ISMS Iso27001 Scope PDF

PUBLIC
Information Security Document
Derbyshire County Council

ISO27001 Scope
Version 7.0
V7.0 Derbyshire County Council ISO27001 Scope

1
PUBLIC
Version History
Version Date Detail Author
1.0 01/08/2012 Approved by Information Governance Jo White
Group
2.0 27/03/2013 Reviewed by Information Governance Jo White
Group to expand on scope areas and
processes
Group. Several Asset Owners have
changed.
Group. Incorporation of definitions of
internal and external stakeholders.
Group. Coroners added and Risk Owners
updated. Council business activities
updated.
Group. Department names and Risk
Owners updated.
Group. Changes to department names,
risk owners and departmental statistics.

2
PUBLIC
1.1 Introduction
This document describes the scope of the Council’s Information Security Management
System (ISMS) and how information assets are protected from influences which are
outside of the ISMS scope.
The Council’s ISMS functions in accordance with the ISO27001:2013 standard and all
legal, regulatory and statutory requirements as identified below:
• The Data Protection Act (2018)

• The Freedom of Information Act (2000)
• Environmental Information Regulations (2004)
• The Computer Misuse Act (1990)
• The Human Rights Act (1998)
• The Copyright, Designs and Patents Act (1988).
• The Regulation of Investigatory Powers Act (2000)
• The Electronic Communications Act (2000)
• Privacy and Electronic Communications Regulations (2003)
Also included within this document:

• A written scope defining company core business;
• Boundaries of scope;
• Geographical locations;
• Organisational employee structure; and
• Responsibilities and any other appropriate information.
1.2 Information Security Management System Scope

The Information Security Management System of this Business Management System is
based on BS EN ISO27001:2013.
The scope of the certified Information Security Management System is for:
"The protection of all information and data assets for the delivery of all Council
functions, services and activities - excluding schools. The assets protected are
physical locations, hardcopy data, electronic data, Council records, policies and
procedures, software and licences and physical IT hardware. The boundaries of the
Information Security Management System are the physical locations, authorised
mobile workers and the endpoints of the organisational network. Supporting
technology includes server platforms, network devices and organisational networks
within the control of Derbyshire County Council, in accordance with Statement of
Applicability Ver 5"
1.2.1 Within Scope

Excluding schools, the Information Security Management System applies to all
functions, services, activities and data information assets of Derbyshire County
Council.

3
PUBLIC
1.2.2 Out of Scope

Schools and associated school maintained premises and resources are
managed autonomously. Schools are beyond the scope of the Council’s ISMS
however, the Council provides key services to schools – many of which, schools
may opt in or out of. Workplaces in buildings owned by third parties that Council
staff work from.
1.3 ISMS Scope Boundaries

The relationship between the Council’s internal business/services within the ISMS
scope and those which are out of the ISMS scope are identified below. Council
services and activities within scope have been identified where there is a risk to
information beyond the Council’s business end-points.
OUT OF THE ISMS SCOPE

WITHIN THE ISMS SCOPE
EXTERNAL PARTY
COUNCIL SERVICES
ACCESS TO INFORMATION AND
AND ACTIVITIES
SERVICES
THE PUBLIC, GOVERNMENT

Adult Social Care and Health services
AGENCIES, THIRD PARTIES
Audit Services GOVERNMENT AGENCIES,
POLICE, COURT SERVICES
Call Derbyshire (call centre) THE PUBLIC, THIRD PARTIES
Children’s Services THE PUBLIC, GOVERNMENT
Computer and Internet use logs THE POLICE, THIRD PARTIES
Coroners THE PUBLIC, GOVERNMENT
AGENCIES, COURT SERVICES
Corporate records THE PUBLIC, THIRD PARTIES
Council Employee information POLICE, DISTRICT COUNCILS,
GOVERNMENT AGENCIES
Council premises and facilities THE PUBLIC, THIRD PARTIES
Council public facing websites THE PUBLIC, THIRD PARTIES
Derbyshire Business Centre THE PUBLIC, THIRD PARTIES
THE PUBLIC, THIRD PARTIES,
DISTRICT AND BOROUGH
COUNCILS, SCHOOLS, POLICE,
Derbyshire Record Office NHS, CORONERS,
MAGISTRATES COURTS,
DIOCESE OF DERBY,
GOVERNMENT AGENCIES
Economy, Regeneration and Planning THE PUBLIC, GOVERNMENT
Services AGENCIES, THIRD PARTIES,
SCHOOLS
Finance SCHOOLS, GOVERNMENT

