Data protection staff policy

We deal with lots of sensitive data. It is up to staff to ensure that they comply with all our procedures.

Every six months, staff need to confirm that they are complying with the following:

• Computer is encrypted using full disk encryption, protected by a strong, unique password
• You are using one of the following password managers: lastpass, pass
• All passwords connected with work or client accounts are unique and stored in a password manager
• No sensitive information is ever stored on any devices apart from work devices
• Any phone connected to your work account is password and fingerprint protected.
• Sensitive data is always transmitted securely, either using PGP encrypted email, https or sftp.

Passwords

Key passwords, e.g. those that are used to log into your computer or your password manager should be strong. We recommend diceware for your passwords.

TODO: use of personal phones (email, mattermost, 2FA)