Information Security and Data Governance

Information Security

What you need to know

This document details the information security principles that apply to all persons employed by, or contracted to, Viberts.

Failure to adhere to the guidance contained herein or to any policy/control referred to in this document (or provided to you as a part of your employment) may result in disciplinary action.

1. Introduction and your responsibilities at Viberts
2. Scope
3. Security of information and assets
4. Passwords and User Identifiers
5. Password requirements
6. Reporting of information security incidents
7. Acceptable use of company assets
8. Use of email
9. Special or privileged rights or access
10. Bring your own device (BYOD)
11. Remote working
12. Return of assets
13. Information and its classification
14. How data classifications are defined
15. Level 0: Public
16. Level 1: Internal
17. Level 2: Confidential (default for legal matters)
18. Level 3: Strictly confidential
19. Personal Data
20. How we secure confidential information
21. iManage Share
22. Clear desk policy

 

Introduction

Your responsibilities to Viberts
As an employee/contractor or third party of Viberts, you are bound by certain controls and obligations relating to the security, integrity & confidentiality of the firm’s information assets.

This document is concerned with both the security of Viberts information and the systems that contain, create & distribute said information. Its purpose is to support our legal, regulatory & compliance obligations in terms of both Viberts intellectual property and client/employee personal data.

Scope
This document is provided in addition to the HR handbook and associated policies, and is designed to clarify the requirements for information security relevant to all Viberts employees. It is also applicable to certain third parties, whether they are explicitly bound (e.g. by contractual terms & conditions) or implicitly bound (e.g. by generally held standards of acceptable behaviour).

The statements made within this Standard refer to the minimum obligations required by Viberts of its staff.

Security of information and assets

Passwords and User Identifiers
All users of Viberts systems are given a unique identifier (User ID) for their personal use. This ensures that the systems can identify users and can ensure auditability. As far as possible, these will be system-wide; however, some applications may require an additional user identifier.

User IDs must never be shared, as they act not only as an access method but also serve to digitally sign and mark all system-based actions (including email, document authoring and transactions within applications).

To prevent unauthorised access, in addition to your User ID, we use passwords or passphrases. Good practice dictates that these must be changed whenever you suspect that they may have been compromised. In addition, passwords and passphrases must never be shared with work colleagues.

If you forget your password, the Operations team will change it for you. You will then be required to change the password on your next sign in. This should be undertaken as soon as possible.

Please note that your passwords should never be written down.

Password requirements
All passwords used for Viberts-related activities should:

• Be a minimum length of 8 characters
• Always use a combination of alphabetic & numeric characters
• Not be a repeat of any of your previous ten passwords.

(Should you forget a password, your account will be locked after three incorrect sign-in attempts.)

Please make passwords difficult to guess; never use simple dictionary words and don’t use a sequence of passwords such as password1, password2, password3.

Setting a secure password needn’t be difficult. Rather than using a dictionary word, consider using a phrase. When combined with special characters, this can create an extremely complex password. Here is an example of a complex password that is easy to remember:

R1.Tpiu! = Rule1.Thispasswordisunhackable!

Reporting of information security incidents
Viberts requires that all employees assist in the security of the business as a part of their everyday activities. As such, all employees are required to report any incident which they consider may be a security issue. This report should be made to the Operations team or to a Partner / line manager. This is especially important if you believe that a password has been compromised, if personal data has been accessed or if there is any evidence of malware.

Employees are also reminded that they must notify the Operations team as soon as possible if any portable device (laptop, external hard drive, USB key, smart device, phone etc.) is lost or stolen.

Acceptable use of company assets
Computer systems, email accounts, telephones (including mobile phones), voicemail boxes and other similar resources are the property of Viberts and are supplied to assist in the performance of your daily activities. Whilst some limited personal use is permitted, you should be aware that:

Viberts reserves the right to access all equipment and systems used to perform work functions (even if not owned by Viberts) for operational support and/or the protection of its information assets and the protection of client data.

All Viberts IT resources are provided solely for Viberts business use. Using any Viberts-provided resource to conduct another business is not permitted.

The provision of limited personal use must comply with all restrictions outlined in this Standard; however, further controls & constraints may be imposed by Viberts management. In addition, the following guidance is given:

• It is not permissible to use unauthorized personal devices for company business. Also, the connection of unauthorized personal devices to Viberts networks is prohibited. (Exceptions may be made at the discretion of the Operations Manager or relevant Partner.)
• If employees are permitted to use a personal device for business purposes, the provisions of this Standard apply to both the device and to any information stored thereon. All Viberts data held on a personal device must be removed immediately if requested by a duly authorized manager or Partner, or when the employee leaves Viberts.

Use of email
The following rules relate to the use of Viberts email:

• Email is provided for business use, and the language used within email should reflect that. Please refrain from jargon and text speak, and adopt a business approach to content and style (especially where communications may be forwarded either internally or externally).
• Staff are advised that the content of email is disclosable, i.e. a client can request internal & external email as part of a Subject Access Request. Please, therefore, do not include anything in an email that you would not include in a written memo or similar.
• Do not include any comments or content which could be considered as harassment (e.g. information that could be construed as bullying or which refers to racial or ethnic origins in a derogatory manner). Do not use swear words or include any offensive or inappropriate material.
• Email will be retained for monitoring and other business reasons and may be made available to HR and/or Operations as required.

Special or privileged rights or access
As a function of your role, you will have been granted access to various systems and applications. Your permissions within these applications have been agreed with Viberts management and in line with your job role. In some cases, additional access is granted for managerial/technical/business reasons and staff will be made aware of this when the associated rights are granted. It should be understood that abuse of this privilege is a reportable offence.

