Dealing with documents received
11 Dealing with documents received
The Principal Public Interest Monitor must develop written procedures for dealing with witness protection data, including the creation and maintenance of the following—
an information security policy;
an access control policy;
procedures for monitoring access activities in respect of witness protection data;
procedures for ensuring that all witness protection data is adequately protected;
a risk management policy for identifying, analysing and treating security risks to witness protection data;
reporting, escalation and response procedures for information security events or identified weaknesses in information security that may affect witness protection data;
a process for the continual monitoring and improvement of an information security incident.
In this regulation—
information security event means an identified occurrence of an information system, service or network state indicating—
a possible breach of information security policy; or
a failure of safeguards; or
a previously unknown situation that may be security relevant;
information security incident means a single information security event or a series of information security events that is likely to have compromised the security of information.
The statute text is free to read above. View subscription options to unlock the case-law research tools for each provision.