Information Governance and Compliance
Learning outcome 1: Critically examine, assess, and investigate the policies, standards, methodologies and procedures, around information governance and their impact on security frameworks in modern and dynamic information systems with clear references to the value of information and organisational assets
Learning outcome 2: Assess, classify, evaluate and review current legal and regulatory requirements, record management and auditing processes and their influence upon self-preserved, dynamic and versatile information governance programmes and frameworks
You will produce an electronic portfolio based on the scenario below. The portfolio should include the following:
1. An outline information governance policy for the Luton and High Town Hospital Trust.
2. An information security incident response and disaster recovery plan for the Luton and High Town Hospital Trust
3. A risk management plan for the Luton and High Town Hospital Trust identifying the main risks associated with the given scenario and outlining mitigations for each
4. An information security roadmap for the Luton and Nigh Town Hospital Trust identifying the technical measures that need to be put in place in order to improve the security and governance for their sites
Scenario
Luton and High Town Hospital Trust have employed you as an information governance consultant to help them develop their information governance and security procedures. They currently have 20 hospitals and five walk-in clinics as well as 15 GP practices.
The Trust has an IT team of twenty people including two information security specialists, ten desktop specialists, four network specialists, one network administrator, a Chief Information Security Officer (CISO) and a Chief Information Officer (CIO).
Each of their facilities is connected via an Ethernet Local Area Network (LAN) with a variety of PCs, printers, laptop machines and a main server. Each local network is connected to a Wide Area Network for the entire Trust meaning that information can be shared across the facilities. In addition, each facility has an external connection to the Internet, and each has a staff (protected/private) Wireless network as well as an open wireless network for members of the general public.
Due to the sensitive nature of patient records, as well as the main application server there are also a local file server, email server and database server, all of which are able to serve all sites on the Wide Area Network. These are physically located on a central site and are managed by the in-house IT team.
Staffing (general)
Each hospital has:
a) A general manager
b) Doctors, nurses and lab specialists
c) Cleaning team
Each walk-in centre has:
a) Doctors
b) Two nurses
c) Reception manager and a team of four receptionists
Each GP practice has:
a) A Practice manager
b) Team of doctors who work on-site, but who also perform home visits and can manage and access patient records via a tablet device
c) Practice nurse
In addition to these staff, the Trust uses an external security firm to provide a team of:
a) 6 security guards for each hospital
b) 3 security guards of each walk-in centre
c) 1 security guard for each GP practice
Over the last twelve months there have been a number of security incidents:
a) Three phishing attacks in which there were two successful attempts to access staff details within the main Luton hospital
b) 1 unsuccessful ransomware attack
c) Five social engineering attacks on reception staff, all of which were successful and led to patient files being compromised. As a result a fine of £750,000 was issues by the Information Commissioner's Office
• Implement, evaluate and analyse an asset classification scheme for a given scenario.
• Justify information governance requirements and limitations in a given organisational context
• Undertake analysis of organisational norms, trends, and guidelines to be considered when implementing, testing, and reviewing an information governance framework
You need to ensure that for each of the elements:
1. An outline information governance policy for the Luton and High Town Hospital Trust.
2. An information security incident response and disaster recovery plan for the Luton and High Town Hospital Trust
3. A risk management plan for the Luton and High Town Hospital Trust identifying the main risks associated with the given scenario and outlining mitigations for each
4. An information security roadmap for the Luton and Nigh Town Hospital Trust identifying the technical measures that need to be put in place in order to improve the security and governance for their sites
Attachment:- Information Governance and Compliance.rar