Information Security Policy

Introduction & Purpose

The Union of Students recognises that information is a valuable organisational asset and is committed to protecting it from threats, whether internal, external, accidental, or deliberate.

The purpose of this Information Security Policy is to ensure that the Union of Students protects the confidentiality, integrity, and availability of all information that it holds, processes, stores, or transmits.

This policy establishes the principles and responsibilities for safeguarding personal data, organisational information, systems, and assets against unauthorised access, disclosure, alteration, loss, or destruction.

The Union will implement appropriate technical and organisational measures to ensure that information is protected according to its sensitivity and legal requirements.

Scope

This Policy relates to all information assets owned, processed, or managed by the Union and all information systems, devices, networks, applications and cloud services.

This policy applies to:

• Employees;
• Elected Officers;
• Trustees;
• Student Representatives;
• Community Leaders;
• Volunteers;
• Contractors and Consultants;
• Agency Workers;
• Third Parties processing personal data on behalf of the Union.

Principles of Information Security

The Union will protect information through the following principles:

Confidentiality

Information will only be accessible to individuals who have a legitimate need to access it as part of their role.

Integrity

Information must be accurate, complete, and protected from unauthorised modification.

Availability

Information and systems must remain accessible to authorised users when required to support Union operations and services.

Roles and Responsibilities

Board of Trustees

The Board of Trustees has overall responsibility for ensuring that effective information security arrangements are in place.

Chief Executive Officer

The Chief Executive Officer is responsible for ensuring that this policy is implemented and maintained throughout the organisation.

Data Protection Officer

The designated Data Protection Officer is responsible for:

• Monitoring compliance with data protection legislation;
• Advising on information security risks;
• Managing data breach responses.;
• Coordinating staff training and awareness.

Staff, Officers, Trustees & Volunteers

All individuals acting on behalf of the Union are responsible for:

• Following this policy and related procedures;
• Protecting information they access during their duties;
• Reporting security incidents promptly;
• Maintaining the confidentiality of personal and organisational information.

Access Control

The Union will implement access controls to ensure that:

• Access is granted only on a need-to-know basis;
• User accounts are unique to individual users;
• Passwords are kept secure and not shared;
• Access rights are reviewed regularly;
• Access is removed promptly when employment, volunteering, or responsibilities end;

Multi-factor authentication should be enabled where available for systems containing personal or sensitive information.

Information Classification

Information should be classified according to its sensitivity and handled appropriately. All formal documentation will be tagged with one of the following:

Public

Information approved for public release.

Internal

Information intended for internal Union use only.

Confidential

Information that could cause harm if disclosed without authorisation, including financial information, personnel records, and operational documents.

Where documents are tagged as confidential, special measures should be put in place to mitigate the risk of disclosure. This includes sending files via secure file storage methods, password protection and clear labelling and communication of the classification.

Secure Use of Technology

Users must:

• Keep devices secure when unattended;
• Lock screens when leaving workstations;
• Install only authorised software;
• Only store Union information on Union or University devices;
• Use approved cloud storage, software and collaboration platforms;
• Ensure anti-malware and security updates are maintained.

E-Mail and Internet Security

Users must:

• Exercise caution when opening emails, links, and attachments;
• Report suspected phishing attempts immediately;
• Use Union email accounts for Union business;
• Not send confidential information unless appropriate safeguards are in place.

E-Mail & File Management

To ensure compliance with this policy, our Data Protection Policy and our responsibilities related to Subject Access Requests, the Union will implement an E-Mail Management procedure.

Physical Security

The Union will protect physical information assets through:

• Secure storage of confidential documents;
• Controlled access to offices and storage areas;
• Secure disposal of confidential waste;
• Appropriate visitor management procedures.

Paper records containing personal information must not be left unattended in public or unsecured areas.

Information Retention and Disposal

Information will be retained in accordance with the Union's Retention Schedule.

When information is no longer required, it will be securely disposed of through:

• Secure deletion of electronic files;
• Shredding or confidential disposal of paper records;
• Secure destruction of storage media where appropriate.

Information Security Incidents

All actual or suspected information security incidents must be reported immediately via the Data Breach Procedure.

The Data Protection Officer will then report incidents to the Head of Operations where this is regarding the loss or theft of equipment or cybersecurity incidents.

Training and Awareness

The Union shall ensure that all relevant individuals receive appropriate training and guidance.

The Union will also ensure appropriate resource and support is available to the Data Protection Officer to enable them to fulfil their duties.

Monitoring and Compliance

The Union shall monitor compliance with this Policy through audits, reviews, investigations, reporting arrangements and other assurance activities.

Failure to comply with this Policy may result in disciplinary action, termination of contractual arrangements, withdrawal of access privileges and, where appropriate, referral to relevant authorities.

Related Documentation

The Policy should be read in conjunction with the following policy & guidance documentation:

• Data Protection Policy
• Retention Policy
• Data Protection Guidance documents and processes found on the Union How-To pages