Information Security Policy and Privacy Policy

Information Security Policy

To guarantee the flow of information, the municipality of West Maas en Waal applies the following information security principles based on the Baseline Information Security Municipalities (BIG):

1. Organization of information security

Employees are responsible for information security. To support this, roles and tasks have been defined.

• The Board has final responsibility and determines the information security policy.
• The Information Provision team is responsible for the day-to-day management of technical information security aspects.
• The coordination of information security is the responsibility of the CISO.
• The team leaders report to the CISO and, together with the CISO, are jointly responsible for the executive tasks of the IB policy.
• The CISO and FG are responsible for the supervisory tasks of the policy.

2. Management of company assets

• Employees must exercise due care when using ICT resources, social media, and information, and must safeguard the integrity and good reputation of the municipality.
• The employee shall take appropriate technical and organizational measures to protect information against loss or any form of unlawful use. In doing so, the employee shall in any case take into account:
  • the security classification of the information;
  • the security regulations set by the municipality (including this information security policy);
  • risks associated with the workplace;
  • The risk of accessing information using ICT equipment other than that provided or approved by the municipality.
• Private use of information and files is not permitted. Further rules will be drawn up for remote working and the use of private resources.
• Upon termination of employment and hiring, all company assets must be returned. Authorizations will be blocked on the instructions of the management team.

3. Security of personnel

• Employees who work with confidential or secret information must submit a Certificate of Good Conduct before starting work. The Certificate of Good Conduct will be renewed during employment if necessary.
• The team leader determines which role(s) the employee must fulfill and which authorizations for consulting, entering, modifying, and deleting data must be granted.
• In the event of a breach of security, the usual disciplinary measures apply to employees, as specified in the Civil Service Regulations and other regulations.

4. Physical security and security of the environment

• The municipality has a 'clear desk, clear screen' policy. This means that you should not leave any important information at your workplace, but store it securely when you leave. Within our organization, Clear Desk also includes the secure storage of USB sticks, external hard drives, and other removable data carriers. 'Clear screen' means that you must lock your screen. If you leave your desk, whether for a short or long period of time, you must at least lock your screen, for example by pressing the key combination [WINDOWS & L).

5. Management of communication and operating processes

• The municipality is increasingly collaborating and exchanging information in chains and outsourcing more tasks. When systems and data are managed by a third party, information from the municipality may also become public. The municipality remains responsible for the information security of its data in the chain, even if management has been outsourced to another party. Employees are therefore also responsible for considering how data can be exchanged securely.

6. Access security

• Authorization to information systems and workstations is role-based and is granted via function(s) and organizational units after approval by the relevant team leader.
• Authentication methods such as passwords are protected against unauthorized access and modification during transport and storage (by means of encryption). Employees also bear responsibility in this regard by keeping passwords confidential.
• A work environment is available for remote/home working. Employees are responsible for ensuring that this is done in a safe and responsible manner. This includes not using unsecured public Wi-Fi, not letting your neighbor look at your screen when you are working from home, etc.

7. Compliance

• In order to improve the quality of information security and prevent any violation of legislation, legal and regulatory or contractual obligations, and security requirements, all employees are required to comply with the legal frameworks, guidelines, and policy principles of the municipality. Employees are also responsible for attending Information Awareness workshops offered by the municipality.

8. Data breach notification

• Employees must immediately report any identified or suspected security breaches and security incidents to the municipality's CISO/information security officer. This also applies to the loss or theft of laptops, USB sticks, tablets, etc., whereby information may fall into the wrong hands. This can be done in person or by sending an email to: informatieveiligheid@westmaasenwaal.nl.