- Original Poster
- #1
Dear all - I am hoping someone can assist with this query:
We are a small company providing Economic studies to Local Authorities, Universities etc. Most of the contracts we find require us to sign-up to frameworks. Some of those frameworks are now asking for Cyber Security.
At present we keep our files on OneDrive/SharePoint, but does that really fulfil all the criteria listed below, such as anti-virus (surely Microsoft is providing that), data protection and encryption of data on the server - again surely 365. Aren't things like restricted access also covered, after all, no one can see any of the files unless the files are shared with them?
In short, what I am asking is would we be credible in replying on this form that we are using Office 365 OneDrive and Sharepoint and asking any questions that way, or is it more likely that they would require far more than that and therefore we would need to ensure our files were managed by a data company? If that is the case, what sort of charges do such companies make and what do you get for your money - are there any recommendations?
With many thanks for any assistance anyone can give (for reference, below is the latest form we are filling in and the sort of questions we are being asked.
Thanks
Trish
1. Cyber Security Provide a detailed description of:
(a) The security technologies adopted to protect on-premise and cloud-based systems, servers and devices. This should include malware (anti-virus) implementation and other technical security provisions that are employed (e.g. firewalls, end-point monitoring) to protect client data.
(b) The security technologies adopted, including encryption techniques, to protect data at rest on servers, laptops and other devices and data in transmission to HIE and SoSE.
2. Data Storage & Transmission Provide a detailed description of:
(a) The policies and procedures adopted to protect and secure data and information gathered as part of delivery of the contract.
(b) The geographic location of the data centre/servers where data and information will be stored and processed. This should include details of on-premise, cloud or hybrid storage environments.
(c) How data and information will be subsequently destroyed at the conclusion of the assignment. This should include a description of the precise procedures and tools employed to erase, destroy and render unreadable all data.
3. Access Control Describe what provisions will be in place to control access to data. Your response should at a minimum include:
(a) Restrictions and controls on access to the data/information (i.e. building and room access; computer access).
(b) How users are authenticated and authorised to gain access to the data (e.g. multifactor authentication; password policy).
4. Service Continuity Describe back-up and disaster recovery systems and procedures that are in place to continue service delivery in the event malware infection; data loss or corruption. This should include data replication times in the live system and restore times in the event of catastrophic failure.
We are a small company providing Economic studies to Local Authorities, Universities etc. Most of the contracts we find require us to sign-up to frameworks. Some of those frameworks are now asking for Cyber Security.
At present we keep our files on OneDrive/SharePoint, but does that really fulfil all the criteria listed below, such as anti-virus (surely Microsoft is providing that), data protection and encryption of data on the server - again surely 365. Aren't things like restricted access also covered, after all, no one can see any of the files unless the files are shared with them?
In short, what I am asking is would we be credible in replying on this form that we are using Office 365 OneDrive and Sharepoint and asking any questions that way, or is it more likely that they would require far more than that and therefore we would need to ensure our files were managed by a data company? If that is the case, what sort of charges do such companies make and what do you get for your money - are there any recommendations?
With many thanks for any assistance anyone can give (for reference, below is the latest form we are filling in and the sort of questions we are being asked.
Thanks
Trish
1. Cyber Security Provide a detailed description of:
(a) The security technologies adopted to protect on-premise and cloud-based systems, servers and devices. This should include malware (anti-virus) implementation and other technical security provisions that are employed (e.g. firewalls, end-point monitoring) to protect client data.
(b) The security technologies adopted, including encryption techniques, to protect data at rest on servers, laptops and other devices and data in transmission to HIE and SoSE.
2. Data Storage & Transmission Provide a detailed description of:
(a) The policies and procedures adopted to protect and secure data and information gathered as part of delivery of the contract.
(b) The geographic location of the data centre/servers where data and information will be stored and processed. This should include details of on-premise, cloud or hybrid storage environments.
(c) How data and information will be subsequently destroyed at the conclusion of the assignment. This should include a description of the precise procedures and tools employed to erase, destroy and render unreadable all data.
3. Access Control Describe what provisions will be in place to control access to data. Your response should at a minimum include:
(a) Restrictions and controls on access to the data/information (i.e. building and room access; computer access).
(b) How users are authenticated and authorised to gain access to the data (e.g. multifactor authentication; password policy).
4. Service Continuity Describe back-up and disaster recovery systems and procedures that are in place to continue service delivery in the event malware infection; data loss or corruption. This should include data replication times in the live system and restore times in the event of catastrophic failure.
- 5. Supply Chain Assurance If third-party software, platforms, cloud solutions or sub-contractors are employed, detail the assurances that have been obtained that these are secure and the methodology employed to gain these assurances
