Essex Digital Service security policies

The technology security policies shown below ​must be followed by all Essex Digital Service staff, contractors and any third parties working on their behalf when providing services to customers​.​​

A

Access Control Policy (PDF, 295KB) - management of access to information, premises and resources.

B

Business Continuity Management Policy (PDF, 229KB) - policy on business continuity management.

C

Cloud Security Policy (PDF, 295KB) - ensuring secure implementation of Cloud services.

Cryptography Policy (PDF, 202KB) - the use of cryptography to protect information.

I

Incident Management Policy (PDF, 248KB) - how incidents should be reported, managed and resolved.

IT Disaster Recovery Policy (PDF, 268KB) - policy on disaster recovery.

L

Logging and Monitoring Policy (PDF, 255KB) - how activities should be logged and monitored.

M

Malware Protection Policy (PDF, 243KB) - ensuring protection from malware, such as viruses and worms.

N

Network Security Policy (PDF, 233KB) – Securing network communications.

O

Operations Security Policy (PDF, 246KB) - measures to protect sensitive information and ensure the security of operational processes.

Organisation and Compliance Policy (PDF, 255KB) - ensuring secure operation of information processing facilities.

S

Secure Asset Management Policy (PDF, 260KB) - how to manage assets securely.

Secure Backup Policy (PDF, 233KB) – ensures the secure and reliable backup of critical data. 

Secure Configuration Policy (PDF, 247KB) - ensures that all systems are configured securely to protect against vulnerabilities and unauthorised access.

Secure Design, Development and Testing Policy (PDF, 219KB) – designing and developing systems and services securely, and confirming this through appropriate security testing. 

Supplier Security Management and Assurance Policy (PDF, 248KB) - managing the technology security risks associated with the use of supplier’s products or services.

V

Vulnerability Management Policy (PDF, 249KB) - best practice for ensuring that technical vulnerabilities are managed appropriately.