{"text_format":"1","workbook":"xlsx","n_sheets":18,"sheets":["Home","ReadMe - Allowlisting","Allowlisting Process","Allowlisting Application","Allowlisting T&C's","Change Note","Comms List","Validation","ReadMe - CoCo","Renewal Process","Application Process","1.CoCo Assurance Statement","2. Connecting 3rd Party Details","3. Sponsoring NHS Org Details","2. 3rd Party Details (Azure)","3. NHS Org Details (Azure)","4. Information Security Matrix","5. Interim Connection"],"not_rendered":{"charts":0,"images":12,"macros":1,"external_links":0,"defined_names":10,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Home","index":0,"n_rows":44,"n_cols":2,"rows_kept":44,"cut":false,"hidden":false,"merged":[[37,1,37,3],[43,1,56,3],[0,1,0,3],[2,1,8,3],[10,1,10,3],[28,1,28,3],[11,1,14,3],[29,1,31,3]]}
[]
[]
[null,"The Information Security Toolkit (IST) is designed to ensure the appropriate levels of assurance are provided for organisations requiring access to the NHS Wales Network. In order to provide these assurance levels the DHCW Cyber Security Team requires this toolkit to be completed in full.\n\nPlease select the relevant type of connection from the options below, this will reveal tabs that contain the forms required for this type of connection:"]
[]
[]
[]
[]
[]
[]
[]
[null,"Code of Connection (CoCo)"]
[null,"The Code of Connection (CoCo) process is designed for third party organisations that require an inbound connection to the NHS Wales Network. There are different levels of assurance required for organisations connecting over HSCN or VPN, which require different forms to be completed. Please select the appropriate option."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Office 365 allow listing"]
[null,"The Office 365 allow listing process is designed for third party organisations that require the ability to connect to the NHS Wales Office 365 Tenancy to collaborate through Teams or SharePoint online."]
[]
[]
[]
[]
[]
[]
[]
[null,"Reset Selection"]
[]
[]
[]
[]
[]
[null,"Once you have completed all of the documentation required for your connection, please rename this document with the following convention:\n\n                         connecting 3rd party name - NHS Sponsor - IST v6.6 - Current Date.xlsm\n\nAs per the process flowcharts, the IST is only to be submitted to the DHCW Cyber Security team by the Sponsoring NHS Organisation and NOT the connecting 3rd party. \n\nNHS Wales Organisations to submit this document to DHCW.securitysubmissions@wales.nhs.uk, this will create a service point call for the Cyber Security team to review and provide an outcome.\n\nAny documents submitted by the Connecting 3rd Party directly to the DHCW Cyber Security team will be declined."]

{"sheet":"ReadMe - Allowlisting","index":1,"n_rows":96,"n_cols":3,"rows_kept":96,"cut":false,"hidden":false,"merged":[[33,1,33,3],[1,1,1,3],[2,1,2,3],[3,1,3,3],[4,1,4,3],[5,1,31,3],[95,2,95,3],[97,1,97,2],[34,1,50,3],[51,1,51,3],[52,1,52,3],[53,1,91,3],[93,1,93,3],[94,2,94,3]]}
[]
[]
[null,"Allowlisting Documentation Overview                   "]
[]
[null,"Brief Description: "]
[null,"The allowlisting process is designed to ensure the appropriate levels of assurance are provided for organisations requiring Domain allowlisting for Microsoft Teams Access in order to provide these assurance levels the DHCW’s Cyber Security Team requires the relevant tabs within this document to be completed.\n\nPlease note that the application should be completed in full and formally approved by the NHS Sponsoring Organisation's Information Governance and Information Security teams before submission to DHCW for domain Listing.\n\nA request for allowlisting an organisation to the domain should only be done so when the requesting NHS Wales Organisation has considered other possible alternatives and robustly justified such access. It is important to note that where an organisation is allowlisted this is done so at tenant level and any breach or impact will affect the entire NHS Wales tenant. It is therefore important that you consider this request is proportionate and necessary and the requesting organisation has undertaken appropriate due diligence for the third party requested.\n\nAll NHS Wales Organisations are responsible for compliance with O365 conditional policies to protect information and ensure that those administrating or providing access to date within O365 applications have appropriate understanding of applications and only grant access to guests where appropriate to do so applying appropriate controls (i.e. ensuring that confidential data is not visible to external guests). By making this request the NHS Wales Organisation is confirming that they have undertaken appropriate review and the third party concerned is appropriately contracted or other such appropriate agreements are in place for the sharing and collaboration of data.\n\nAccess provided to any third party via guest access once a domain is approved is the responsibility of the NHS Wales Organisation.\n\nPlease complete the below information, failure to provide robust justification will result in the rejection of this request."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Definitions:"]
[null,"Organisation - A legal entity or company (E.g. NHS Wales Informatics Service or facebook UK ltd.)\n\nDHCW - Digital Health & Care Wales or subsequent body responsible for managing the assurance process for 3rd party connections into NHS Wales\n\nConnecting 3rd Party Organisation - The organisation that will be connecting into NHS Wales\n\nSponsoring NHS Organisation - The organisation that is acting as the intermediary between DHCW and the Connecting 3rd Party. Typically though not always this is the organisation who owns the service/devices the Connecting 3rd Party will be connecting to.\n\nContact - This is the designated point of contact for the respective organisation, they are are responsible for all communications between organisations and must inform the DHCW security team in the event they are no longer responsible for the connection."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Documentation Pack:"]
[null,"Process Flowchart\n- This document details of the allowlisting process.\n\nReadMe - Allowlisting\n- This document provides guidance for completing the O365 allowlisting Domain documentation\n\nAllowlisting Application\n- This document contains the information required to support the application\n\n4.\tInformation Security Matrix\nThis document requires the connecting 3rd party to complete the toolkit. They are also required to provide supporting evidence, which is subsequently reviewed and where required returned for further clarification, this evidence can be in the form of certifications such as ISO 27001 or Cyber Essentials Plus.\n\nAllowlisting T&C's\n- This document contains 3rd party agreement to comply with the terms and conditions of connection.\n\nPlease note, some forms are to be completed by the connecting 3rd party and some by the sponsoring NHS organisation:"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Security Team Contact Information:"]
[null,"Telephone:  ","02920 503393"]
[null,"E-mail:         ","DHCW.OperationalSecurity@wales.nhs.uk"]