4
PUBLIC
Freedom Of Information requests THE PUBLIC

Hubs THE PUBLIC, THIRD PARTIES
COURT SERVICES, POLICE, THE
Legal services CORONER and ASSISTANT
CORONERS
Libraries & Heritage THE PUBLIC, THIRD PARTIES
GOVERNMENT AGENCIES, THE
Pensions PUBLIC, THIRD PARTIES
Property Services SCHOOLS, THE PUBLIC, THIRD

PARTIES
SCHOOLS, THE PUBLIC,
Waste and Environment Services GOVERNMENT AGENCIES,
THIRD PARTIES
Registrars (Birth deaths and marriages) THE PUBLIC, GOVERNMENT
AGENCIES
SCHOOLS, THE PUBLIC,
School admissions and referrals GOVERNMENT AGENCIES,
THIRD PARTIES
School Support services SCHOOLS, THIRD PARTIES
Subject access requests THE PUBLIC
Trading Standards THE PUBLIC, GOVERNMENT
AGENCIES, COURT SERVICES
THE PUBLIC, GOVERNMENT
Highways and Transport Services AGENCIES, POLICE, THIRD
PARTIES, SCHOOLS
EXTERNALLY CONTRACTED
SERVICES AND SUPPLIERS
• IT Solutions, services and

maintenance
• Disposals
• Building contractors
• Agency workers
• Cleaners
• Offsite storage
• Personal (medical) aides THIRD PARTIES
• Environmental services
• Waste
• Highways
• School and Social Care transport
• Public Transport
• Nursing Homes
• Individual Agencies

5
PUBLIC
In delivering these services, the Council relies on many third party suppliers who are
contracted to provide solutions and services which may store, process and generate Council
information or who may have access to Council information. The Council is also required to
share information with government and other outside agencies due to legal, regulatory,
statutory or business requirements. The Council protects the confidentiality, integrity and
availability of information which is held in locations by suppliers and other agencies that are
outside of the Council’s ISMS scope by ensuring robust procurement processes, contractual
and information sharing agreements are in place.
1.4 Company Stakeholders

Derbyshire County Council delivers services for people of all ages in every community
across the county. Many, but not all, of these services are required due to legal,
statutory or regulatory requirements. Much of the information and data which is held
and/or generated by delivering these services is subject to protection under the Data
Protection Act 1998 and the Council works to ensure that this information is protected
at all times. The Council’s information asset risk management strategy has identified
and appointed information asset Risk Owners from all departments. Risks to
Information assets are recorded in departmental Asset Registers and managed under
the Council’s Information Security Management System (ISMS).
1.5 Key Business Risk Owners

Key business processes include:
Ref Asset Owner Department

1.5.1 Graham Woodhouse Adult Social Care and Health
1.5.2 Andrew Bartle Adult Social Care and Health
1.5.3 Karen Gurney Children’s Services
1.5.4 Chris Newton Children’s Services
Commissioning, Communities &
1.5.5 Graham Morgan
Policy – Trading Standards
1.5.6 Don Gibbs
Policy - libraries
1.5.7 Sarah Eaton
Policy – Policy & Research
1.5.8 Roy Ackrill (DBC) Policy – Derbyshire Business
Centre
1.5.9 Peter Handford
Policy – Finance
1.5.10 David Massingham
Policy - Property
1.5.11 Mark Smith
Policy
Economy, Transport and
1.5.12 Liz Partington
Environment
Economy, Transport and
1.5.13 Angela Glithero
Environment

6
PUBLIC

1.5.14 Emma Crapper
Policy
1.5.15 Simon Hobbs
Policy – Legal Services
1.5.16 Dean Wallace Adult Social Care and Health
1.5.17 Carol Brown
Policy – ICT Services
1.5.1 Graham Woodhouse

Head of Finance, Adult Social Care and Health.
Responsible for Adult Social Care and Health financial client files, finance staff
and finance systems.
1.5.2 Andrew Bartle

