Cybersecurity and Information Security Policy

26 August 2020
0 views

Principles

DGA sets requirements for the use, maintenance and protection of its assets that are appropriate to its operations. Maintenance and protection are directed toward security, based on the principles of confidentiality, integrity and availability described below.

Confidentiality means protecting assets against unauthorised access, including unauthorised disclosure and distribution. Both physical and technical controls are required. Unauthorised persons must be prevented from accessing assets, and assets must be classified with clear protection levels so that custodians can handle them appropriately.

Integrity means protecting assets from intentional or unintentional alteration by anyone without permission to make changes. Controls must define editing and access rights and include checks using both asset inventories and technical methods.

Availability means ensuring that authorised users can access assets whenever needed, whether physical or technological. For example, email systems must be continuously available so users can send and receive messages whenever necessary.

Implementation Policy

  1. DGA conducts a risk assessment at least once a year and whenever significant changes occur. Assessments consider the internal and external context, interested parties, the agency’s vision and mission, changes to cybersecurity systems, risks and relevant international standards.
  2. DGA defines acceptable and unacceptable risk criteria to guide the management of risks identified in assessments.
  3. DGA reviews the policy at least annually or when significant changes occur.
  4. DGA maintains a cyber threat response plan to prepare for and respond to cybersecurity incidents.
  5. DGA assesses the effectiveness of its policy and uses the results to improve its policy and strategic plans in line with current and potential future threats.
  6. DGA provides sufficient funding, personnel and technology management resources for its security operations.

Cybersecurity Organisation

DGA establishes controls, supervision and monitoring for cybersecurity duties across internal units. It also provides guidance on controlling computing devices and working away from the office under its Information and Cyber Security Policy. This is divided into two areas.

  1. Internal Organisation. DGA defines roles, duties and responsibilities for the appropriate and secure use of information technology systems.
  2. Computing Device and Teleworking Policy. This policy protects the security of computing devices and work carried out outside the office.

Human Resources Security

DGA selects, trains and supervises personnel appropriately throughout their employment so they understand their responsibilities for protecting the agency’s data and information systems. This covers the periods before and during employment, changes of role and termination of employment.

Asset Management

DGA identifies its critical assets and assigns responsibility for protecting them against threats, vulnerabilities, intrusion, theft and other potential damage. This includes the following policies.

  1. Asset Management Policy. DGA identifies critical assets and assigns appropriate responsibility for protecting them.
  2. Information Classification Policy. Information is protected at a level appropriate to its importance to DGA.
  3. Storage Media Management Policy. This policy prevents the unauthorised disclosure, alteration, deletion or destruction of information assets.

Access Control

DGA restricts access to information systems to authorised persons to prevent disclosure or theft of information and equipment and to secure its operations. Its policies include the following.

  1. Information Systems Access and Use Policy. DGA establishes rules governing access to data and use of its information systems and protects data and information from unauthorised access.
  2. Operating System Access Control Policy. This policy protects operating systems and prevents unauthorised access to them.
  3. Application and Information Access Control Policy. DGA establishes rules to prevent unauthorised access to its applications and information.

Data Encryption

DGA establishes guidelines for data encryption so that its information systems effectively and appropriately preserve confidentiality, authenticate users and prevent unauthorised alteration of data.

Physical and Environmental Security

DGA establishes controls, safeguards and security standards for access to buildings, premises and areas where information systems are used. The controls take into account the importance of equipment and data as valuable assets that may require confidentiality. They apply to users and external service providers.