{"sheet":"Allowlisting Process","index":2,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[[2,1,2,5]]}
[]
[]
[null,"Office 365 Allowlisting Process Flowchart"]
[null,"Connecting 3rd Party"]
[null,"NHS Sponsor"]
[null,"DHCW"]

{"sheet":"Allowlisting Application","index":3,"n_rows":61,"n_cols":3,"rows_kept":61,"cut":false,"hidden":false,"merged":[[27,1,27,2],[1,1,1,2],[2,1,2,2],[5,1,5,2],[11,1,11,2],[12,1,12,2],[23,1,23,2],[22,1,22,2],[3,1,3,2],[16,1,16,2],[62,1,62,2],[61,1,61,2],[56,1,56,2],[28,1,28,2],[50,1,50,2],[51,1,51,2],[42,1,42,2],[40,1,40,2],[41,1,41,2],[29,1,39,1],[29,2,39,2]]}
[]
[]
[null,"Application for Allowlisting of Domain for Office 365 Access"]
[null,"Please note that the application should be completed in full and formally approved by the NHS Sponsoring Organisation's Information Governance and Information Security teams before submission to DHCW for domain Listing."]
[]
[null,"NHS Wales Sponsor Details:\n(This is the person in NHS Wales responsible for the collaboration between NHS Wales and the connecting third party)"]
[null,"Name"]
[null,"Job Title"]
[null,"Contact Number"]
[null,"Email Address"]
[null,"Health Board / Trust"]
[]
[null,"Third Party Organisation Details:\n(These are the details for the connecting third party as a whole)"]
[null,"Organisation Name"]
[null,"Domain Name(s) to be allowlisted (e.g. @wales.nhs.uk)"]
[null,"Organisation Address"]
[null,"Organisation Single Point of Contact (SPOC) Details:\n(These are the details of the specific person in the conncting third party who has been designated as the SPOC)"]
[null,"SPOC Name"]
[null,"SPOC Job Title"]
[null,"SPOC Contact Number"]
[null,"SPOC Email Address"]
[]
[null,"Security Assessment (Third Party)"]
[null,"Please confirm Cyber Security accreditations held:\n(N.B. If you have a current Cyber Essentials Plus or ISO 27001 certification you still need to complete the Information Security Matrix but will only need to supply evidence of the certification instead of specific evidence for each requirement.)"]
[null,"Do you have a current Cyber Essentials Plus certification?","Yes/No \nCertificate Expiry Date: \nPlease provide evidence of certification and scope."]
[null,"Do you have a current ISO 27001 certification?","Yes/No \nCertificate Expiry Date: \nPlease provide evidence of certification and scope."]
[]
[null,"Justification of Access"]
[null,"Please describe access and collaboration requirements in detail including:"]
[null,"· Reason for access\n\n· Number of Individuals from this organisation that require access\n\n· Benefits access will bring\n\n· Risks / impacts of not providing access\n\n· Why access to information cannot be\nprovided in another way"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Description of Access Required:"]
[null,"Please describe the level of access required:"]
[null,"Access to teams meetings & channels","Yes / No"]
[null,"Access to SharePoint Online Site(s)","Yes / No"]
[null,"Access to file sharing through Teams or SharePoint Online","Yes / No"]
[null,"Name of Teams Channel(s) required (if known)"]
[null,"Name of SharePoint Online Site(s) required (if known)"]
[null,"End Date (if access is to be temporary)"]
[]
[null,"Request Approved By:"]
[null,"NHS Sponsor Information Governance Representative:"]
[null,"Name:"]
[null,"Signature:"]
[null,"Role / Job Title:"]
[null,"Date:"]
[null,"NHS Sponsor Information Security Representative:"]
[null,"Name:"]
[null,"Signature:"]
[null,"Role / Job Title:"]
[null,"Date:"]

