{"text_format":"1","workbook":"xlsx","n_sheets":14,"sheets":["Introduction","Sheet2","Lookup","1. Info & cyber sec management","2. Asset management","3. Information management ","4. Access control","5. Physical security","6. System & network security","7. Compliance","8. IT supplier relationships","9. Business continuity manageme","10. Change management","11. Information transfer"],"not_rendered":{"charts":6,"images":1,"macros":1,"external_links":0,"defined_names":8,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[[5,1,42,15],[4,1,4,15]]}
[]
[]
[]
[]
[null,"Information & Cyber Security Checklist Tracker"]
[null,"\nYou can use this Tracker to record and track your actions once you have read the checklist. \n\nWe have suggested some columns to help you to build your own action plan and improve your compliance. \n\nKey phrases:\n\nStatus – This refers to whether the suggested action is ’in place', ‘partially in place’, or ‘not in place’. You can also record the status as ‘not applicable’ to your organisation. You can choose the status from a drop-down list.\n\nActions – You can describe what you need to do next to meet the suggested action.\n\nAction Owner(s) – You can specify who is responsible for the action.\n\nAction Status – You can choose what stage the action is at from a drop-down list. \n\nDue Date – You can record when you expect to complete the action.\n\n\n\nThe Data Protection Audit Framework, including the Tracker, is available under the terms of the Open Government Licence v3.0."]

{"sheet":"Sheet2","index":1,"n_rows":27,"n_cols":11,"rows_kept":27,"cut":false,"hidden":true,"merged":[]}
[null,"1. Leadership & Oversight","2. Policies & Procedures","3. DP compliance, monitoring and assurance","4. Contracts with processors","5. Documentation","6. Lawful basis & transparency","7. DP by design & default","8. Risks & DPIAs","9. Individual rights","Total"]
["Fully meeting our expectation",{"$f":"COUNTIF('1. Info & cyber sec management'!#REF!,A2)","v":{"$error":"#REF!"}},{"$f":"COUNTIF('2. Asset management'!E:E,A2)","v":0},{"$f":"COUNTIF('3. Information management '!E:E,A2)","v":0},{"$f":"COUNTIF('4. Access control'!E:E,A2)","v":0},{"$f":"COUNTIF('5. Physical security'!E:E,A2)","v":0},{"$f":"COUNTIF('6. System & network security'!E:E,A2)","v":0},{"$f":"COUNTIF('7. Compliance'!E:E,A2)","v":0},{"$f":"COUNTIF('8. IT supplier relationships'!E:E,A2)","v":0},{"$f":"COUNTIF('9. Business continuity manageme'!E:E,A2)","v":0},{"$f":"SUM(B2:J2)","v":{"$error":"#REF!"}}]
["Partially meeting our expectation",{"$f":"COUNTIF('1. Info & cyber sec management'!#REF!,A3)","v":{"$error":"#REF!"}},{"$f":"COUNTIF('2. Asset management'!E:E,A3)","v":0},{"$f":"COUNTIF('3. Information management '!E:E,A3)","v":0},{"$f":"COUNTIF('4. Access control'!E:E,A3)","v":0},{"$f":"COUNTIF('5. Physical security'!E:E,A3)","v":0},{"$f":"COUNTIF('6. System & network security'!E:E,A3)","v":0},{"$f":"COUNTIF('7. Compliance'!E:E,A3)","v":0},{"$f":"COUNTIF('8. IT supplier relationships'!E:E,A3)","v":0},{"$f":"COUNTIF('9. Business continuity manageme'!E:E,A3)","v":0},{"$f":"SUM(B3:J3)","v":{"$error":"#REF!"}}]
["Not meeting our expectation",{"$f":"COUNTIF('1. Info & cyber sec management'!#REF!,A4)","v":{"$error":"#REF!"}},{"$f":"COUNTIF('2. Asset management'!E:E,A4)","v":0},{"$f":"COUNTIF('3. Information management '!E:E,A4)","v":0},{"$f":"COUNTIF('4. Access control'!E:E,A4)","v":0},{"$f":"COUNTIF('5. Physical security'!E:E,A4)","v":0},{"$f":"COUNTIF('6. System & network security'!E:E,A4)","v":0},{"$f":"COUNTIF('7. Compliance'!E:E,A4)","v":0},{"$f":"COUNTIF('8. IT supplier relationships'!E:E,A4)","v":0},{"$f":"COUNTIF('9. Business continuity manageme'!E:E,A4)","v":0},{"$f":"SUM(B4:J4)","v":{"$error":"#REF!"}}]
["Not Applicable",{"$f":"COUNTIF('1. Info & cyber sec management'!#REF!,A5)","v":{"$error":"#REF!"}},{"$f":"COUNTIF('2. Asset management'!E:E,A5)","v":0},{"$f":"COUNTIF('3. Information management '!E:E,A5)","v":0},{"$f":"COUNTIF('4. Access control'!E:E,A5)","v":0},{"$f":"COUNTIF('5. Physical security'!E:E,A5)","v":0},{"$f":"COUNTIF('6. System & network security'!E:E,A5)","v":0},{"$f":"COUNTIF('7. Compliance'!E:E,A5)","v":0},{"$f":"COUNTIF('8. IT supplier relationships'!E:E,A5)","v":0},{"$f":"COUNTIF('9. Business continuity manageme'!E:E,A5)","v":0},{"$f":"SUM(B5:J5)","v":{"$error":"#REF!"}}]
["Blank",{"$f":"COUNTBLANK('1. Info & cyber sec management'!#REF!)","v":{"$error":"#REF!"}},{"$f":"COUNTBLANK('2. Asset management'!E2:E25)","v":7},{"$f":"COUNTBLANK('3. Information management '!E2:E21)","v":0},{"$f":"COUNTBLANK('4. Access control'!E2:E13)","v":0},{"$f":"COUNTBLANK('5. Physical security'!E2:E9)","v":0},{"$f":"COUNTBLANK('6. System & network security'!E2:E46)","v":0},{"$f":"COUNTBLANK('7. Compliance'!E2:E13)","v":6},{"$f":"COUNTBLANK('8. IT supplier relationships'!E2:E31)","v":13},{"$f":"COUNTBLANK('9. Business continuity manageme'!E2:E18)","v":10},{"$f":"SUM(B6:J6)","v":{"$error":"#REF!"}}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"1. Leadership & Oversight","2. Policies & Procedures","3. DP compliance, monitoring and assurance","4. Contracts with processors","5. Documentation","6. Lawful basis & transparency","7. DP by design & default","8. Risks & DPIAs","9. Individual rights","Total"]