Group Manager (Performance), Adult Social Care and Health.
Responsible for Adult Social Care and Health activity other than finance, client
data held in electronic and paper form and other non-financial systems.
1.5.3 Karen Gurney

Finance Manager, Children’s Services.
Responsible for Children and Younger Adults’ financial electronic and paper files,
finance staff and finance systems.
1.5.4 Chris Newton

Head of Information & ICT, Children’s Services.
Responsible for Management Information, ICT and Information Governance for
Children’s Services staff.
1.5.5 Graham Morgan

Head of Trading Standards, Commissioning, Communities & Policy.
Responsible for Trading Standards staff and IT systems. Also responsible for
hardcopy case files and evidence files.
1.5.6 Don Gibbs

Service Director, Libraries & Heritage. Commissioning, Communities & Policy..
Head of Libraries & Heritage.
Responsible for libraries, library management system and user data. Also
responsible for museum artifacts, Derbyshire Record office cataloguing system,
physical archives, book stocks and Arts website.
1.5.7 Sarah Eaton

Head of Policy & Research, Commissioning, Communities & Policy..
Responsible for electronically held data such as systems used by Public Relations,
Complaints, Citizens personal data, Members’ Casework system and
Communications personnel.
1.5.8 Roy Ackrill

HR Service Partner, Commissioning, Communities & Policy.
Responsible for the Derbyshire Business Centre which prints out the majority of
the Council’s mailings, payslips, staff rotas, P60s and pension files. Also

7
PUBLIC
responsible for the delivery and dispatch of post, photocopying, press equipment
and multi-function devices.
1.5.9 Peter Handford

Director of Finance, Commissioning, Communities & Policy.
Responsible for all corporate financial systems, personal data held electronically
on those system, paper based pension files and other paper based financial
records including invoicing. Also responsible for risk and insurance.
1.5.10 David Massingham

Director of Property, Commissioning, Communities & Policy.
Responsible for all council physical premises, asset management and job
management systems, various files and databases used by Property Services and
paper files relating to drawings, invoices and planning.
1.5.11 Mark Smith

Corporate Records Manager, Commissioning, Communities & Policy..
Responsible for hardcopy offsite storage documents, records management within
the Electronic Document and Records Management system, records management
procedural framework.
1.5.12 Liz Partington

Emergency Planning Manager, Economy, Transport and Environment.
Responsible for the Council’s Business Continuity and Emergency plans and
associated underpinning data. Also responsible for the Council’s security key
system.
1.5.13 Angela Glithero

Assistant Director Economy, Transport and Environment (Resources &
Improvement).
Responsible for Economy, Transport and Environment department’s mobile
devices, specialist technical equipment, protective monitoring systems,
departmental ICT systems, personnel, properties and the Council’s vehicle fleet.
1.5.14 Emma Crapper

Director (Organisation and Policy), Commissioning, Communities & Policy.
Responsible for HR System, HR personnel files, medical records, accident/assault
records and corporate learning and development.
1.5.15 Simon Hobbs

Deputy Director Legal Services, Commissioning, Communities & Policy.
Responsible for Legal Services IT System and associated paper files, Council
minutes and reports, general office personal information and financial details and
the Registration Service.
1.5.16 Dean Wallace

Director of Public Health, Adult Social Care and Health.
Responsible for Public Health staff, Public Health and Knowledge Services Teams
personnel information. Also responsible for Public Health Births and Mortality files,
Public Health Hospital Episode Statistics data, Derbyshire Health United Care
Home and Rightcare Contacts information and other data held and shared from
and to the NHS and commissioned providers.