{"sheet":"Allowlisting T&C's","index":4,"n_rows":75,"n_cols":2,"rows_kept":75,"cut":false,"hidden":false,"merged":[[75,1,75,2],[66,1,66,2],[67,1,67,2],[68,1,68,2],[1,1,1,2],[2,1,2,2],[65,1,65,2],[3,1,3,2],[5,1,64,2],[4,1,4,2]]}
[]
[]
[null,"Allowlisting Terms and Conditions"]
[]
[null,"Terms and Conditions:"]
[null,"1. \tAll Organisations provided access to the NHS Wales O365 Domain must comply with required Information Security requirements. Where the key Information Security standards (as identified in the Information Security Matrix or having current certification of either Cyber Essentials plus or ISO 27001) are not met to an appropriate standard, an action plan for the necessary improvements must be agreed with the DHCW Security Team.\n\t\n2.\t Access to the NHS Wales O365 Domain is granted to support activities to be undertaken by NHS Wales in satisfying service requirements and collaborations, or to support the NHS Wales workforce (to include staff; students; trainees; secondees; volunteers; and contracted third parties including locum and agency staff). Such use must be in line with acceptable use requirements. For the avoidance of doubt, NHS Wales will generally consider any of the following inappropriate use (please note this is not an exhaustive list):\n\t\n2a. \tAllowing access to NHS Wales O365 services by anyone not authorised to access the services, such as by a friend or family member.\n\t\n2b. \tAccessing, deleting, modifying, disclosing or downloading any content / information without the permission of the content owner, or attempting to access, delete, modify, disclose or download any content information without permission.\n\t\n2c. \tExpressing personal views that may bring NHS Wales into disrepute. Communicating unsolicited personal views on political, social, or religious matters with the intention of imposing that view on any other person. This does not preclude Trade Union officials from communicating with staff on Trade Union related matters.\n\t\n2d. \tCommunicating or saving any information or images which are unlawful, or could be regarded as defamatory, offensive, abusive, obscene, hateful, pornographic, violent, terrorist, indecent, being discriminatory in relation to the protected characteristics, or using NHS Wales O365 services to inflict bullying or harassment on any person.\n\t\n2e. \tKnowingly breaching copyright or Intellectual Property Rights (IPR).\n\t\n2f. \tObtaining or distributing unlicensed or illegal software via NHS Wales O365 services.\n\t\n2g. \tDistributing unsolicited commercial or advertising materials.\n\t\n2h.\t Deliberately attempting to circumvent security systems protecting the integrity of the NHS Wales O365 Domain, including ‘hacking’ into others’ accounts or unauthorised areas.\n\t\n2i.\t Disabling or overloading any NHS Wales O365 service via deliberate or reckless actions, or attempting to disable or circumvent any system intended to protect the privacy or security of employees, patients or others.\n\t\n2j. \tIntentionally introducing malicious software such as Viruses, Worms, and Trojans into the NHS Wales O365 Domain.\n\t\t\n3. \tAll threats or security events affecting or potentially affecting the security of the NHS Wales Domain or services must be immediately reported to the DHCW Cyber Security Team via DHCW.securitysubmissions@wales.nhs.uk\n\t\n4.\t NHS Wales is not responsible for the content of any user-created post or listing made on NHS Wales O365 services. The decision to post, view or interact with contact is at the risk of the guest organisation.\n\t\n5. \tThe guest organisation must support its workforce in understanding how to safely use O365 services and that users understand the legal professional and ethical obligations that apply to its use, including ensuring that content is shared appropriately with individuals who have the right/authority to access it.\n\t\n6.\tAny information you share to the All Wales O365 domain using O365 services may be subject to requests for information under relevant legislation and regulation. All users should be mindful that it may be necessary to conduct a search for information and this may take place with or without the author’s knowledge or consent.\n\t\n7.\tNHS Wales reserves the right to monitor NHS Wales O365 services to ensure the effectiveness of the service. This will mean that any personal activities that occur on NHS Wales O365 services may come under scrutiny. NHS Wales organisations respect the privacy of its staff/users and as such monitoring is normally only conducted where it is suspected that there is a breach of either policy or legislation. "]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"By signing this document I confirm that I have read, understood and agreed to comply with the terms and conditions that apply to organisations that have been granted access to the @wales.nhs.uk Office 365 domain. I acknowledge failure to comply with any of the agreed terms or acceptable use requirements, will result in termination of access to the domain and may result in legal action."]
[]
[null,"Third Party Designated Signatory"]
[null,"Name in Full"]
[null,"Job Title"]
[null,"Email"]
[null,"Telephone"]
[null,"Signature"]
[null,"Date"]

