Departmental Data Protection

Anne Main
To ask the Secretary of State for Children, Schools and Families what auditing his Department undertakes to ensure that IT security policies are being followed; and on how many occasions (a) IT security policies have been breached by employees and (b) a member of staff has been sanctioned for a breach of such policies in the last 12 months.

Sarah McCarthy-Fry
Information is a key asset to Government and its correct handling is vital to the delivery of public services and to the integrity of HMG. The Security Policy Framework, the Data Handling Report and the National Information Assurance Strategy produced by the Cabinet Office provide a strategic framework for protecting information that Government handles and put in place a set of mandatory measures which Departments must adhere to.

The Department has a programme of regular and ad-hoc auditing in place to ensure policies are being followed, including audits of staff awareness/compliance and security sweeps of DCSF buildings.

For the period 1 March 2008 to 28 February 2009, the Department for Children, Schools and Families had two serious breaches of IT security policies, which resulted in one member of staff being dismissed and one member of staff having a laptop confiscated.

During the same period, the Department also had a number of less serious breaches, such as mobile IT equipment being stored in unlocked storage, which were dealt with in accordance with the Department’s security breach policy.

Anne Main
To ask the Secretary of State for Children, Schools and Families if he will place in the Library a copy of his Department's IT security hierarchy.

Sarah McCarthy-Fry
Information is a key asset to Government and its correct handling is vital to the delivery of public services and to the integrity of HMG. The Security Policy Framework, the Data Handling Report and the National Information Assurance Strategy produced by the Cabinet Office provide a strategic framework for protecting information that Government handle and put in place a set of mandatory measures which Departments must adhere to.

It is not in the interest of the security of the Department, or that of the public, to disclose detailed information pertaining to the security of the Department's IT systems. Disclosing such information would enable criminals and those who would attempt to cause disruptive threats to the Department to deduce how to conduct attacks and therefore potentially enhance their capability to carry out such attacks.

Anne Main
To ask the Secretary of State for Children, Schools and Families what scanning for vulnerabilities his Department conducts of each of its IT devices; what method is used for IT device scans; and how many vulnerabilities have been detected as a result of such scans in the last 12 months.

Sarah McCarthy-Fry
Information is a key asset to Government and its correct handling is vital to the delivery of public services and to the integrity of HMG. The Security Policy Framework, the Data Handling Report and the National Information Assurance Strategy produced by the Cabinet Office provide a strategic framework for protecting information that Government handle and put in place a set of mandatory measures which departments must adhere to.

It is not in the interest of the security of the Department, or that of the public, to disclose detailed information pertaining to electronic breaches of security of departments’ IT systems. Disclosing such information would enable criminals and those who would attempt to cause disruptive threats to the department to deduce how to conduct attacks and therefore potentially enhance their capability to carry out such attacks.

Anne Main
To ask the Secretary of State for Children, Schools and Families what IT security policy his Department has; what procedures are in place to ensure the policy is being followed; what his Department’s policy is on encryption of data when it leaves departmental premises; and what sanctions are in place for failure to comply with this policy.

Sarah McCarthy-Fry
Information is a key asset to Government and its correct handling is vital to the delivery of public services and to the integrity of HMG. The Security Policy Framework, the Data Handling Report and the National Information Assurance Strategy produced by the Cabinet Office provide a strategic framework for protecting information that Government handles and put in place a set of mandatory measures which Departments must adhere to.

The Department for Children, Schools and Families is compliant with the security policies contained in the Government Security Policy Framework including those for information security and assurance. Compliance arrangements comprise a system of self assessment, accreditation, assurance reporting, audit and review. Depending upon the circumstances, a range of sanctions are available including disciplinary or administrative action, and in extreme or persistent cases, termination of employment/services and, if appropriate, criminal proceedings.