Acceptable Use
This policy sets out how we manage and handle our IT equipment and data, and the standards that must be observed when using and/or accessing them.
Acceptable Use PolicyAccess Control
The purpose of this policy is to ensure that all access to The Open College of the Arts (OCA)’s IT environment is controlled.
Access Control PolicyAsset Management
The purpose of this policy is to specify and communicate the requirements for the management of all the Open College of the Arts (OCA)’s information and IT assets (logical or physical).
Asset Management PolicyBackup and Recovery
The purpose of this policy is to specify and communicate the requirements for backup and recovery of The Open College of the Arts (OCA)’s IT systems, and to ensure that backup and recovery procedures and technology are in place to protect the OCA from losses or corruption of information, software or systems.
Backup and Recovery PolicyChange Management
The purpose of this policy is to ensure that there is a robust process for requesting, evaluating, testing, and implementing changes to prevent an adverse impact to the existing IT network and systems.
Change Management PolicyThe Change Management process ensures that IT changes within the Open College of the Arts (OCA) are controlled, documented, and implemented with minimal disruption to business operations. Zendesk will be utilised as the IT Service Management (ITSM) tool to perform change tracking, approvals, and reporting. This process will maintain compliance with the Change Management Policy.
Change Management ProcessCryptographic Controls
The purpose of this policy is to specify and communicate the minimum requirements for use of cryptography in the protection of The Open College of the Arts (OCA) data.
Cryptographic Controls PolicyDigital Communications Standard
The Email and Communications Policy establishes the college’s expectations from employees in regards to their use of digital tools for communications purposes. This Standard details the measures which must be followed in maintaining compliance with that policy. This standard applies to all employees of the college (inclusive of external contractors and other third parties), in addition to the systems it owns and/or uses.
Digital Communications StandardIncident Response
The purpose of this policy is to specify and communicate high-level guidance and requirements for managing and responding to information security incidents.
Incident Response PolicyInformation Classification Handling
The purpose of this policy is to specify and communicate The Open College of the Arts (OCA)’s policy in regard to the classification and handling of information.
Information Classification Handling PolicyInformation Security Audit and Compliance
The purpose of this policy is to specify and communicate the requirements for conducting information security audits at the OCA and ensuring compliance with the relevant legislative, statutory, regulatory and contractual requirements.
Information Security Audit and Compliance PolicyInformation Security Glossary
The purpose of this document is to provide a general glossary of terms used in information security documentation.
Information Security GlossaryInformation Security Management System (ISMS)
The purpose of this Information Security Management System (ISMS) policy is to define a systematic approach for establishing and maintaining an ISMS, protecting the confidentiality, integrity, and availability of information assets within the Open College of the Arts (OCA). This policy ensures compliance with applicable regulations, enhances risk management and safeguards data from security threats.
Information Security Management System (ISMS) PolicyInformation Security Risk Management
The purpose of this policy is to specify and communicate guidance and requirements for the effective management of information security risk across The Open College of the Arts (OCA).
Information Security Risk Management PolicyLogging and Monitoring
The purpose of this policy is to ensure that access to sensitive and/or critical networks, systems, applications and facilities, and any other relevant event data, are appropriately logged and collated for investigative and audit requirement, and logs are appropriately protected, retained for an appropriate length of time, and regularly monitored.
Logging and Monitoring PolicyNetwork Security
The purpose of this policy is to specify and communicate requirements for the security of the Open College of the Arts (OCA) networks.
Network Security PolicyRemote Working
The purpose of this policy is to ensure that OCA implements information security best practice for its remote working activities.
Remote Working PolicyRisk Management
The Risk Management Process outlines the various stages we need to undertake to fully understand our risks and identify the best ways to manage them.
Risk Management ProcessSecure Software Development
The purpose of this policy is to ensure that appropriate controls, including information security controls, are applied throughout the life cycle of all the Open College of the Arts (OCA) information systems, whether developed in house, by third parties or purchased off the shelf or via cloud services for internal production.
Secure Software Development PolicyThird Party Vendor Management
The purpose of this policy is to specify and communicate information security requirements for vendor engagement, on-boarding and management.
Third Party Vendor Management PolicyThis process sets out the required actions to be taken by the OCA to ensure vendors collaborating with, or providing products or services to the College, do so securely and in-line with the requirements of the Third-Party Vendor Management Policy.
Third Party Vendor Management ProcessThreat and Vulnerability Management
The purpose of this policy is to specify and communicate the requirements for vulnerability and patch management, for all of The Open College of the Arts (OCA)’s IT network devices and systems.
Threat and Vulnerability Management Policy