{"sheet":"Change Note","index":5,"n_rows":22,"n_cols":6,"rows_kept":22,"cut":false,"hidden":true,"merged":[]}
[]
[null,"1.1      Template Revision History"]
[null,"Date","Version","Next Review Date","Author","Revision Summary"]
[null,null,"V5.0",null,"James Ball","Toolkit V1.0-4.0 only included matrix, while other questions were within other documents"]
[null,null,"V5.1",null,"James Ball","Combined 5 zip files to 1 excel book"]
[null,null,"V5.2",null,"James Ball","Added 3rd Party IP's to routing details question"]
[null,null,"V5.3",null,"James Ball","Revised process flowcharts"]
[null,null,"V5.4",null,"James Ball","Added Change of Scope option (submitted and approved by OSSMB)"]
[null,null,"V5.5",null,"James Ball","Pilot Feedback - Updated security matrix to ISO 270001 revision 2013"]
[null,null,"V5.6",null,"James Ball","Pilot Feedback - Combined the options down to only VPN or HSCN/N3 or Change of Scope"]
[null,null,"V5.7",null,"James Ball","Pilot Feedback - Removed extraneous questions that are part of the design process on the recommendation of the Cyber Security Design Lead"]
[null,"2020-04-27","V5.8","2021-04-27","Tracey Dimblebee","Moved 'Read Me' tab to the beginning of the document pack\nAmended 'Read Me' tab to capture the DHCW transition to a SHA: 'DHCW - NHS Wales Informatics Service or subsequent body responsible for managing the assurance process for 3rd party connections into the NHS Wales network'\nRenamed 'New Connection Process' to 'Application Process'\n\nThe creation of an Interim Connection to allow urgent connections to support the delivery of patient care during unprecedented times e.g Covid-19\nAdded a new tab '5. Interim Connection'\n'Read Me' tab changes:\nAdded to 'Brief Description' Interim Connections will only be granted for 3 months in exceptional circumstances for example the sponsoring organisation has entered into business continuity or there is a requirement for emergency patient care.  The connecting organisation must provide evidence as set out in the interim connection questionnaire.  \nThe sponsoring organisation takes responsibility for the limited assurance surrounding interim connections and raises an organisational risk.\nAdded to 'Document Pack' Interim Connection\nAdded Interim Connection 'button' to display tabs relevant to this type of assurance"]
[null,"2020-06-03","V6.1","2021-06-03","Tracey Dimblebee","O365 Whitelisting assurance added"]
[null,"2021-03-01","V6.2","2022-03-01","James Ball","Added Teams/Sharepoint whitelisting clarification and re-wrote home page to be clearer to applicants"]
[null,"2021-11-15","V6.3","2022-11-15","James Ball","Added additional fields to whitelisting application form and updated whitelisting T&Cs with input from IG\nAdded \"Azure Tenancy Access\" option for CoCo application\nRemoved duplicate address and business case questions from 3rd party details tab"]
[null,"2023-01-18","V6.4","2024-01-18","James Ball","Update process following ISO audit recommendations"]
[null,"2023-03-20","v6.5","2024-03-20","Steve Banks","Signed new macros"]
[]
[null,"1.2      Reviewers "]
[null,"Version","Name","Date","Outcome"]
[null,"d5.8 to v6","OSSMB","2020-05-14","One comment received"]
[null,"d6.3","OSSMB"]