["Not started",{"$f":"COUNTIF('1. Info & cyber sec management'!I:I,A18)","v":0},{"$f":"COUNTIF('2. Asset management'!I:I,A18)","v":0},{"$f":"COUNTIF('3. Information management '!I:I,A18)","v":0},{"$f":"COUNTIF('4. Access control'!I:I,A18)","v":0},{"$f":"COUNTIF('5. Physical security'!I:I,A18)","v":0},{"$f":"COUNTIF('6. System & network security'!I:I,A18)","v":0},{"$f":"COUNTIF('7. Compliance'!I:I,A18)","v":0},{"$f":"COUNTIF('8. IT supplier relationships'!I:I,A18)","v":0},{"$f":"COUNTIF('9. Business continuity manageme'!I:I,A18)","v":0},{"$f":"SUM(B18:J18)","v":0}]
["Action rejected",{"$f":"COUNTIF('1. Info & cyber sec management'!I:I,A19)","v":0},{"$f":"COUNTIF('2. Asset management'!I:I,A19)","v":0},{"$f":"COUNTIF('3. Information management '!I:I,A19)","v":0},{"$f":"COUNTIF('4. Access control'!I:I,A19)","v":0},{"$f":"COUNTIF('5. Physical security'!I:I,A19)","v":0},{"$f":"COUNTIF('6. System & network security'!I:I,A19)","v":0},{"$f":"COUNTIF('7. Compliance'!I:I,A19)","v":0},{"$f":"COUNTIF('8. IT supplier relationships'!I:I,A19)","v":0},{"$f":"COUNTIF('9. Business continuity manageme'!I:I,A19)","v":0},0]
["On track",{"$f":"COUNTIF('1. Info & cyber sec management'!I:I,A20)","v":0},{"$f":"COUNTIF('2. Asset management'!I:I,A20)","v":0},{"$f":"COUNTIF('3. Information management '!I:I,A20)","v":0},{"$f":"COUNTIF('4. Access control'!I:I,A20)","v":0},{"$f":"COUNTIF('5. Physical security'!I:I,A20)","v":0},{"$f":"COUNTIF('6. System & network security'!I:I,A20)","v":0},{"$f":"COUNTIF('7. Compliance'!I:I,A20)","v":0},{"$f":"COUNTIF('8. IT supplier relationships'!I:I,A20)","v":0},{"$f":"COUNTIF('9. Business continuity manageme'!I:I,A20)","v":0},0]
["Overdue",{"$f":"COUNTIF('1. Info & cyber sec management'!I:I,A21)","v":0},{"$f":"COUNTIF('2. Asset management'!I:I,A21)","v":0},{"$f":"COUNTIF('3. Information management '!I:I,A21)","v":0},{"$f":"COUNTIF('4. Access control'!I:I,A21)","v":0},{"$f":"COUNTIF('5. Physical security'!I:I,A21)","v":0},{"$f":"COUNTIF('6. System & network security'!I:I,A21)","v":0},{"$f":"COUNTIF('7. Compliance'!I:I,A21)","v":0},{"$f":"COUNTIF('8. IT supplier relationships'!I:I,A21)","v":0},{"$f":"COUNTIF('9. Business continuity manageme'!I:I,A21)","v":0},0]
["Completed",{"$f":"COUNTIF('1. Info & cyber sec management'!I:I,A22)","v":0},{"$f":"COUNTIF('2. Asset management'!I:I,A22)","v":0},{"$f":"COUNTIF('3. Information management '!I:I,A22)","v":0},{"$f":"COUNTIF('4. Access control'!I:I,A22)","v":0},{"$f":"COUNTIF('5. Physical security'!I:I,A22)","v":0},{"$f":"COUNTIF('6. System & network security'!I:I,A22)","v":0},{"$f":"COUNTIF('7. Compliance'!I:I,A22)","v":0},{"$f":"COUNTIF('8. IT supplier relationships'!I:I,A22)","v":0},{"$f":"COUNTIF('9. Business continuity manageme'!I:I,A22)","v":0},0]
["Blank",{"$f":"COUNTBLANK('1. Info & cyber sec management'!I2:I11)","v":10},{"$f":"COUNTBLANK('2. Asset management'!I2:I25)","v":24},{"$f":"COUNTBLANK('3. Information management '!I2:I21)","v":20},{"$f":"COUNTBLANK('4. Access control'!I2:I49)","v":48},{"$f":"COUNTBLANK('5. Physical security'!I2:I9)","v":8},{"$f":"COUNTBLANK('6. System & network security'!I2:I46)","v":45},{"$f":"COUNTBLANK('7. Compliance'!I2:I13)","v":12},{"$f":"COUNTBLANK('8. IT supplier relationships'!I2:I31)","v":30},{"$f":"COUNTBLANK('9. Business continuity manageme'!I2:I18)","v":17},214]
[]
[]
[null,"Not started","Action rejected","On track","Overdue","Completed","Blank"]
[null,{"$f":"SUM(B18:J18)","v":0},{"$f":"SUM(B19:J19)","v":0},{"$f":"SUM(B20:J20)","v":0},{"$f":"SUM(B21:J21)","v":0},{"$f":"SUM(B22:J22)","v":0},{"$f":"SUM(B23:J23)","v":214}]

{"sheet":"Lookup","index":2,"n_rows":9,"n_cols":10,"rows_kept":9,"cut":false,"hidden":true,"merged":[]}
["Will implement fully",null,null,null,"Not started",null,"Not started",null,null,"In place"]
["Will implement in part",null,null,null,"On track",null,"In progress",null,null,"Partially in place"]
["Not appropriate for my organisation",null,null,null,"Overdue",null,"Overdue",null,null,"Not in place"]
[null,null,null,null,"Completed",null,"Completed",null,null,"Not appropriate for my organisation"]
[]
[]
[]
["2000-01-01"]
[{"$f":"TODAY()","v":"2024-09-24"}]

{"sheet":"1. Info & cyber sec management","index":3,"n_rows":29,"n_cols":10,"rows_kept":29,"cut":false,"hidden":false,"merged":[[1,5,3,5],[4,5,6,5],[7,5,14,5],[1,2,3,2],[7,0,14,0],[7,1,14,1],[7,2,14,2],[1,0,3,0],[1,1,3,1],[4,0,6,0],[4,1,6,1],[23,0,28,0],[23,1,28,1],[23,2,28,2],[23,5,28,5],[15,1,18,1],[15,0,18,0],[15,2,18,2],[15,5,18,5],[19,0,22,0],[19,1,22,1],[19,2,22,2],[19,5,22,5]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[1.1000000000000001,"Clearly define information and cyber security roles and segregate responsibilities in an overarching management framework. ",null,"1.1.1","Develop a network of information and cyber security champions across your organisation to support the framework."]
