owner.  Use of personal laptops for using and storing restricted information is not recommended. Confidential information must only be stored on centrally managed laptops with appropriate drive encryption. For further details please speak to the IT Service Desk. 
      Mobile phones and tablets No restrictions, data may be stored on University-owned or personal devices.  Data may be stored on devices where access is authenticated using a PIN, password etc. Physical security of device should be ensured.

      Confidential data should only be stored on managed mobile devices with appropriate security verified by IT Services. Physical security of device should be ensured.
      USB and external drives No restrictions, data may be stored on University-owned or personal devices. 

      Drives must be encrypted to a minimum of AES128, check with IT Services if in doubt. For details of how to encrypt removable drives please see here or speak to the IT Service Desk.

      Storage of confidential data on USB and external drives is not recommended and the approval of IT Services and Faculty / Directorate data owner must be sought before use. Drives must be encrypted to a minimum of AES128, please check with IT Services if in doubt. For details of how to encrypt removable drives please see here or speak to the IT Service Desk.
      PUBLIC  RESTRICTED CONFIDENTIAL
      No restrictions. Consideration should be given to who may overhear conversations and if it is appropriate to discuss subject matter with the individual.  Calls and conversations regarding confidential data should not be held in locations where non-authorised individuals may overhear them.
      PUBLIC  RESTRICTED CONFIDENTIAL
      Websites should use https and be approved by IT Services or the central web team before being published. Websites should use https, include appropriate access controls and be approved by IT Services or the central web team before being published.

      Websites must use https and appropriate authentication and access control. They must be approved by IT Services before being published.
      PUBLIC  RESTRICTED CONFIDENTIAL
      No security restrictions, local procedures may apply. Wastepaper should be disposed of using University provided secure waste disposal facilities. If off-site, a cross-cut shredder should be used. IT Services will arrange secure disposal of data-bearing electronic devices. 

      To request secure disposal of an IT asset please use the IT web portal.

      		 Wastepaper should be disposed of using University provided secure waste disposal facilities. If off-site, a cross-cut shredder should be used. IT Services will arrange secure disposal of data-bearing electronic devices, self disposal of devices is strictly forbidden. To request secure disposal of an IT asset please use the IT web portal.
      PUBLIC  RESTRICTED CONFIDENTIAL
      No labelling required. Information should be labelled as 'restricted' or 'internal use only'. Information must be proactively labelled as 'confidential'.