Thank you for confirming that the Using SOSE IT Equipment and Systems Policy has now been updated. It is reassuring that incidents are followed by learning, and necessary updates in policy and practices.
It is also good to hear that the Information Asset Register includes Information Security Classification. That work is ongoing to scope and plan for sensitivity label implementation is also good to hear.
Thank you for letting the Assessment Team know that there has been a change in approach regarding the three policies named in the Keeper’s Agreement Report (Information Classification Guide, Handling Classified Information Guide and Information Classification Handling Policy). It is good to hear that SOSE is no longer updating these versions, but is working to combine the scope of these policies into a single policy that aligns with the Business Classification Scheme. The Team looks forward to sight of this new, combined Information Classification Policy when it has been formalised and becomes available.
Thank you for confirming that SOSE retains its Cyber Essentials Plus re-certification. While not a requirement, this is positive indication of ongoing focus on information security.
For comments on business continuity arrangements, see Element 10.