[null,null,null,"1.1.2","Review the framework at appropriate intervals to ensure it remains up-to-date."]
[null,null,null,"1.1.3","Include your Data Protection Officer (DPO) on any relevant information and cyber security committees, boards or forums."]
[1.2000000000000002,"Set out your approach to information and cyber security in a policy framework. ",null,"1.2.1","Create procedures that support and provide direction on certain topics (eg physical security, network security, access control and asset management)."]
[null,null,null,"1.2.2","Create system operating procedures that provide clear guidance on the correct and secure use of software and hardware assets which process personal information."]
[null,null,null,"1.2.3","Ask staff to confirm they have read and understood key policies and procedures"]
[1.3,"Incorporate information and cyber security within a formal training programme. ",null,"1.3.1","Do a training needs assessment to understand at a role level what training your staff require, taking into account the information you process and the risks to security."]
[null,null,null,"1.3.2","Include information security in the induction process and refresh the training on a regular basis."]
[null,null,null,"1.3.3","Provide specialist training, where applicable. "]
[null,null,null,"1.3.4","Ensure the content of the training is written by qualified personnel and approved by senior management. "]
[null,null,null,"1.3.5","Keep records of completed training to evidence that you are meeting training targets. "]
[null,null,null,"1.3.6","Include a knowledge check at the end of any training to test staff understanding."]
[null,null,null,"1.3.7","Request staff feedback on the effectiveness and relevance of the training."]
[null,null,null,"1.3.8","Upload the training materials to your intranet so staff can still access it on completion"]
[1.4,"Assign responsibility for monitoring your information and cyber security practices and regularly report on these practices to an appropriate level of management.",null,"1.4.1","Assign responsibility for monitoring information and security practices. "]
[null,null,null,"1.4.2","Regularly report findings to the appropriate level of management."]
[null,null,null,"1.4.3","Set up a steering group or other forums where you can discuss information and cyber security."]
[null,null,null,"1.4.4","Share the minutes from the meeting with other established committees or boards"]
[1.5,"Broaden your knowledge and understanding of new and emerging technology and the security threat landscape by interacting with external information and cyber security communities. ",null,"1.5.1","Become a member of an information and cyber security group or forum that shares relevant knowledge and best practice, such as early warnings of attacks and vulnerabilities. "]
[null,null,null,"1.5.2","Rotate which cyber security staff attend cyber community events or workshops, so all staff benefit from new knowledge and continuing development."]
[null,null,null,"1.5.3"," Regularly communicate common or increasing information and cyber security risks to raise staff awareness."]
[null,null,null,"1.5.4","Include common or increasing risks in regular refresher training"]
[1.6,"Assess your information and cyber security risks as part of your risk management approach.",null,"1.6.1","Assign responsibility for managing information and cyber security risks to information asset owners."]
[null,null,null,"1.6.2","Ensure relevant staff have sufficient risk management training."]
[null,null,null,"1.6.3","Assess information and cyber security risks before starting new projects. "]
[null,null,null,"1.6.4","Do a data protection impact assessment to compliment your security risk assessment. "]
[null,null,null,"1.6.5","Use both local and central risk registers to capture information and cyber security risks at all operational levels."]
[null,null,null,"1.6.6"," Review and update risks on an ongoing basis."]

{"sheet":"2. Asset management","index":4,"n_rows":18,"n_cols":10,"rows_kept":18,"cut":false,"hidden":false,"merged":[[10,2,17,2],[10,0,17,0],[10,1,17,1],[10,5,17,5],[1,0,9,0],[1,1,9,1],[1,2,9,2],[1,5,9,5]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[2.1,"Identify, classify and risk assess all your hardware and software assets.",null,"2.1.1","Conduct periodic physical checks (floor to book exercises) to ensure the accuracy of the hardware asset inventory."]
[null,null,null,"2.1.2","Use asset discovery tools to help you identify all assets within the network."]
[null,null,null,"2.1.3","Put processes in place to capture new assets you acquire."]
[null,null,null,"2.1.4","Assign ownership for each individual asset."]
[null,null,null,"2.1.5","Apply appropriate security classifications based on the sensitivity of the information you are processing."]
[null,null,null,"2.1.6","Keep records to show that you review both the inventories themselves and the risks associated with the assets on a periodic basis. "]
[null,null,null,"2.1.7","Train owners on how to risk assess hardware and software assets."]
[null,null,null,"2.1.8","Create a checklist for staff to follow when they review asset inventories. "]
[null,null,null,"2.1.9","Identify your critical assets and suppliers and any interdependencies."]
[2.2000000000000002,"Keep records showing secure disposal of hardware assets (eg destruction logs and certificates). ",null,"2.2.1","Wipe, degauss or securely destroy hardware that contains personal information."]
[null,null,null,"2.2.2","Document the procedure for the secure disposal of assets. "]
[null,null,null,"2.2.3","Maintain evidence of management approval and sign-off prior to disposing of assets."]
[null,null,null,"2.2.4","Store hardware assets awaiting destruction in a locked area with limited access."]
[null,null,null,"2.2.5","Keep a destruction log which details all hardware assets that are destroyed. "]
[null,null,null,"2.2.6","Obtain certificates from third parties who securely destroy hardware assets on your behalf. "]
[null,null,null,"2.2.7","Conduct internal audits to check you follow the correct process for disposal."]
[null,null,null,"2.2.8","Carry out due diligence checks or audits on third parties to assess whether they maintain the security of hardware assets during the disposal process."]

{"sheet":"3. Information management ","index":5,"n_rows":40,"n_cols":10,"rows_kept":40,"cut":false,"hidden":false,"merged":[[1,2,10,2],[1,1,10,1],[1,0,10,0],[1,5,10,5],[11,2,15,2],[11,1,15,1],[11,0,15,0],[11,5,15,5],[16,0,19,0],[16,1,19,1],[16,2,19,2],[16,5,19,5],[34,0,39,0],[34,1,39,1],[34,2,39,2],[34,5,39,5],[20,2,23,2],[20,5,23,5],[24,0,33,0],[24,1,33,1],[24,2,33,2],[24,5,33,5],[20,1,23,1],[20,0,23,0]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[3.1,"Assign appropriate security classifications to your information and label your information to reflect your agreed information classification scheme.",null,"3.1.1","Take into account the requirements of confidentiality, integrity and availability of personal information when you assign classifications. "]
[null,null,null,"3.1.2","Document security classifications within an applicable policy that you communicate to all staff."]