8
PUBLIC
1.5.17 Carol Brown

Assistant Director ICT (Customer Services), Commissioning, Communities &
Policy – ICT Services.
Responsible for the Corporate Service Desk, the Council’s PC and Laptop estate,
equipment commissioning and disposals, the definitive software library, the
Council’s Data Centres, servers, networks, telephony, offsite storage for electronic
data, support and maintenance contracts for equipment, the Council’s technical
specialists, internet, email, other corporate applications, security incident
management and business continuity.
1.6 Company Structure

The company structure can be observed in Appendix 1
Derbyshire County Council employs a workforce of over 16,000 to collect and process
information to enable the delivery of the above services. The Council is also responsible for
the employment and pension information for both the current workforce and retired employees.
1.7 Geographical and Physical
There are approximately 200 key office locations and Derbyshire County Council employees
can also work from home or as mobile workers.
The table below identifies where information assets can be located:
Site Location Asset Types

Main Data Centre, all office
Head Office County Hall, Matlock equipment and core
information assets.
Secondary Data Centre, office
Shand House, Darley
Other Office equipment and information
Dale
assets.
Chatsworth Hall, Office equipment and
Other Office
Matlock information assets.
John Hadfield Office equipment and
Other Office
House, Matlock information assets.
Office equipment and
Derbyshire Record Office Matlock
information assets.
Chesterfield, Denby, Office equipment and
3 Business Units
Doveholes information assets.
9 Highways/Street Office equipment and
Various
Lighting/Transport Depots information assets.
12 Council Social Care Office Office equipment and
Various
Bases information assets.
39 Children and Family Office equipment and
Various
Centres/Homes information assets.
45 Branch Libraries Various
information assets.

9
PUBLIC

22 Registered Care Homes Various
information assets.
29 Day Care Services Various
information assets
7 Countryside Sites/Visitor
Various Office equipment
Centres
Laptops, Paper information
Home & Mobile workers Various assets and Digital information
assets on laptops.
Markham Vale Environment Office equipment and
Chesterfield
Centre information assets.
Breakdown of Council business activities and end-points:
• Supports 416 schools with 6,554 teachers teaching 107,442 children.

• Run 20 children’s centres and support 147 day nurseries, 117 pre-schools, 227
out of school clubs, 8 creches, 23 holiday scheme and 522 childminders
providing early years support.
• Run 18 Youth Resource Centres and 6 mobile youth units.
• Support 412 foster carers, run 12 children’s homes, 7 family support centres
and 2 residential respite care home looking after more than 600 vulnerable
children.
• Help more than 16,145 vulnerable and older people to live at home through
directly provided services, housing-related support and services through the
independent and voluntary sector.
• Support 3,363 people in residential and nursing care.
• Assist 1,589 people to arrange their own services through Direct Payments.
• Maintain almost 3,500 miles of roads, 1,100 bridges, 3,200 miles of public
rights of way and almost 89,000 street columns which have nearly 90,000
street lights.
• Operate a gritting route that covers 1,500 miles, 50% of our roads each year.
• Run 45 branch libraries, 2 mobile libraries, 1 museum, the Record office and
issue approximately 3 million items each year.
• Manage 4 country parks, 7 visitor centres, own 10 nature reserves and provide
positive contributions at 90 local wildlife sites.
• Dispose and recycle more than 388,000 tonnes of local authority collected
waste each year.
• Manage a network of 468 km of multi user trails/greenways.
• Supports 134 School Crossing Patrol sites across the County.
• Have 1,200 businesses that are members on our Trusted Trader scheme, with
feedback from over 13,000 consumers using the scheme each year.
• Provide trading standards advice to 5,816 businesses and members of the
public each year.
• Manage over 400,000 enquiries and referrals annually through Call Derbyshire,
the Council’s contact centre.

10
PUBLIC
• Manage a portfolio of 15 websites; including Derbyshire.gov.uk which is viewed

on average by 220,000 people each month looking at 1.7 million pages.
• Respond to approximately 80 emergency planning incidents each year.
• On average our Commissioning Health Visiting service makes 450 antenatal
visits, 500 new baby reviews, 550 6-8 week reviews, 575 12 month reviews
and 550 2 year reviews per month.
• Commissioned School Nursing service undertakes 8,200 school entry health
reviews, 6,550 Year 6 reviews, 7,500 hearing screenings and 2,733 vision
screenings on average in an academic year.
• Delivery of the National Child Measurement Programme (NCMP) measuring
approximately 8,000 4-5 year olds and 7,500 10-11 year olds.
• Substance Misuse treatment and recovery services treats over 350 children
and over 3,000 adults per year.
• Exercise Referral Schemes takes around 5,000 referrals per year.
• Funded walking for Health programme has over 2,700 participants per year.
• Stop Smoking Commissioned services helps over 1,300 residents to quit
smoking each year.
• Feeding Derbyshire Scheme supports 10,000 people across the county.
• Commissioned Falls prevention programme sees over 1,300 clients per year.
• Manage over 57,000 Service Requests and over 20,000 Incidents annually
through the ICT Service Desk.
• Actively maintain over 99.75% availability of the Council’s ICT Infrastructure.
1.8 Information Security Objectives
Business Objectives are documented in the Corporate Business Plan.
In addition to Business Objectives, Information Security Objectives are also set. These are
discussed in the Information Governance Group Terms of Reference. The Terms of
Reference are due for review in due course and this policy will then be updated accordingly.
Terms of Reference
The Council’s Information Governance Group manage and review the Council’s Information
Security Management System (ISMS) to ensure its continuing suitability, adequacy and
effectiveness. This shall include identifying opportunities for continuous improvement and
the need for change.
Ensure that an appropriate, comprehensive information governance framework is in place

