Policies

The following policies (listed in alphabetical order) are the policies that are required in support of the University's Information Security Policy. These documents will be published over a period of time and added to this web site when they become available.

Those to whom any Supporting Policy applies are expected to be either compliant with it within three months of that policy being approved by the ISG, or have an action plan through which to achieve compliance within three months of approval, and be actively and demonstrably working towards it.

1. Access Control & Account Management Policy (v1.6) | (updated 9 August 2007)
2. Archiving Policy
3. Asset Management Policy
4. Business Continuity Policy
5. Change Control Policy
6. Information Classification & Protection Policy (updated Nov 2007)
   Draft policy showing track changes
7. Information Security Awareness & Training Policy
8. Legislation Compliance Policy
9. Media Marking & Storage Policy
10. Mobile & Remote Working Policy (v2.2) | (updated 8 April 2008)
11. Password Usage & Management Policy (v 1.2) | (updated 16 December 2008)
12. Personnel Security Policy
13. Physical Security & Access Control Policy
14. Policy on Safeguarding Data - Storage, Backup and Encryption (v1.0) | (30 September 2008)
15. Risk Assessment Policy
16. Security Assurance Testing Policy
17. Security Incident & Computer Misue Policy (v1.1) | ( updated 13 September 2007)
18. Security Patching Policy (1.2) | (updated 2 January 2008)
19. Software Usage & Control Policy (v2.3) | (updated 14 September 2009)
20. Systems Security and Network Access and Management Policy (v2.7) |  (PDF) (updated 20 Feb 2012)
21. System Usage Logging & Audit Policy
22. Third Party Network Connection Policy
23. Use of Computer Systems Policy (Incorporating Internet, Web & E-mail Acceptable Usage) (v2.7)| (updated 22 August 2007)
24. Virus Protection & Management Policy (v1.3) | ( updated January 2008)