[null,null,null,"3.1.3","Assign accountability for classifications to Information Asset Owners. "]
[null,null,null,"3.1.4","Review classifications to ensure they remain appropriate and keep a record of reviews."]
[null,null,null,"3.1.5","Conduct dip sampling to check whether you apply security classifications appropriately and feed results back to staff."]
[null,null,null,"3.1.6","Provide detailed guidance for staff on how to assign security classifications, including examples."]
[null,null,null,"3.1.7","Implement a procedure for information labelling that covers both physical and electronic information."]
[null,null,null,"3.1.8","Ensure electronic information records sufficient metadata that helps to identify, manage and control personal information."]
[null,null,null,"3.1.9","Provide training to staff on how to correctly label information."]
[null,null,null,"3.1.10","Conduct dip sampling to check whether you are labelling information correctly and feed results back to staff."]
[3.2,"Use appropriate methods for deletion when disposing of electronic data containing personal information you no longer require",null,"3.2.1","Have a retention schedule for all electronic data and review it on a regular basis."]
[null,null,null,"3.2.2","Implement safeguards for technical changes that may prevent future access to long-term data (eg obsolete formats and the potential deterioration of storage media). "]
[null,null,null,"3.2.3","Include clauses in contracts and agreements with third parties that cover the secure deletion of information when terminating the contract."]
[null,null,null,"3.2.4","Securely store and lock down information that you cannot delete due to system functionality restrictions. "]
[null,null,null,"3.2.5","Use deletion software to ensure information is deleted securely and cannot be recovered by specialist recovery or forensic tools."]
[3.3,"Have procedures in place to protect personal information processed through your employees’ own devices (BYOD). ",null,"3.3.1","Have a separate policy that covers the secure configuration and acceptable use of your employees’ own devices. "]
[null,null,null,"3.3.2","Provide staff with clear instructions on the physical security of their devices and rules about:\n- installing software; \n- using endpoint device software; \n- applying security updates; and \n- connecting to public networks. "]
[null,null,null,"3.3.3","Risk assess the use of BYOD before you implement it."]
[null,null,null,"3.3.4","Train all your staff on using BYOD."]
[3.4,"Ensure all staff (including temporary staff and contractors) return mobile devices when their employment or contract is terminated.",null,"3.4.1","Develop a leavers’ checklist which includes steps to ensure that staff return mobile devices. "]
[null,null,null,"3.4.2","Carry out periodic sampling of historical leavers to check they returned their devices. "]
[null,null,null,"3.4.3","Revoke access and remotely block devices automatically after the leavers’ last day of employment."]
[null,null,null,"3.4.4","Require line managers to physically collect devices from staff at the end of their last day of employment. "]
[3.5,"Put appropriate governance arrangements in place for using removeable media. ",null,"3.5.1","Document procedures for managing removable media (eg USBs, external hard drives and CDs). "]
[null,null,null,"3.5.2","Keep a record of all removable media approved for use. "]
[null,null,null,"3.5.3","Check that users of removable media are doing so in a secure manner and in line with security procedures. "]
[null,null,null,"3.5.4","Conduct dip sampling for the use of removable media to check it is still used by approved personnel."]
[null,null,null,"3.5.5","Define within procedures how long you should retain personal information on removable media."]
[null,null,null,"3.5.6","Implement port controls on applicable hardware assets to prevent unauthorised use of removeable media. "]
[null,null,null,"3.5.7","Record and regularly risk assess any ports that are uncontrolled."]
[null,null,null,"3.5.8","Store removable media in locked cabinets when not in use."]
[null,null,null,"3.5.9","Ensure all data stored on removable media is encrypted."]
[null,null,null,"3.5.10","Use technologies that prevent unauthorised data transfers to removable media."]
[3.6,"Implement security measures to protect personal information that staff are processing when working remotely or at home. ",null,"3.6.1","Protect systems through virtual private networks or multi-factor authentication."]
[null,null,null,"3.6.2","Ensure staff are able to store hardware assets securely. "]
[null,null,null,"3.6.3","Include remote working and working from home in business continuity and incident management procedures. "]
[null,null,null,"3.6.4","Train staff on their responsibilities for keeping personal information secure when working remotely or at home."]
[null,null,null,"3.6.5","Develop guidance for staff to follow when working in a public place."]
[null,null,null,"3.6.6","Enable remote wipe capabilities to protect personal information if devices are lost or stolen"]

{"sheet":"4. Access control","index":6,"n_rows":37,"n_cols":10,"rows_kept":37,"cut":false,"hidden":false,"merged":[[21,0,28,0],[21,1,28,1],[21,2,28,2],[21,5,28,5],[29,0,36,0],[29,1,36,1],[29,2,36,2],[29,5,36,5],[15,0,16,0],[15,1,16,1],[15,2,16,2],[15,5,16,5],[17,0,20,0],[17,1,20,1],[17,2,20,2],[17,5,20,5],[1,0,6,0],[1,1,6,1],[1,2,6,2],[1,5,6,5],[7,0,14,0],[7,1,14,1],[7,2,14,2],[7,5,14,5]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[4.0999999999999996,"Assign appropriate access rights to staff for processing personal information",null,"4.1.1","Carry out background checks on new staff prior to employment (including direct employees, temporary staff and contractors), when it is applicable to their role and responsibilities."]
[null,null,null,"4.1.2","Document in policy how you grant access rights to new starters."]
[null,null,null,"4.1.3","Assess and document the requirements of each role to assign the correct access rights."]
[null,null,null,"4.1.4","Document the process for granting access for temporary and contract staff."]
[null,null,null,"4.1.5","Create role-based access profiles based on the requirement of each role. "]
[null,null,null,"4.1.6","Use security classifications to assess which roles should have access to certain types of information."]
