{"text_format":"3","workbook":"xls","n_sheets":1,"sheets":["General controls"],"not_rendered":{"external_links":1,"defined_names":1},"read":"whole","date_system":"1900","formulas":"cached_only"}

{"sheet":"General controls","index":0,"n_rows":118,"n_cols":4,"rows_kept":118,"flags":["formulas_cached_only"]}
["High level information security questionnaire"]
[]
[null,"Question","Y or N","Additional comment or supporting evidence"]
["1. Security Governance"]
["a","Is there an Information Security Policy ?","Yes"]
["b","Is this aligned with ISO 17799?","Yes","ISO 27001"]
["c","Is there a documented risk assessment methodology deployed to assess security risks associated with new developments/infrastructure changes?","Yes"]
["d","Are measures in place to provide user awareness of the policy and controls for staff working in the Data Centre?","Yes"]
["e","Are regular security audits or penetration tests undertaken?","Yes"]
["f","Are these internal or external? If external, give details as to type of test, third party who carried out testing, summary of results?","Yes","Both have been tested"]
["2.1 Physical - site"]
["a","Does the site appear to meet security requirements given the importance of the site (consider gates, fences, site access, etc.)?","Yes"]
["b","Is the site located away from obvious hazards, such as flooding, air strip or chemical plant?","Yes"]
["c","Are facilities used for National Grid segregated in a separate area? IF so, how is access controlled?"]
["2.2 Physical security - computer room"]
["a","Is the network equipment stored within a separate computer room?","Yes"]
["b","Is the computer room located away from water sources?","Yes"]
["c","Is the computer room located in a difficult to get to location (ie. above ground floor and away from the site perimeter)?","Yes","Located in a secure underground ex-MOD bunker"]
["d","Are measures in place to prevent equipment being visible form outside of the room.","Yes"]
["2.3 Physical - computer room access"]
["a","Does the room have a locked door?","Yes"]
["b","Is there adequate control over the allocation and circulation of keys, swipe cards or other access tokens? Describe.","Yes","All access is via escort from Ssecurity approved  personel"]
["c","Are only certain and authorised people allowed to approve distribution of keys or swipe cards?","Yes"]
["d","Is the list of personnel with keys or swipe cards formally reviewed on a regular basis? If so, how regularly?","Yes","In line with the Bunkers security policy"]
["e","Are cleaning staff restricted from access to the room, and supervised?","Yes"]
["2.4 Physical - computer room envirnment"]
["a","Does the room have a fire detection system?","Yes"]
["b","Does the room have a fire suppression system?","Yes"]
["c","Does the room have a flood detection system?","Yes"]
["d","Does the room have a raised floor?","Yes"]
["e","Does the room have a temperature and humidity monitoring system?","Yes"]
["f","Does the room have air conditioning?","Yes"]
["g","Does the room have CCTV?","Yes"]
["h","Are materials that may be a fire hazard or contain hazardous material not stored inside of the computer room?","Yes","Not Stored inside computer room"]
["i","Are the environmental measurements monitored?","Yes"]
["2.5 Physical - power supply"]
["a","Does the room have power a single computer from dual, independent panels?","Yes","A&B UPS systems"]
["b","Does the room/computer have a UPS? If so, for how long?","Yes","Inline with hotstart generator start up times"]
["c","Does the room have a backup power generator? If so, for how long?","Yes","Ability to run for 90 days"]
["d","Does the computer room have an emergency power cut off?","Yes"]
["e","Is the site supplied by power from different sub-stations?","Yes"]
["2.6 Physical - comms and cabling"]
["a","Are there multiple physical telecommunication lines into the computer room that are in separate ducts?","Yes"]
["b","Are only approved wireless LANs or other wireless devices in use at the site?","Yes"]
["c","Is all communication equipment housed in a suitable case or cabinet?","Yes"]
["d","Is all cabling housed in a protective covering?","Yes","Where relevant"]
["e","Is all cabling cleared labelled, with appropriate hazard and warning signs?","Yes","Where relevant"]
["2.8 Management"]
["a","Are maintenance schedules on key parts of the infrastructure adhered to (consider fire suppressions system, electrical and UPS batteries, cooling equipment)?","Yes"]
["b","Is the standard change control process used to cover changes to the infrastrcuture and configuration of firewalls, routers, etc?","Yes"]
["c","Is all equipment monitored for faults centrally?","Yes"]
["3. Personnel"]
["a","Are there clear guidelines for staff on use of IT systems as part of their T&Cs, confidentiality agreements, and a disciplinary process for breach of these?","Yes"]
["b","Is Screening of staff part of the recruitment process? If so, who does the background check?","Yes","To be confirmed"]
["c","Are users trained in security requirements and procedures?","Yes"]
["d","Are there procedures for reporting security issues, risks and incidents?","Yes"]
["e","Are the same security controls applied to contractors and consultants?","Yes"]
["4. Change management"]
["a","How is the change control processed managed?","Yes","Through support system - Where required we can work to change control management procedures."]