Employees are advised that all changes to user privileges can only be completed with a duly authorised request. Permissions should never be created, changed or deleted without written authority from the system owner or from an authorised manager/Partner.

If you believe that you shouldn’t have access to a specific application, or are uncomfortable with your level of access, this should be raised in the first instance with your line manager.

Bring your own device (BYOD)
Where appropriate, staff can use their own devices for business activities. This is subject to approval and the application of appropriate controls.

Employees and contract staff who prefer to use their own IT equipment for work purposes must be explicitly authorised to do so and must secure all equipment & data to the same extent as it would be secured on Viberts IT network.

Remote working
Viberts offers a remote working capability, providing similar access to that available in the office.

Staff who work remotely must treat information as securely as they would in the office, and should prevent family members etc. from viewing confidential data.

Return of assets
All employees, contractors and other third-parties must return company assets upon termination of their employment or contract.

Information and its classification
At Viberts, dealing with confidential & private data is our business. To protect these information assets, Viberts requires that employees be aware of the sensitivity of information encountered during their employment and of the impact to individuals and the firm should that data be subject to inappropriate disclosure.

Information should be classified as follows:

Public	There is no risk to Viberts if inappropriately shared.
Internal	No risk to Viberts and can be shared openly within the organisation. Minimal risk if shared externally.
Confidential	Appropriate handling is expected. Documents cannot be distributed internally or externally except with authorisation.
Strictly Confidential	Special care must be taken to ensure that distribution is appropriate and that all recipients are approved by the document owner.

 

Viberts recommends that the distribution of strictly confidential information should be encrypted; however it may be transmitted over email or similar if this has been accepted as the normal means of communication for a given client, matter or business activity and agreed as such with a relevant Partner.

How data classifications are defined

Level 0: Public
Public information is information that is neither privileged nor protected (e.g. not classed as intellectual property, covered by data protection, privacy regulations). Information in this category is considered as having no impact if lost or stolen.

Classification criteria: Disclosure of this type of information does not carry any risk to Viberts. Public does not, however, imply that the information is intended to be an official communication to the public. Appropriate procedures for deciding which information is made available to the public must be followed.

Level 1: Internal
This is information that is defined as “for business internal use only”. It is typically required for normal day-to-day work. Information in this category is considered as low impact if lost or stolen.

Classification criteria: Access to Internal information must be granted on a need-to-know basis. This classification level also includes information exchanged between departments insofar as it does not contain content classified as confidential.

Level 2: Confidential (default for legal matters)
Confidential information is information that may only be accessed by a limited group of known individuals. Information in this category is considered as having a high impact if lost or stolen.

Classification criteria: Disclosure of confidential information may lead to a breach of the company’s data protection obligations. Improper or unauthorised use of such information may infringe upon the ability of the firm to carry out normal business operations. Significant financial loss and/or reputational damage may occur as the result of the disclosure of confidential information.

Level 3: Strictly confidential
Strictly confidential information is intended for a very restricted group of known individuals. Information in this category is considered as having a very high impact if lost or stolen.

Classification criteria: This classification level identifies data that, if disclosed, may provide access to vital business information. If revealed to unauthorised persons, significant losses could be incurred. Additional consequences may include reputational damage, operational impacts and legal action.

Personal data
Personal data is information that, when used alone or with other relevant data, can identify an individual (data subject).

Personal data will be assumed to carry the default classification of Confidential as a minimum.

Sensitive personal data is information that reveals (for example) a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, social security details, criminal history, sex-life or health data.

Sensitive personal data should be classified as Strictly confidential. Any exceptions must be discussed with the Data Protection Officer or designate.

Note: In some cases, personal data may be classified as Internal. This would include contact details provided by a data subject, information found in public address books etc.

When handling classified information, care must be taken to ensure that the contents are not divulged to unauthorised persons. Typical failures include leaving confidential documents unattended on photocopiers or sending email to an unintended recipient.

How we secure confidential information
This section deals predominantly with information that is transmitted electronically; however, confidential information stored physically as paper files etc. should be secured following best practice for physical security, e.g. locked in a secure cabinet or office.

Where sensitive documents need to be sent electronically, we must ensure that the recipient’s contact details are correct. In order to do this, the client or other receiving party should be contacted to ensure that we have the correct details on file.

Where information is deemed to be of a low data protection risk, and when agreed with the receiving party, it is acceptable to send information via email. Consideration should be given however as to whether any documents should be password protected.

Where files contain information of a highly confidential nature, email can still be used; however, the information should always be password protected (and the password sent via an alternative channel, e.g. phone call).

A secure alternative to email that should be considered for collaboration with external parties (and in particular for highly confidential information) is the Viberts iManage Share platform …

iManage Share
iManage Share provides a secure, cloud-based sharing solution that ranges from secure email attachments to large file exchanges and shared collaboration folders. Its web interface allows you to access both your private and shared content. It also enables Viberts administrators to govern user access and firm content.

All Viberts staff have access to iManage Share and help & assistance is available from the Operations team.

Clear desk policy
Viberts has a clear desk policy. Its primary purpose is to ensure that confidential and sensitive information is not made available to unauthorised individuals. All employees should ensure that their desks are cleared, and any personal items appropriately secured, when leaving the office.

Over and above the principles stated in this document, all staff have a duty to colleagues & clients to ensure that every care is taken in guaranteeing the confidentiality and integrity of information.