[4.2,"Restrict access to sensitive confidential information or systems to roles which you have formally assessed as requiring privileged or higher level access. ",null,"4.2.1","Document the process for assessing and assigning privileged access. "]
[null,null,null,"4.2.2","Assign responsibility for granting privileged access to a senior member of staff. "]
[null,null,null,"4.2.3","Maintain a list of all staff with privileged and administrator access. "]
[null,null,null,"4.2.4","Carry out background checks or vetting on new staff prior to employment (including direct employees, temporary staff and contractors), when it is applicable to their role and responsibilities?"]
[null,null,null,"4.2.5","Promptly remove privileged access from staff when they no longer require it."]
[null,null,null,"4.2.6","Training staff with privileged access."]
[null,null,null,"4.2.7","Conduct audits of privileged accounts to ensure staff are not misusing access."]
[null,null,null,"4.2.8","Segregate service accounts to avoid exfiltration (internally) (ie no access to web or email)."]
[4.3,"Review access rights regularly and adjust them if staff change role or responsibilities. ",null,"4.3.1","Document the movers’ process and regularly check to confirm compliance. "]
[null,null,null,"4.3.2","Keep records to demonstrate you review access rights and appropriately adjust them, if required."]
[4.4000000000000004,"Remove leavers’ access rights in a timely manner when their employment is terminated, including temporary and contract staff",null,"4.4.1","Document the leavers’ process and regularly check to confirm compliance. "]
[null,null,null,"4.4.2","Keep records to demonstrate you remove access rights in a timely fashion. "]
[null,null,null,"4.4.3","Assign end dates to access permissions, particularly for temporary role changes or when access isn’t needed permanently."]
[null,null,null,"4.4.4","Ask managers to check and confirm that access rights are removed."]
[4.5,"Ensure read and write access to source code, development tools or software is limited to authorised personnel only.",null,"4.5.1","Restrict access to source code and development tools to staff who require regular access only."]
[null,null,null,"4.5.2","Assign write access permissions to source code to privileged personnel or designated owners only. "]
[null,null,null,"4.5.3","Use a source code management system or similar mechanism to control central storage of source code."]
[null,null,null,"4.5.4","Restrict access to system design and specification documents that may contain information highlighting vulnerabilities"]
[null,null,null,"4.5.5","Restrict access to compilers and test platform environments."]
[null,null,null,"4.5.6","Implement strict authentication requirements to source code, such as multi-factor authentication."]
[null,null,null,"4.5.7","Allow source code to only be accessible on a separate network domain."]
[null,null,null,"4.5.8","Document who has privileged access."]
[4.5999999999999996,"Use secure authentication technologies and hold staff accountable for safeguarding their authentication information. ",null,"4.6.1","Develop a policy about using secure authentication information such as passwords, PINs and security answers. "]
[null,null,null,"4.6.2","Use suitable authentication techniques to identify users, messages and software. "]
[null,null,null,"4.6.3","Use multi-factor authentication when you require an enhanced level of security to protect personal information. "]
[null,null,null,"4.6.4","Publish regular reminders for staff on the importance of keeping their authentication information secure."]
[null,null,null,"4.6.5","Test how secure authentication information is by using password strength checkers and penetration testing."]
[null,null,null,"4.6.6","Implement lockout mechanisms after a certain number of failed log in attempts."]
[null,null,null,"4.6.7","Set expiration dates on passwords and send reminders to staff when their password is due to expire."]
[null,null,null,"4.6.8","Assess the privacy implications and lawful basis for using biometric authentication as part of a DPIA."]

{"sheet":"5. Physical security","index":7,"n_rows":23,"n_cols":10,"rows_kept":23,"cut":false,"hidden":false,"merged":[[12,0,18,0],[12,1,18,1],[12,2,18,2],[12,5,18,5],[19,0,22,0],[19,1,22,1],[19,2,22,2],[19,5,22,5],[1,0,7,0],[1,1,7,1],[1,2,7,2],[1,5,7,5],[8,0,11,0],[8,1,11,1],[8,2,11,2],[8,5,11,5]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[5.0999999999999996,"Protect entry points using appropriate physical controls that mitigate the risk of unauthorised access to secure areas where you are processing personal and special category information.",null,"5.1.1","Identify and risk assess areas that may require an increased level of security. "]
[null,null,null,"5.1.2","Regularly test physical controls to gain assurances of their effectiveness."]
[null,null,null,"5.1.3","Ensure entry points include a mixture of controls to maximise security (eg perimeter security and electronic access control systems)."]
[null,null,null,"5.1.4","Keep a record of the physical access rights assigned to staff. "]
[null,null,null,"5.1.5","Monitor the granting of visitor and guest access."]
[null,null,null,"5.1.6","Include the removal of physical access rights in the leavers’ checklist. "]
[null,null,null,"5.1.7","Audit the record of physical access rights to ensure you revoke access when you should."]
[5.2,"Implement controls to protect against external threats in secure areas, such as server rooms. ",null,"5.2.1","Conduct risk assessments of secure areas and the equipment in them."]
[null,null,null,"5.2.2","Implement controls such as fire detection and suppression systems, humidity sensors and physical access detection systems."]
[null,null,null,"5.2.3","Maintain a log of all attempts to access secure areas to assess whether they are authorised."]
[null,null,null,"5.2.4","Use additional electronic controls in secure areas, such as CCTV."]
[5.3,"Position computers and devices displaying personal information in a way that reduces the risk of unauthorised access.",null,"5.3.1","Use screen filters or privacy screens. "]
[null,null,null,"5.3.2","Locate printers in a secure area to prevent unauthorised personnel accessing personal information."]
[null,null,null,"5.3.3","Obstruct public facing windows to prevent unauthorised personal seeing into the office space. "]
[null,null,null,"5.3.4","Conduct regular physical checks to ensure staff are adhering to the process for positioning physical assets."]
[null,null,null,"5.3.5","Document clear desk and clear screen requirements in policies and procedures. "]
[null,null,null,"5.3.6","Communicate clear desk and clear screen requirements to all staff. "]
[null,null,null,"5.3.7","Set screens to automatically lock after an appropriate period of time. "]
[5.4,"Store physical records securely and control access to them.",null,"5.4.1","Store physical records in lockable store rooms and filing cabinets. "]
[null,null,null,"5.4.2","Document who has access to physical records, including who has access to keys, key cards or access codes for secure areas. "]
[null,null,null,"5.4.3","Change access codes on a regular basis."]
[null,null,null,"5.4.4","Conduct audits to assess whether access is revoked where required."]

