Background
As you may be aware, the public has growing expectations of public organisations to properly and securely handle personal and confidential information. In 2007, the Institute (now retitled The Education University of Hong Kong) has commissioned KPMG as consultant to prepare an Information Security Policy for us. The policy and related procedures took reference to the international standard on information security ISO 27001 (external site, opens in new tab), which covers governance structure, information classification, information handling, incident management and etc.
This policy was approved by the then Institute in Mar 2009 and is applicable to all staff members and students. The Chief Information Officer (CIO) is appointed as the Information Security Officer (ISO) of the University and is responsible for the implementation of the policy.
Information Security Audits are conducted from time to time to make sure that departments have developed the necessary controls or departmental policies to support the policy.
Objectives of the Information Security Policy
To protect the University's members and its reputation through the preservation of Confidentiality, Integrity and Availability (CIA); and
to set out the information security management framework for protecting:
- Personal, vital and sensitive information;
- Infrastructure and information systems; and
- Authorised information users and administrators of the above.
The "CIA" Concept
CIA is the basic concept behind information security. CIA stands for “Confidentiality”, “Integrity” and “Availability”. Apart from protecting the confidentiality of restricted documents, we also need to ensure the integrity or accuracy of the information. Making crucial documents available in a timely fashion is essential for the operation of the University. Public information published by the University must be accurate and available in a timely manner.
What is my role and responsibilities?
Familiarise the requirements of the policy, in particular, in the following areas:
- Classification – classify documents accordingly (“Confidential”, “Internal” and “Public”)
- Labelling – label documents in a visible manner according to the classifications
- Storage* – Confidential documents must be stored in a secured place physically or with encryption when stored on portable storage media (e.g USB thumb drives)
- Copy and Transmission – proper authorisation to copy and transmit Confidential documents
- Disclosure – disclose Confidential materials with proper authorisation
- Disposal – shred/wipe/destroy/degauss the storage media containing Confidential documents before disposal
- Incident Reporting – report information security breach, loss, leakage incidents to Head of Department or ISO (i.e. CIO)
* As per the University's Information Security Policy and related documents, confidential information should only be downloaded to portable storage media with proper endorsement by head of department / line manager as appropriate.
The Information Security Policy and related documents
- The Information Security Policy (PDF file)
- The Information Classification and Protection Policy (PDF file)
- The Information Security Incident Management Procedures (PDF file)
- The Acceptable Usage Policy (PDF file)
- The Password Policy (PDF file)
- The Portable Storage Media Security Policy (PDF file)
- Network and System Hardening Guidelines (PDF file) for all EdUHK information systems and web sites
- Non-Disclosure Agreement template for vendors and service providers (Fillable pdf form (PDF file) for direct use / Word format (Word file) for revisions as needed)
- Personal Data Protection in EdUHK and Personal Data Compliance Manual (PDF file)
Training by OCIO
OCIO organises training workshops from time to time. There are also related training sessions in the quarterly IT training for staff.
- Information Security Workshop with Lessons Learnt 2019 Presentation Slides (PDF file) / Video (video, opens in new tab)** <English only> (for INTERNAL only)
- IT Training for Staff
**Note: The video can only be viewed on modern browsers such as Chrome, Firefox and Microsoft Edge.
Training by KPMG
The very first training workshops on the policy were given by KPMG consultants in Jun 2009. The presentation slides are available below. More workshops were held in Sep/Oct 2009 for staff and students. Though some of the figures and cases quoted may be out-dated, the key principles remain valid as of today. The materials below also provide some background on the establishment of the Information Security Policy and related documents at the University.
- Information Security Training Slides Part One (PDF file) and Part Two (PDF file) (for INTERNAL only)
- Information Security Poster (PDF file)
JUCC Information Security Awareness Workshop Materials - by JUCC Information Security Task Force
The Joint Universities Computer Centre (JUCC) (external site, opens in new tab)'s Information Security Task Force meets regularly to discuss matters of concern. Previously, KPMG was commissioned to help the UGC-funded institutes to prepare their Information Security Policy. Promotional events were held to enhance awareness of staff and students. The following are some useful materials for reference.
- Training workshop for staff and students conducted by KPMG on 27 Oct 2011 - training poster (PDF file), presentation slide Part One (PDF file), Part Two (PDF file), Part Three (PDF file), Part Four (PDF file) and Part Five (PDF file) (for INTERNAL only)
- A two-day conference "Implementing Information Security in the Higher Education Community (external site, opens in new tab)" for senior management and technical staff in The Hong Kong Polytechnic University on 19-20 May 2011.
- Training workshop for staff and students conducted by KPMG on 23 Mar 2011 - training poster (PDF file), presentation slide Part One (PDF file), Part Two (PDF file), Part Three (PDF file) and Part Four (PDF file) (for INTERNAL Only)
- Training workshop for staff and students conducted by KPMG on 20 Oct 2010 - training poster (PDF file), presentation slide: Part One (PDF file), Part Two (PDF file), Part Three (PDF file) and Part Four (PDF file) (for INTERNAL Only)
- A two-day conference for senior management and staff in The Hong Kong Polytechnic University on 19 - 20 May 2010.
- Training workshop for staff and students conducted by KPMG on 24 Mar 2010 - training poster (PDF file), presentation slide: Part One (PDF file), Part Two (PDF file), Part Three (PDF file) and Part Four (PDF file) (for INTERNAL Only)
Feedback
If you have any queries and feedback on the Information Security Policy, please kindly send to listen@ocio.eduhk.hk .
Related pages