{"sheet":"Comms List","index":6,"n_rows":6,"n_cols":6,"rows_kept":6,"cut":false,"hidden":true,"merged":[]}
[]
[null,"Circulation List",null,null,"Physical Document"]
[null,"Audience","Method",null,"Location","URL"]
[null,"OSSMB","NWISOperationalSecuritySMB@wales.nhs.uk",null,"HOWIS","http://howis.wales.nhs.uk/sites3/page.cfm?pid=36593&orgid=852"]
[null,"IMB","NWISInfrastructureManagementBoard@wales.nhs.uk ",null,"Security Teams SharePoint","Code of Connection >1. Current Documentation"]
[null,"Firewall Requestors"]

{"sheet":"Validation","index":7,"n_rows":5,"n_cols":2,"rows_kept":5,"cut":false,"hidden":true,"merged":[]}
["5. Validation"]
[]
["Answer","Evidence"]
["Yes","Yes"]
["No","No"]

{"sheet":"ReadMe - CoCo","index":8,"n_rows":113,"n_cols":3,"rows_kept":113,"cut":false,"hidden":true,"merged":[[1,1,1,2],[4,1,4,2],[3,1,3,2],[2,1,2,2],[34,1,34,2],[110,1,110,2],[52,1,52,2],[5,1,32,2],[35,1,50,2],[53,1,108,2]]}
[]
[]
[null,"Code of Connection Documentation Overview                   "]
[]
[null,"Brief Description: "]
[null,"The Code of Connection (CoCo) process is designed to ensure the appropriate levels of assurance are provided for organisations requiring a connection to the NHS Wales Network. In order to provide these assurance levels the DHCW’s Cyber Security Team requires the documentation detailed below to be completed.\n\nTo ensure that the process is complete in a timely fashion Cyber Security Team will require regular updates on the status of the documentation to provide the necessary assurance that progress is being made. As such there are timescales involved for progression and completion of the CoCo process.  A submission must be completed within 90 days of its original submission - A submission requires updates every 15 working days, as such if sufficient evidence is not provided to Cyber Security team that the CoCo submission is progressing the Cyber Security team reserve the right to cancel the request.\n\nThe DHCW Cyber Security team reserve the right to conduct an onsite audit of the areas covered within the connection in order to fulfil NHS Wales’ obligation to provide the required information to maintain ongoing connection.\n\nAll documentation will be marked as Confidential by the DHCW Cyber Security team.\n\nThe documentation will need to be refreshed on at least a yearly rolling basis - this will be instigated by the Security team.\n\nAny substantive change to network configuration, access requirements or authorised signatory will require a documentation update - this is a mandatory requirement and the responsibility of the sponsoring NHS Organisation to notify DHCW.\n\nInterim Connections will only be granted for 3 months in exceptional circumstances for example the sponsoring organisation has entered into business continuity or there is a requirement for emergency patient care.  The connecting organisation must provide evidence as set out in the interim connection questionnaire.  \nThe sponsoring organisation takes responsibility for the limited assurance surrounding interim connections and raises an organisational risk.\n\nFailure to comply may result in the cessation of your connection to the NHS Wales network.\n\n"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Definitions:"]
[null,"Organisation - A legal entity or company (E.g. Digital Health & Care Wales or Facebook UK ltd.)\n\nDHCW - Digital Health & Care Wales or subsequent body responsible for managing the assurance process for 3rd party connections into the NHS Wales network\n\nConnecting 3rd Party Organisation - The organisation that will be connecting into the NHS Wales network\n\nSponsoring NHS Organisation - The organisation that is acting as the intermediary between Digital Health & Care Wales and the Connecting 3rd Party. Typically though not always this is the organisation who owns the service/devices the Connecting 3rd Party will be connecting to. This must be signed by a risk owner within the sponsoring NHS Wales organisation. This is because DATIX risks can be raised should any issues occur with the CoCo assurance e.g. the CoCo expires without completing the renewal process.\n\nContact - This is the designated point of contact for the respective organisation, they are  responsible for all communications between organisations and must inform the DHCW security team in the event they are no longer responsible for the connection. This contact must have sufficient authority in order to own any risks raised by the connection."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Documentation Pack:"]
[null,"Renewal Process Flowchart\n- This document details the process of renewing a lapsed Code of Connection, indicating responsibilities.\n\nProcess Flowchart\n- This document details the process of applying for a new Code of Connection, indicating responsibilities.\n\n1.\tAssurance Statement\nRequires that the connecting 3rd party and the sponsoring NHS Wales organisation are aware of, and agree to, the terms and conditions of the CoCo process. This must be signed by a risk owner within the sponsoring NHS Wales organisation. This is because DATIX risks can be raised should any issues occur with the CoCo assurance e.g. the CoCo expires without completing the renewal process.\n\n2.\tConnecting 3rd Party Details\nThis document requires the connecting 3rd party to provide relevant details such as the reason for the connection and listing any current cyber security certifications the 3rd party hold.\n\n3.\tSponsoring NHS Org Details\nThis document requires the sponsoring NHS Wales organisation to provide relevant details such as the IP addresses and ports required for the connection. This must be signed by the designated Local Risk Lead for the organisation.\n\n4.\tInformation Security Matrix\nThis document requires the connecting 3rd party to complete the toolkit. They are also required to provide supporting evidence, which is subsequently reviewed and where required returned for further clarification, this evidence can be in the form of certifications such as ISO 27001 or Cyber Essentials Plus.\n\n5.\tInterim Connection\nThis document requires the connecting 3rd party to complete the questionnaire. They are also required to provide supporting evidence, which is subsequently reviewed and where required returned for further clarification, this evidence can be in the form of certifications such as ISO 27001 or Cyber Essentials Plus. Interim connections are valid for a maximum 3 months, or the remaining length of the certification if lower.\n\nAny change of scope may affect the risk profile to NHS Wales and as such they must be resubmitted to DHCW for approval.\n\nPlease note, some forms are to be completed by the connecting 3rd party and some by the sponsoring NHS organisation:\n"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Security Team Contact Information:"]
[null,"Telephone:  ","02920 500500"]
[null,"E-mail:         ","DHCW.OperationalSecurity@wales.nhs.uk"]

