Clear Desk and Screen

Transcription

1 Example Policy Author: A Heathcote Date: 24/05/2017 Version: 1.0 Copyright 2017 Health and Social Care Information Centre. The Health and Social Care Information Centre is a non-departmental body created by statute, also known as NHS Digital.

2 Contents 1 Purpose 3 2 Scope 3 3 Applicability 3 4 Guidance 3 Terminology 3 Policy 3 Clear Desk Policy 4 Clear Screen Policy 5 5 Key Words 5 Copyright 2017 Health and Social Care Information Centre. 2

3 1 Purpose The purpose of this Clear Desk and Screen Example Policy is to provide exemplar guidance in line with HMG and private sector best practice for the production of a Clear Desk and Screen Policy. This is in order to allow the reader to produce the necessary policy and guidance for their business area and to ensure that the applicable and relevant security controls are set in place in line with the Department for Health, the wider NHS, health and social care and HMG requirements. 2 Scope The drafting of any policy governing the production of a Clear Desk and Screen policy for NHS systems, devices or applications and information deployed in support of NHS or health and social care business function. 3 Applicability This Example Policy is applicable to and designed for use by any NHS, health and social care or associated organisations that use or have access to NHS systems and/or information at any level. 4 Guidance This Example Policy provides guidance on the production of a Clear Desk and Screen Policy. The Example Policy is in italics with areas for insertion shown as <> and the rationale for each paragraph or section, where required, in [.]. Terminology Term SHALL SHOULD MAY Definition This term is used to state a Mandatory requirement of this policy This term is used to state a Recommended requirement of this policy This term is used to state an Optional requirement Policy The Clear Desk and Screen Policy will support <insert name of organisation> in preserving the confidentiality, integrity and availability of the NHS and other UK Government data manually handled and on IT systems used by <insert name of organisation> and third party staff. Copyright 2017 Health and Social Care Information Centre. 3

4 Clear Desk Policy At the end of the working day or when leaving the office during the day, all documents or media with a NHS or Government classification marking shall be secured in lockable commercial office furniture (desk drawers, filing cabinets, cupboards). Information classified at OFFICIAL or NHS Protect may be left out for up to 5 minutes (for example for comfort breaks or making a drink). If the office remains occupied for the duration of your absence information at OFFICIAL SENSITIVE or NHS Confidential may be left on the desk for up to 5 minutes, provided those present are authorised to view the information, otherwise it should be removed from view or secured appropriately. If material at OFFICIAL SENSITIVE or NHS Confidential has been left unsecured, you shall either stay with it until the data owner returns or secure the material before you leave. Information classified as SECRET shall not be left unattended for any period of time. When not in use, it is to be secured in a cabinet approved to store SECRET assets. Removable media shall be locked away Personal belongings should be removed from view Office/work area windows shall be closed when working areas are unattended and at the end of the working day. All internal doors shall be closed when working areas are unattended and at the end of the working day. In ground floor work areas, blinds shall be closed or PC/Laptop screens, information boards or any protectively marked or sensitive information shall be positioned so it cannot be viewed by passers-by. All desk pedestals shall be locked when working areas are unattended and at the end of the working day. All cabinets shall be locked when working areas are unattended and at the end of the working day. All laptops shall be secured in suitable containers when working areas are unattended and at the end of the working day. All printers shall be cleared of printed material when working areas are unattended and at the end of the working day. All photocopiers shall be cleared of printed material when working areas are unattended and at the end of the working day. All white boards shall be wiped clean when working areas are unattended and at the end of the working day. All flip charts shall be cleared of information when working areas are unattended and at the end of the working day. [This section may need to be amended to reflect the practices, equipment used and classification of information/data that the organisation handles and processes. For instance, if the organisation does not handle any SECRET material this element will not be required. Conversely if the organisation has material or equipment not listed above Copyright 2017 Health and Social Care Information Centre. 4

5 (e.g. tablets that are used for patient data) then the securing of these items should be reflected above.] Clear Screen Policy For all <insert name of organisation> IT systems, computer screens should be angled away from the view of unauthorised persons. All users shall ensure that any information at OFFICIAL SENSITIVE or NHS CONFIDENTIAL shall not be overseen by those without a need to know. Screens shall be cleared or locked when talking to unauthorised persons. All computer terminals shall have the auto screen saver set to activate when there is no activity for a period, suggested as no longer than 15 minutes. (If users have access to SECRET material then the auto screen saver period shall be set for a period of no longer than 5 minutes inactivity). Users shall invoke the screen lockout for periods when they are away from their device for no longer than 45 minutes. For periods longer than 45 minutes and at the end of the working day they shall log-off or shut down the device and switch off the screen. For IT systems processing SECRET information the screen lockout shall be invoked for a period of no longer than 30 minutes inactivity. Users shall be required to re-authenticate to unlock their screens. [The criteria in this section should reflect the practices; i.e. does the organisation actually have any SECRET material, or is 45 mins appropriate for screen lockout? Another example could be if IT equipment that runs medical equipment is involved (e.g. for CT scanners) it may need to stay on and accessible throughout the working day; if this is the case it should be listed and covered in the policy.] 5 Key Words Authenticate, Auto Screen, Desk, Lock, Log-off, Screen, Unlock Copyright 2017 Health and Social Care Information Centre. 5