{"sheet":"6. System & network security","index":8,"n_rows":76,"n_cols":10,"rows_kept":76,"cut":false,"hidden":false,"merged":[[71,0,75,0],[71,1,75,1],[71,2,75,2],[71,5,75,5],[62,0,66,0],[62,1,66,1],[62,2,66,2],[62,5,66,5],[67,0,70,0],[67,1,70,1],[67,2,70,2],[67,5,70,5],[50,0,55,0],[50,1,55,1],[50,2,55,2],[50,5,55,5],[56,0,61,0],[56,1,61,1],[56,2,61,2],[56,5,61,5],[34,0,40,0],[34,1,40,1],[34,2,40,2],[34,5,40,5],[41,0,49,0],[41,1,49,1],[41,2,49,2],[41,5,49,5],[19,0,22,0],[19,1,22,1],[19,2,22,2],[19,5,22,5],[23,0,33,0],[23,1,33,1],[23,2,33,2],[23,5,33,5],[12,0,14,0],[12,1,14,1],[12,2,14,2],[12,5,14,5],[15,0,18,0],[15,1,18,1],[15,2,18,2],[15,5,18,5],[1,0,5,0],[1,1,5,1],[1,2,5,2],[1,5,5,5],[6,0,11,0],[6,1,11,1],[6,2,11,2],[6,5,11,5]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[6.1,"Establish and apply a secure baseline across your organisations information technology (IT) infrastructure. ",null,"6.1.1","Establish and define baseline configurations for all endpoints, systems, network devices, cloud services and applications. "]
[null,null,null,"6.1.2","Keep all baseline configurations under periodic review."]
[null,null,null,"6.1.3","Implement processes and utilising tools that assist in enforcing baseline configurations. "]
[null,null,null,"6.1.4","Implement procedures to ensure you control any modification to baseline configurations. "]
[null,null,null,"6.1.5","Document roles and responsibilities for applying and modifying baseline configurations."]
[6.2,"Use appropriate anti-virus and anti-malware software and keep it up-to-date.",null,"6.2.1","Conduct risk assessments to determine which anti-virus and anti-malware software is most suitable to your organisation."]
[null,null,null,"6.2.2","Keep records to demonstrate you’ve installed anti-virus and anti-malware software. "]
[null,null,null,"6.2.3","Schedule regular anti-virus and anti-malware software scans and checks of systems."]
[null,null,null,"6.2.4","Keep anti-virus and anti-malware software up-to-date and install patches as soon as possible. "]
[null,null,null,"6.2.5","Training staff who are responsible for deciding which anti-virus and anti-malware software to use. "]
[null,null,null,"6.2.6","Keep a record of all updates you’ve installed."]
[6.3,"Implement appropriate measures to minimise your processing of personal information, such as using data masking, pseudonymisation and anonymisation. ",null,"6.3.1","Use various techniques for pseudonymising or anonymising personal information (eg encryption, substitution, tokenisation, hashing and the nulling of characters)."]
[null,null,null,"6.3.2","Test the use of various techniques on synthetic data prior to official use."]
[null,null,null,"6.3.3","Review our guidance on privacy enhancing technologies (PETs) to assist you in minimising personal information processing."]
[6.4,"Implement measures to prevent the loss of data from systems, networks and any other devices that process, store or transmit sensitive information.",null,"6.4.1","Identify potential channels of data loss (eg email, file transfers, mobile devices and portable storage devices) and implement safeguards to prevent data leakage."]
[null,null,null,"6.4.2","Use automated monitoring tools to detect and block disclosures of sensitive information or unauthorised network transmissions (eg information being uploaded to untrusted third-party cloud services)."]
[null,null,null,"6.4.3","Prevent the copying or extracting of database entries."]
[null,null,null,"6.4.4","Use warning pop ups to alert users and remind them about transfer protocols."]
[6.5,"Back up key software assets that process personal information to protect against the loss of data. ",null,"6.5.1","Document the process for creating back up copies in policies. "]
[null,null,null,"6.5.2","Test back up and recovery processes to ensure they remain fit for purpose."]
[null,null,null,"6.5.3","Use a variety of back up types and methods depending on the criticality of the personal information you’re processing."]
[null,null,null,"6.5.4","Limit access to back ups to authorised personnel only."]
[6.6,"Monitor networks, systems and applications to identify any unusual activity or potential information security incidents. Use logs to record the activity of users and to identify unauthorised access and misuse of personal information. ",null,"6.6.1","Establish a baseline for normal activity and monitor activity against this baseline. "]
[null,null,null,"6.6.2","Use continuous monitoring tools (eg intrusion detection software). "]
[null,null,null,"6.6.3","Assess whether to monitor in real time or at periodic intervals, based on needs and capabilities."]
[null,null,null,"6.6.4","Communicate abnormal events to relevant parties and investigate them. "]
[null,null,null,"6.6.5","Enable alerts, such as emails or push notifications, to notify unusual activity."]
[null,null,null,"6.6.6","Train staff on how to recognise unusual activity."]
[null,null,null,"6.6.7","Produce a documented policy that sets out logging requirements. "]
[null,null,null,"6.6.8","Ensure logs are sufficiently detailed to assess whether the use of systems and applications is permitted. "]
[null,null,null,"6.6.9","Regularly review and analyse logs to identify any unusual activity that may indicate unauthorised access and misuse of systems and applications. "]
[null,null,null,"6.6.10","Protect logs by making sure staff with privileged access rights do not have permission to delete or de-activate their own activities. "]
[null,null,null,"6.6.11","Assess the amount of information recorded on the logs to ensure it complies with the data minimisation principle."]
[6.7,"Collect detailed threat intelligence and implement corrective measures swiftly to ensure personal information is protected. ",null,"6.7.1","Adopt a layered approach to collecting intelligence, such as strategic, tactical and operational threat intelligence. "]
[null,null,null,"6.7.2","Ensure threat intelligence is relevant, insightful, contextual and actionable. "]
[null,null,null,"6.7.3","Review threat intelligence on a regular basis. "]
[null,null,null,"6.7.4","Keep a record of all the actions you’ve taken as a result of threat intelligence, such as applying vendor updates to software. "]
[null,null,null,"6.7.5","Communicate the analysis of threat intelligence with relevant staff members. "]
[null,null,null,"6.7.6","Share threat intelligence with other organisations that may benefit."]
[null,null,null,"6.7.7","Factor new risks into security risk assessments on a regular basis."]