{"sheet":"Renewal Process","index":9,"n_rows":5,"n_cols":2,"rows_kept":5,"cut":false,"hidden":true,"merged":[[1,1,1,5]]}
[]
[null,"CoCo Renewal Process Flowchart"]
[null,"Connecting 3rd Party"]
[null,"NHS Sponsor"]
[null,"DHCW"]

{"sheet":"Application Process","index":10,"n_rows":5,"n_cols":2,"rows_kept":5,"cut":false,"hidden":true,"merged":[[1,1,1,5]]}
[]
[null,"CoCo Application Process Flowchart"]
[null,"Connecting 3rd Party"]
[null,"NHS Sponsor"]
[null,"DHCW"]

{"sheet":"1.CoCo Assurance Statement","index":11,"n_rows":76,"n_cols":2,"rows_kept":76,"cut":false,"hidden":true,"merged":[[76,1,76,2],[63,1,63,2],[46,1,46,2],[71,1,71,2],[70,1,70,2],[72,1,72,2],[54,1,54,2],[0,1,0,2],[1,1,1,2],[3,1,42,2],[2,1,2,2],[62,1,62,2],[53,1,53,2],[44,1,44,2],[45,1,45,2]]}
[]
[null,"Code of Connection Assurance Statement"]
[null,"Terms and Conditions:"]
[null,"1. All organisations that have either direct or indirect access to NHS Wales Network provided by PSBA, must complete an Information Security Toolkit. Where the key Information Security standards (as identified through the Information Security Matrix, having a current HSCN/N3 connection, or having current in scope certification of either Cyber Essentials + or ISO 27001) are not met to an appropriate standard, to continue with the application process an action plan for making the necessary improvements must be agreed with the DHCW Security Team. \n\n2. The use of NHS Wales Services must be conducted within the Scope of the initial application for connection, to support NHS business activities that contribute to the care of patients. Usage of individual services must be conducted in line with those individual service requirements and acceptable use policies. The use of NHS Wales provided infrastructure or services for unauthorised advertising or other non-healthcare related activity is expressly forbidden. \n\n3. All threats or security events affecting or potentially affecting the security of NHS Wales infrastructure or services must be immediately reported via the NHS Wales incident reporting arrangements managed by the DHCW Cyber Security Team.\n\n4. All NHS Wales organisations connected or wishing to connect to the NHS Wales Network must inform DHCW Cyber Security of any addition external connections e.g. independent ADSL lines. All independent connections should be supported, from the Trust/HB side, by a local risk assessment and a clearly defined scope for the monitoring and management of the link(s).\n\n5. The organisation will ensure connection to systems or networks that are not covered by this Code of Connection Assurance Statement have been disconnected, this is achieved with the activation of “no split tunnelling”.  The Organisation agrees not to disable this function when accessing NHS Wales Infrastructure.  \n\n6. Organisations may not establish any onward connections over NHS Wales IT Infrastructure Network from systems and networks which are not covered by an approved Information Security Assessment and agreement to this Code of Connection Assurance Statement.\n\n7. The approved organisation must allow the Digital Health & Care Wales, or its representatives, to carry out ad-hoc on-site audits as necessary to confirm compliance with these terms and conditions and with the standards set in the Information Security Assessment.\n\n8. The approved organisation must complete the Information Security Toolkit, locally on a regular basis and submit a formal assessment annually, or when significant organisational changes occur (significant organisational changes can include, but are not limited to: merger or change of ownership of the organisation, change in in scope infrastructure, or designated contact details changing).\n\n9. The organisation must notify the DHCW Cyber Security Team of any Change of Circumstances in relation to the organisations name, ownership, change of address or any changes that would affect a previously acceptable score in the Information Security Toolkit.\n\n"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Connecting 3rd Party"]
[null,"By signing below I confirm that I have read, understood and agree to comply with the terms and conditions that apply to organisations that have access to NHS Wales services and acknowledge that failure to comply with any of the points below will jeopardise the connection agreement, and may result in the connection being terminated."]
[null,"Chief Executive or appropriate equivalent designated signatory"]
[null,"Name in Full"]
[null,"Signature"]
[null,"Email"]
[null,"Telephone"]
[null,"Role"]
[null,"Date"]
[]
[null,"Individual Responsible for Security/Information Governance"]
[null,"Name in Full"]
[null,"Signature"]
[null,"Email"]
[null,"Telephone"]
[null,"Role"]
[null,"Date"]
[]
[null,"Sponsoring NHS Organisation"]
[null,"Sponsoring NHS Organisation representative\n(This must be signed the by Local Risk Lead, as identified in SOP-CG-010)"]
[null,"Name in Full"]
[null,"Signature"]
[null,"Email"]
[null,"Telephone"]
[null,"Role"]
[null,"Date"]
[]
[null,"Contract Details"]
[null,"Renewal Details:"]
[null,"Current Date"]
[null,"Contract End Date     \n (if applicable)"]
[null,"Assurance Renewal Date\n(1 year from now or certification end date whichever is sooner)"]