["b","What are the configuration management procedures for control of software versions through the build, test, and release process?",null,"We customise to meet individual client requirements."]
["c","Procedures are in place for the control of source libraries, development tools, and developed products?",null,"As above"]
["5. Operational management"]
["a","Detailed documented operating procedures exists?","Yes"]
["b","Is there a documented security incident response and escalation procedure?","Yes"]
["c","Are operator duties segregated for security purposes?","Yes"]
["d","Are any external management services or facilities employed?","Yes","Facility employed in this case is www.thebunker.net"]
["e","Are software licenses recorded and controlled?","Yes"]
["f","Up to date anti virus software is applied to all servers, desktops and laptops, and at the perimeter? If so, provide details.","Yes","CA E-Trust"]
["g","What data and application back-up and restoration procedures exist?",null,"Daily backup, monthly restore testing, but customisable to requirements."]
["h","Are system and security logs regularly reviewed?","Yes"]
["i","What equipment disposal procedures exist?",null,"We are WEEE compliant"]
["j","Are servers and other devices patched in a timely and regular manner? If so, what tools are used?","Yes","At least once a week, using OS based propietary tools."]
["k","What are the out-of-hours support arrangements?",null,"Guaranteed 2 hr response to critical issues."]
["6. Logical access controls"]
["a","Is there a general policy or procedure governing network and server access rights?","Yes"]
["b","Are there procedures in place governing the use of privileged accounts, and are records maintained of privileged users?","Yes"]
["c","Are there procedures in place for the authorisation of users, maintenance of user records and deletion of user accounts?","Yes"]
["d","Is there a password policy and procedure? If so, does the policy meet up with at least three of the following:","Yes"]
[null,"Password minimum length of 8 characters","Yes"]
[null,"Password should be a mix of alpha and numeric characters","Yes"]
[null,"Password should be a mix of upper and lower case"]
[null,"Password should include a special symbol","Yes"]
["e","Passwords expire every 30 days"]
["f","All system users shall have a unique user identifier.","Yes"]
["g","User identifiers shall not provide any indication of the likely access facilities available to that user."]
["h","Following 60 days of inactivity, the access rights of any user shall be disabled.","Yes"]
["i","Are there controls in place for access to different networks and network services?","Yes"]
["j","Are there any user authentication techniques employed other than Passwords and IDs (eg. Token based access)","No"]
["k","Is any use made of encryption or digital signatures?","Yes"]
["l","Are staff allowed work out of the office/Data Centre e.g., from home? If so, how is remote connections made?","Yes","Via VPN to office only."]
["m","What are the controls on permitted network protocols and connection types?",null,"Port access is restricted at a FW level."]
["n","What controls are in place governing access to software applications?"]
["o","What are the controls to prevent unauthorised access to the network (eg. 3rd party laptop)?"]
["p","Automatically generated system logs shall be maintained to record security incidents.","Yes"]
["q","Event logs shall be protected from unauthorised review of their contents.","Yes"]
["r","Event logs shall include unauthorised access attempts, all privileged user activities, access to sensitive information such as password files.","Yes"]
["7. Network management"]
["a","Is the Data Centre's network physically separate from the main company's network?","Yes"]
["b","If not, is there some logical separation such as firewall? If so, please give as much detail as you can?","N/A"]
["c","From b, is there a formal firewall rule and change management process?"]
["d","From b, is there regular review of firewall rules?"]
["e","From b, is there regular penetration tests of these firewalls?"]
["f","Access by third parties shall only be authorised provided a business need has been identified."]
["g","Security controls will be agreed and defined in the contract with the third party."]
["h","Are Intruder Detection Systems (IDS) installed, and if so how are these monitored?","Yes","Physical"]
["8. Development and maintenance"]
["a","Is a standard project planning & development methodology used on the National Grid account?","N/A"]
["b","Duties are suitably segregated to ensure that the opportunity for unauthorised activities is reduced.","N/A"]
["c","Data entry, system administration, systems development/maintenance, change management and security administration are segregated.","N/A"]
["d","Are there procedures in place to include hardware and software security requirements in specification documents?","Yes"]
["e","Does system testing include security requirements - eg  data validation, firewall functions and resilience?","Yes"]
["f","Access to program source libraries shall be controlled in a manner that is consistent with the business risks.","N/A"]
["g","Are there software change control processes for applications, operating systems and layered products on servers and network devices?","Yes"]
["h","What quality records are maintained of the overall development & maintenance processes?","N/A"]
["9. Business continuity and DR"]
["a","Has an assessment of business continuity and disaster risks been undertaken?","Yes"]
["b","Do business continuity plans and DR procedures exist? If so, can we have details.",null,"Depends on customer requirements - we can customise at your request."]
["c","Business continuity and DR procedures are exercised regularly? If so, how often?",null,"Depends - All of Blue Sky's disaster recovery solutions are built on a per customer basis"]