University Information Security Policy

The overall objectives for information security are that: 

• a culture is embedded to ensure all teaching, research and administration activities consider information security, including preparation for responding to cyber security events
• individuals are aware and kept informed of their information security responsibilities
• information security is managed on the basis of an assessment of risk to information assets
• information assets are identified and controls are applied proportionately to mitigate risks to a defined level of tolerance in a cost-effective manner
• authorised users can securely access information to perform their roles
• facilities, technologies, and services adequately balance usability and security
• pragmatic, effective, and measurable security controls reflect the state of the art
• contractual, regulatory, and legal obligations relating to information security are met
• incidents are effectively managed and resolved
• constituents of the University of Oxford domain develop resilience from the effects of major cyber security incidents
• information security complies with the recognised international standards ISO 27001/2 and supports compliance with other standards as demanded by research sponsors such as the NHS Data Security and Protection Toolkit (DSPT).

These objectives must cascade into lower-level objectives at university and departmental levels and plans must be drawn up at each level to ensure they are achieved.

The ISMS is underpinned by and Information Security Policy Framework (ISPF), comprising a series of policies and procedures, to ensure that:

• a consistent and planned approach is taken to information security
• information security risk is managed through risk assessments on IT systems and services, information assets and business processes
• information security requirements are covered in agreements with third-party partners or suppliers, and these are monitored for compliance
• appropriate information security controls are implemented to protect all IT facilities, technologies and services used to access, process and store university information
• these controls, described in the baseline, are to be enforced by all constituents on the Oxford domain
• controls are monitored to ensure they are adequate and effective
• all information security incidents are reported in a timely manner via appropriate management channels, information systems are isolated, and incident thoroughly investigated and managed
• all constituents’ information assets are identified, owned, classified according to how critical and sensitive they are, and rules for their use are in place
• business continuity and disaster recovery are planned and exercised in case of a major cyber event
• communications are planned and manged.

The ISPF will be governed by the Joint Information Security Advisory Group (JISAG) and maintained by the Information Security Team.

The following bodies and individuals have specific information security responsibilities: 

• Council has executive responsibility for information security risk within the university. Council must determine the system of internal controls and monitor the adequacy and effectiveness of the control environment. This responsibility will be enacted via the Information and Digital Committee via representation from the Joint Information Security Advisory Group. The Conference of Colleges Security Advisory Group (ISAG) and The Security Subcommittee of the General Purposes Committee will provide additional checks and balances.
• Information and Digital Committee (formerly IT Committee) This is a primary committee of council and is charged by council with providing the appropriate assurances that the cyber security risk is being managed.
• Joint Information Security Advisory Group (JISAG) is a joint body between the university and the conference of colleges. It is responsible for reviewing the information security policy framework, making decisions on the baseline control set, reviewing reports on compliance, escalation of risks and issues, and provide collectively agreed recommendations to the university.
• Chief Information Security Officer (CISO) is responsible for establishing and maintaining the university’s information security policy framework to reduce the risks to the availability, integrity, and confidentiality of the university’s information. The CISO will define and implement the university’s information security strategy and lead operational and improvement programmes.
• Information Security Team is responsible for maintaining the university’s information security policy framework, including the Baseline, and monitoring compliance against with appropriate assessments and internal audits. It also maintains a capability to conduct cyber incident response. The Information Security Team will provide services to the university and colleges to support a unified and collaborative approach to reducing risks to personal information, research data, operational systems around Oxford.
• Heads of Division / Heads of House are responsible for the oversight of information security arrangements for their colleges or departments or faculties within their division to ensure that they are functioning in accordance with this policy.
• Heads of Department and Faculty Board Chairs are responsible for the effective implementation of this information security policy, and supporting information security rules and standards, within their department or faculty. This includes the provision of appropriate levels of People (ITSS), Process and Technology to complete local information security requirements.
• All Staff and Students and other users handling university information, are required to complete information security awareness training including an annual refresher. They are responsible for making informed decisions to protect information, including datasets for research and teaching and all other university documentation. They are also responsible for reporting incidents promptly.

The Information Security Team will conduct information security audit and assurance activities to ensure information security objectives and the requirements of the ISPF are met. Staff and students are to be reassured that individual security failures can be reported without repercussions and their privacy will be preserved. Wilful failure by a constituent to comply with the policy and baseline may result in enforcement action or exclusion from the network.  

This policy should be read in conjunction with related policies and regulations, including: 

• Data Protection Policy
• Regulations relating to the use of Information Technology Facilities.

This policy and supporting ISPF documentation, will be reviewed and updated by JISAG on an annual basis to ensure that they:

• minimise the risk of harm to our people from a personal data breach
• reassure our research funders that cyber security matches their expectations
• enable the university to continue to operate despite malicious cyber activity

preserve the reputation of the university by ensuring that controls are

• fit for purpose
• improved where necessary
• reflect changes in technologies
• are aligned to industry best practice and associated standards support
• continued regulatory, contractual, and legal compliance.