throughout the organisation, in line with national and regional standards.
Review, monitor, publicise and ensure the continuous development of effective information
security related policies, procedures and guidelines.
Ensure information security communications and awareness training is effective.

11
PUBLIC
Ensure the Council remains compliant with information security legislation, regulations, best
practice and contractual obligations.
Ensure the Council’s systems and processes are secure, fit for purpose and the Council is
able to work collaboratively with third parties and exchange information with those third parties
securely.
Raise awareness of issues from the National Cyber Security Centre (NCSC) to build and
improve capability for the Council to manage cyber security threats effectively.
To seek cultural change within the Council, such that keeping personal information safe but
sharing information where it is legal and appropriate to do so, is embedded in everything the
Council does.
Role of the Group:
1. To develop the Council’s Information Governance work programme to establish good

practice, promote a culture of information security awareness and ensure improvements
to existing processes are implemented.
2. To ensure that an appropriate comprehensive Information Governance framework and
systems are in place throughout the Council in line with national standards.
3. To inform and review the Council’s management and accountability arrangements for
Information Governance.
4. To validate reviews of existing information security policies, procedures and guidelines
and develop responses to new threats as they emerge.
5. To develop and maintain an Information Security Management System which conforms
to the ISO 27001 standard.
6. To raise concerns, risks and incidents associated with information security.
7. To establish and support effective communication to ensure that the Council’s approach
to information handling is communicated to all Derbyshire County Council employees,
elected members, partner agencies, contractors and vendors with access to Council
systems and made available to the public.
8. To coordinate the activities of employees given data protection, confidentiality, security,
information quality, records management and Freedom of Information responsibilities.
9. To offer support, advice and guidance to the Caldicott Function and Data Protection
programme within the Council.
10. To monitor the Council’s information handling activities to ensure compliance with law
and guidance.
11. To ensure that security awareness training is made available by the Council and is taken
up by staff as necessary to support their role.
12. To provide a focal point for the resolution and/or discussion of Information Governance
issues.
13. To receive reports from the Access to Information Implementation group
14. To implement effective policies and procedures that embed GDPR compliant operational
practices.
15. To review Privacy Impact Assessment forms and seek to ensure the Council is applying
a consistent approach.
Membership:
The membership of the Information Governance Group will be:

12
PUBLIC
• Director of Finance and ICT (Chair)

• The Council’s Data Protection Officer
• The Council’s Risk Manager or nominee
• The Council’s Records Manager
• One senior representative from each service Department
• One senior representative from Legal Services, Audit Services, Communications, Property
Services, ICT Services and HR Services
Members of the Group will:
• Ensure engagement and awareness of the work of the Information Governance Group
with Executive Directors/Directors and senior management team
• Reflect the views of their department/function and contribute to decision making on
action plans, policy developments and service delivery relating to Information
Governance
• Consult with their department/function and contribute views based up on implications for
implementation of Information Governance requirements from their
departmental/function service delivery perspective
• Keep departments/functions informed on priorities, developments and decisions
• Ensure communication mechanisms are in place within their departments/functions to
ensure information and actions are cascaded throughout the Council
• Implement any agreed actions ensuring consistency of approach throughout the Council
• Influence actions, behaviours and approaches and promote issues regarding Information
Governance within their department/function
• Maintain sensitivity, confidentiality and diplomacy with regard to any proposals
Organisation and Structure:
The Director of Finance and ICT will report data issues to the Council’s Corporate
Management Team (CMT) as appropriate.
In addition the Council’s Data Protection Officer will also report to CMT as they think
appropriate.
Members of the Group are responsible for ensuring that issues raised are reported to their
respective management teams.
Meetings will be held on a monthly basis (Frequency of meetings will be reviewed on an annual
basis from January 2012).
1.9 Responsibilities for Information Security
Derbyshire County Council specifically reviews Information Security in a dedicated