[6.8,"Implement network security management to protect the IT infrastructure from being compromised. ",null,"6.8.1","Complete a mapping exercise of the whole network. "]
[null,null,null,"6.8.2","Document processes for the management of network security in a policy. "]
[null,null,null,"6.8.3","Assign responsibilities for the management of network security to relevant staff. "]
[null,null,null,"6.8.4","Implement internal and external firewalls and intrusion detection systems. "]
[null,null,null,"6.8.5","Document firewall rules. "]
[null,null,null,"6.8.6","Ensure open connections on firewalls are subject to approval by an authorised staff member. "]
[null,null,null,"6.8.7","Monitor incoming and outgoing network traffic for potential security threats. "]
[null,null,null,"6.8.8","Use air gapped equipment for high-risk processing activities. "]
[null,null,null,"6.8.9","Apply technologies to the network, such as authentication and encryption."]
[6.9,"Divide larger networks into separate network domains to improve the security of network boundaries and control network traffic. ",null,"6.9.1","Keep network domains separate to the public network. "]
[null,null,null,"6.9.2","Ensure each network boundary is clearly defined. "]
[null,null,null,"6.9.3","Keep sensitive or critical information secured in a separate network with higher network traffic controls."]
[null,null,null,"6.9.4","Use separate networks for connections with external organisations."]
[null,null,null,"6.9.5","Have independent authentication and encryption controls for each network."]
[null,null,null,"6.9.6","Manage access controls at a user-level."]
[6.1,"Monitor the lifespan of current software assets and take measures to mitigate any risks.",null,"6.10.1","Keep a log of all operating systems and software in use."]
[null,null,null,"6.10.2","Assess the risk of using unsupported operating systems (eg Windows XP, Windows Server 2008)."]
[null,null,null,"6.10.3","Keep a documented list of all software and applications running on operating systems which are approaching the end of life. "]
[null,null,null,"6.10.4","Apply appropriate mitigating controls for continuing to use unsupported software."]
[null,null,null,"6.10.5","Consult software vendors or developers directly, or subscribe to service updates, to get advanced notice of end of life."]
[null,null,null,"6.10.6","Separate devices with unsupported software or operating systems on a separate network or air-gap them."]
[6.11,"Identify vulnerabilities in your network and conduct regular vulnerability scanning.",null,"6.11.1","Assign responsibility for applying fixes. "]
[null,null,null,"6.11.2","Implement a process for following up on any risks identified during vulnerability scans. "]
[null,null,null,"6.11.3","Have a schedule of penetration (pen) tests that are carried out by independent external providers. "]
[null,null,null,"6.11.4","Periodically change the external provider of pen testing. "]
[null,null,null,"6.11.5","Report the findings of vulnerability scans and pen testing to an appropriate level of management."]
[6.12,"Establish effective patch management practices so that the risk that vulnerabilities are exploited are mitigated",null,"6.12.1","Implement a patch management policy. "]
[null,null,null,"6.12.2","Assign responsibilities for installing the latest patches to software assets to fix any vulnerabilities. "]
[null,null,null,"6.12.3","Test patches prior to their implementation. "]
[null,null,null,"6.12.4","If you are reliant on third parties, gain assurances that they have applied patches, including critical or urgent security patches, or they have provided them in an appropriate timeframe."]
[6.13,"Strictly control or prohibit staff use of internet sites, social media, messaging platforms and apps to minimise risk. ",null,"6.13.1","Maintain a record of approved internet sites and apps."]
[null,null,null,"6.13.2","Use URL or web content filtering to block specific websites or categories of websites. "]
[null,null,null,"6.13.3","Restrict staff from downloading unauthorised apps onto organisation owned mobile devices. "]
[null,null,null,"6.13.4","Train staff on the professional use of internet sites, social media and messaging platforms."]
[null,null,null,"6.13.5","Have an acceptable use policy for organisation-owned devices that staff are required to read and sign periodically."]

{"sheet":"7. Compliance","index":9,"n_rows":7,"n_cols":10,"rows_kept":7,"cut":false,"hidden":false,"merged":[[1,0,3,0],[1,1,3,1],[1,2,3,2],[1,5,3,5],[4,0,6,0],[4,1,6,1],[4,2,6,2],[4,5,6,5]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[7.1,"Plan and undertake internal reviews to ensure that you implement information and cyber security controls in line with organisational policies and procedures.",null,"7.1.1","Conduct independent internal reviews of information and cyber security controls, including audits and IT health checks (ITHC). "]
[null,null,null,"7.1.2","Develop an action plan for treating any identified issues and risks and recording risks on any relevant risk registers. "]
[null,null,null,"7.1.3","Ensure management undertake compliance reviews, such as spot checks and staff surveys, within their areas of responsibility."]
[7.2,"Commission external information and cyber security reviews to ensure you are implementing effective information and cyber security controls.",null,"7.2.1","Plan and commission external compliance reviews of key systems, including vulnerability assessments, pen testing and audits."]
[null,null,null,"7.2.2","Develop an action plan for treating any identified issues and risks and record risks on any relevant risk registers. "]
[null,null,null,"7.2.3","Obtain certification from industry standards, such as ISO27001/2 and Cyber Essentials Plus."]

{"sheet":"8. IT supplier relationships","index":10,"n_rows":18,"n_cols":10,"rows_kept":18,"cut":false,"hidden":false,"merged":[[10,0,17,0],[10,1,17,1],[10,2,17,2],[10,5,17,5],[1,0,4,0],[1,1,4,1],[1,2,4,2],[1,5,4,5],[5,0,9,0],[5,1,9,1],[5,2,9,2],[5,5,9,5]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[8.1,"Carry out information and cyber security risk assessments and due diligence checks to understand and mitigate risks prior to granting IT suppliers access to your organisation's networks and assets. ",null,"8.1.1","Complete risk assessments prior to procuring services. "]
[null,null,null,"8.1.2","Conduct due diligence checks."]
[null,null,null,"8.1.3","Group suppliers into different categories based on the nature of the service they provide."]
[null,null,null,"8.1.4","Assign risk profiles to each group, taking into account the: \n- sensitivity of the personal information processed; \n- capability of likely threats; and \n- impact on operations of any loss, damage or disruption."]
[8.1999999999999993,"Ensure contracts and agreements are in place with IT suppliers, and that they include relevant information and cyber security requirements.",null,"8.2.1","Ensure contracts and agreements are signed by all parties. "]
[null,null,null,"8.2.2","Include appropriate information and cyber security requirements or clauses in contracts and ensure they are enforceable under the contract."]