{"sheet":"2. Connecting 3rd Party Details","index":12,"n_rows":25,"n_cols":2,"rows_kept":25,"cut":false,"hidden":true,"merged":[[21,1,21,2],[13,1,13,2],[16,1,16,2],[2,1,2,2],[3,1,3,2],[4,1,4,2],[6,1,6,2],[5,1,5,2],[20,1,20,2],[12,1,12,2]]}
[]
[]
[null,"Code of Connection - 3rd Party Details"]
[null,"1. Organisation Name: "]
[]
[]
[null,"2. UK Registered Headquarters Address: "]
[null,"Address 1:"]
[null,"Address 2:"]
[null,"Address 3:"]
[null,"Address 4:"]
[null,"Post Code:"]
[]
[null,"3. Has your organisation previously completed the Code of Connection process?"]
[null,"Yes/No"]
[]
[null,"4. How do you intend to connect to the NHS Wales Network? (Please select as applicable)"]
[null,"Consumer Broad Band (VPN)"]
[null,"N3/HSCN (Please supply NAC’s/ ODS details)"]
[]
[null,"5. Do you currently have any Cyber Security certifications?"]
[null,"If you have a current Cyber Essentials + or ISO 27001 certification you still need to complete the Information Security Matrix but will only need to supply evidence of the certification instead of specific evidence for each requirement."]
[null,"Yes/No"]
[null,"Certification Name"]
[null,"Certification Expiry date"]

{"sheet":"3. Sponsoring NHS Org Details","index":13,"n_rows":49,"n_cols":5,"rows_kept":49,"cut":false,"hidden":true,"merged":[[14,1,14,3],[15,1,15,3],[19,1,43,4],[45,1,45,4],[46,1,46,4],[47,1,47,4],[16,2,16,3],[18,1,18,4],[1,1,1,4],[13,1,13,3],[3,1,3,3],[4,1,4,3],[5,1,5,3],[6,1,6,3],[7,1,7,3],[2,1,2,4],[8,1,8,3],[10,1,10,3],[11,1,11,3],[12,1,12,3],[9,1,9,3]]}
[]
[null,"Sponsoring NHS Organisation Details"]
[null,"1. Sponsoring NHS Wales organisation:"]
[null,"Aneurin Bevan University Health Board"]
[null,"Betsi Cadwaladr University Health Board"]
[null,"Cardiff & Vale University Health Board"]
[null,"Cwm Taf Morgannwg Health Board"]
[null,"Digital Health and Care Wales"]
[null,"Hywel Dda Health Board"]
[null,"NHS Wales Shared Services Partnership"]
[null,"Powys Teaching Health Board"]
[null,"Public Health Wales "]
[null,"Swansea Bay University Health Board"]
[null,"Velindre University NHS Trust"]
[null,"Welsh Ambulance Services NHS Trust"]
[null,"Welsh Blood Service"]
[null,"Other:",null,null,"x"]
[]
[null,"3. Purpose of Access / Connection: (Please give brief details of the software and/or services to be provided by the contracted organisation)"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"4. Routing Details:"]
[null,"Please state the sponsoring organisation’s IP addresses to which the contracted organisation will have access to:"]
[null," (If connecting in via an HSCN aggregator such as RedCentric, please note this in the application)"]
[null,"Connecting 3rd Party IP's","Sponsoring NHS Org IP's","Ports","Comments"]