Forum. The following Employees constitute the forum:
• Director of Finance and ICT (Chair);

• Data Protection Officer

13
PUBLIC
• Information Security Manager;

• Adult Social Care and Health Performance;
• Information Children and Younger Adults’;
• Assistant Director Economy, Transport and Environment (Resources &
Improvement);
• Corporate Risk Manager
• Corporate Records Manager;
• Senior Policy and Research Manager Chief Executives;
• Group Manager Property Services;
• Service Relationship Manager Commissioning, Communities & Policy
• Assistant Director ICT Services
• HR Consultant;
• Senior Solicitor Legal Services;
• Principal Auditor;
All information security related issues and incidents are reported to the Information
Governance Group as part of the Agenda and policies and procedures support incident
reporting and management.
1.10 Monitoring and Review

This document shall be continually monitored and shall be subject to a regular review
which shall take place annually, or when a significant change is made.

14

ISMS Iso27001 Scope PDF

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

ISMS Iso27001 Scope PDF

Încărcat de

Drepturi de autor:

Formate disponibile

PUBLIC

Information Security Document

Derbyshire County Council

V7.0 Derbyshire County Council ISO27001 Scope

V7.0 Derbyshire County Council ISO27001 Scope

• The Data Protection Act (2018)

Also included within this document:

1.2 Information Security Management System Scope

The scope of the certified Information Security Management System is for:

1.2.1 Within Scope

V7.0 Derbyshire County Council ISO27001 Scope

1.2.2 Out of Scope

1.3 ISMS Scope Boundaries

OUT OF THE ISMS SCOPE

THE PUBLIC, GOVERNMENT

V7.0 Derbyshire County Council ISO27001 Scope

Freedom Of Information requests THE PUBLIC

Property Services SCHOOLS, THE PUBLIC, THIRD

• IT Solutions, services and

V7.0 Derbyshire County Council ISO27001 Scope

1.4 Company Stakeholders

1.5 Key Business Risk Owners

Ref Asset Owner Department

V7.0 Derbyshire County Council ISO27001 Scope

Commissioning, Communities &

1.5.1 Graham Woodhouse

1.5.2 Andrew Bartle

1.5.3 Karen Gurney

1.5.4 Chris Newton

1.5.5 Graham Morgan

1.5.6 Don Gibbs

1.5.7 Sarah Eaton

1.5.8 Roy Ackrill

V7.0 Derbyshire County Council ISO27001 Scope

1.5.9 Peter Handford

1.5.10 David Massingham

1.5.11 Mark Smith

1.5.12 Liz Partington

1.5.13 Angela Glithero

1.5.14 Emma Crapper

1.5.15 Simon Hobbs

1.5.16 Dean Wallace

V7.0 Derbyshire County Council ISO27001 Scope

1.5.17 Carol Brown

1.6 Company Structure

1.7 Geographical and Physical

The table below identifies where information assets can be located:

Site Location Asset Types

V7.0 Derbyshire County Council ISO27001 Scope

Office equipment and

Breakdown of Council business activities and end-points:

• Supports 416 schools with 6,554 teachers teaching 107,442 children.

V7.0 Derbyshire County Council ISO27001 Scope

• Manage a portfolio of 15 websites; including Derbyshire.gov.uk which is viewed

1.8 Information Security Objectives

Business Objectives are documented in the Corporate Business Plan.

Ensure that an appropriate, comprehensive information governance framework is in place

Ensure information security communications and awareness training is effective.

V7.0 Derbyshire County Council ISO27001 Scope

Role of the Group:

1. To develop the Council’s Information Governance work programme to establish good

The membership of the Information Governance Group will be:

V7.0 Derbyshire County Council ISO27001 Scope