[null,null,null,"8.2.3","Conduct audits or reviews of information and cyber security arrangements on a periodic basis. "]
[null,null,null,"8.2.4","Keep a centralised log of all contracts and agreements to facilitate an easily review when required."]
[null,null,null,"8.2.5","Dip sample current contracts to check they are valid, up-to-date and include correct security requirements."]
[8.3000000000000007,"Implement processes for acquiring, using, managing and exiting cloud services. ",null,"8.3.1","Implement a policy that defines how you manage information and cyber security risks associated with using cloud services. "]
[null,null,null,"8.3.2","Complete information and cyber security risk assessments before using a cloud service."]
[null,null,null,"8.3.3","Identify and document residual risks and ask management to accept them. "]
[null,null,null,"8.3.4","Adopt a shared responsibility model that clearly defines the responsibilities of both your organisation and the cloud service provider. "]
[null,null,null,"8.3.5","Obtain assurances from cloud service providers that their information and cyber security controls are sufficient. "]
[null,null,null,"8.3.6","Implement procedures for handling information security incidents that occur when using cloud services. "]
[null,null,null,"8.3.7","Include provisions for protecting personal information and the availability of services in contracts, such as access controls, malware monitoring, and backup services."]
[null,null,null,"8.3.8","Document processes for changing or stopping the use of cloud services, including exit strategies and returning information, such as configuration files, source code and data."]

{"sheet":"9. Business continuity manageme","index":11,"n_rows":8,"n_cols":10,"rows_kept":8,"cut":false,"hidden":false,"merged":[[1,0,7,0],[1,1,7,1],[1,2,7,2],[1,5,7,5]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[9.1,"Have business continuity and disaster recovery plans in place so you can take appropriate and timely actions to protect personal information from further loss of confidentiality, integrity or availability.",null,"9.1.1","Formally document plans for business continuity and disaster recovery."]
[null,null,null,"9.1.2","Periodically review, test and update plans. "]
[null,null,null,"9.1.3","Ask senior staff to authorise the plans. "]
[null,null,null,"9.1.4","Define and document roles and responsibilities for staff involved in business continuity and disaster recovery."]
[null,null,null,"9.1.5","Train all staff on what to do in the event of a systems or network outage."]
[null,null,null,"9.1.6","Test business continuity and disaster recovery plans to ensure they remain up-to-date and fit for purpose."]
[null,null,null,"9.1.7","Conduct lessons learned activities to identify and understand any changes you need to make to the plans."]

{"sheet":"10. Change management","index":12,"n_rows":20,"n_cols":10,"rows_kept":20,"cut":false,"hidden":false,"merged":[[5,2,12,2],[5,5,12,5],[13,0,19,0],[13,1,19,1],[13,2,19,2],[13,5,19,5],[1,0,4,0],[1,1,4,1],[1,2,4,2],[1,5,4,5],[5,0,12,0],[5,1,12,1]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[10.1,"Assess potential information and cyber security risks before you make a change to your existing processes, assets or systems. ",null,"10.1.1","Identify information and cyber security requirements for all types of changes, not only ICT development projects. "]
[null,null,null,"10.1.2","Take steps to address the risks at an early stage. "]
[null,null,null,"10.1.3","Review risks and steps taken at predefined stages and throughout the change process. "]
[null,null,null,"10.1.4","Allocate responsibility for information and cyber security risks to someone who is involved in the project."]
[10.199999999999999,"Assess potential information and cyber security risks before procuring or developing new systems or applications. ",null,"10.2.1","Document your approach to the secure development and acquisition of new applications and systems. "]
[null,null,null,"10.2.2","Establish and apply a minimum secure baseline for their development and acquisition. "]
[null,null,null,"10.2.3","Implement security testing during the development life cycle and through the acquisition process."]
[null,null,null,"10.2.4","Assign responsibility for directing, monitoring and reviewing the outsourced system development. "]
[null,null,null,"10.2.5","Separate development, testing and production environments. "]
[null,null,null,"10.2.6","Ensure any personal information used in development environments is either falsified or fully anonymised."]
[null,null,null,"10.2.7","Build the minimum and desired security requirements into tendering documents."]
[null,null,null,"10.2.8","Embed consultation with cyber security teams into system development and procurement processes."]
[10.3,"Control the installation of new software and changes to existing software until you’ve completed information and cyber security risk assessments. ",null,"10.3.1","Have gateways and sign offs in place for new software and changes to existing software. "]
[null,null,null,"10.3.2","Conduct sufficient testing prior to roll-out. "]
[null,null,null,"10.3.3","Involve the DPO on completion of any risk assessment to check whether the installation of new software will have an impact on data protection compliance."]
[null,null,null,"10.3.4","Keep a record of any changes to existing software assets."]
[null,null,null,"10.3.5","Complete a full back up of information before implementing changes to software assets."]
[null,null,null,"10.3.6","Monitor recent changes to software assets closely for a period following implementation."]
[null,null,null,"10.3.7","Communicate software changes to staff to make them aware and alert to new issues and vulnerabilities."]

{"sheet":"11. Information transfer","index":13,"n_rows":10,"n_cols":10,"rows_kept":10,"cut":false,"hidden":false,"merged":[[5,0,9,0],[5,1,9,1],[5,2,9,2],[5,5,9,5],[1,0,4,0],[1,1,4,1],[1,2,4,2],[1,5,4,5]]}
["Number","Action","Status","Reference","Tasks to consider","Notes","Actions to take","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[11.1,"Protect personal information when you are transferring it and prevent it being inappropriately disclosed.",null,"11.1.1","Implement information transfer policies and procedures for  transferring personal information electronically and manually. "]
[null,null,null,"11.1.2","Communicate these policies and procedures to relevant staff. "]
[null,null,null,"11.1.3","Include data transfer security requirements in contracts or transfer agreements with third parties. "]
[null,null,null,"11.1.4","Complete a lessons learned exercise in the event of a personal data breach, update policies and procedures and provide further training, where required."]
[11.2,"Protect incoming and outgoing communications using appropriate security measures. ",null,"11.2.1","Use encryption to protect the content of emails and their attachments, especially if they contain sensitive personal information. "]
[null,null,null,"11.2.2","Use spam filters and various malware detection techniques to protect against receiving malicious emails."]
[null,null,null,"11.2.3","Automatically quarantine outgoing emails containing sensitive information."]
[null,null,null,"11.2.4","Provide social engineering training to staff, covering the different types of techniques that can be used."]
[null,null,null,"11.2.5","Conduct phishing tests on staff and feedback on the results. "]