{"sheet":"2. 3rd Party Details (Azure)","index":14,"n_rows":27,"n_cols":2,"rows_kept":27,"cut":false,"hidden":true,"merged":[[2,1,2,2],[3,1,3,2],[4,1,4,2],[5,1,5,2],[6,1,6,2],[16,1,16,2],[22,1,22,2],[23,1,23,2],[13,1,13,2],[17,1,17,2]]}
[]
[]
[null,"Code of Connection - 3rd Party Details (Azure)"]
[null,"1. Organisation Name: "]
[]
[]
[null,"2. UK Registered Headquarters Address: "]
[null,"Address 1:"]
[null,"Address 2:"]
[null,"Address 3:"]
[null,"Address 4:"]
[null,"Post Code:"]
[]
[null,"3. Has your organisation previously completed the Code of Connection process?"]
[null,"Yes/No"]
[]
[null,"4. Do you currently have access to the HSCN network?"]
[null,"If you have a current NAC / ODS code you do not need to complete the Information Security Matrix but will need to supply your details to confirm."]
[null,"Yes/No"]
[null,"NAC / ODS details"]
[null,"Expiry Date (if applicable)"]
[]
[null,"5. Do you currently have any Cyber Security certifications?"]
[null,"If you have a current Cyber Essentials+ or ISO 27001 certification you do not need to complete the Information Security Matrix but will need to supply evidence of the certification"]
[null,"Yes/No"]
[null,"Certification Name"]
[null,"Certification Expiry date"]

{"sheet":"3. NHS Org Details (Azure)","index":15,"n_rows":48,"n_cols":7,"rows_kept":48,"cut":false,"hidden":true,"merged":[[12,1,12,5],[1,1,1,6],[2,1,2,6],[3,1,3,5],[4,1,4,5],[5,1,5,5],[6,1,6,5],[7,1,7,5],[8,1,8,5],[9,1,9,5],[10,1,10,5],[11,1,11,5],[45,1,45,6],[46,1,46,6],[13,1,13,5],[14,1,14,5],[15,1,15,5],[18,1,18,6],[19,1,43,6],[16,2,16,5]]}
[]
[null,"Sponsoring NHS Organisation Details (Azure)"]
[null,"1. Sponsoring NHS Wales organisation:"]
[null,"Aneurin Bevan University Health Board"]
[null,"Betsi Cadwaladr University Health Board"]
[null,"Cardiff & Vale University Health Board"]
[null,"Cwm Taf Morgannwg Health Board"]
[null,"Digital Health and Care Wales (Previously NWIS)"]
[null,"Hywel Dda Health Board"]
[null,"NHS Wales Shared Services Partnership"]
[null,"Powys Teaching Health Board"]
[null,"Public Health Wales "]
[null,"Swansea Bay University Health Board (Previously ABMU)"]
[null,"Velindre University NHS Trust"]
[null,"Welsh Ambulance Services NHS Trust"]
[null,"Welsh Blood Service"]
[null,"Other:",null,null,null,null,"x"]
[]
[null,"3. Purpose of Access / Connection: (Please give brief details of the software and/or services to be provided by the contracted organisation)"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"4. Routing Details:"]
[null,"This information is required so that we can configure any exceptions to our security controls required to enable access to the NHS organisation’s network."]
[null,"Name of 3rd Party User","Computer OS of 3rd Party User\n(Required for Conditional Access Policy)","Connecting 3rd Party IP(s)\n(fixed subnet if possible)","Location/Country of 3rd Party User\n(required for exceptions to our Geo-IP policy)","NHS Wales Subscription","Comments"]

{"sheet":"4. Information Security Matrix","index":16,"n_rows":55,"n_cols":18,"rows_kept":55,"cut":false,"hidden":false,"merged":[[0,8,0,11]]}
[null,null,null,"What is required by the connecting third party:","If the connecting third party meets the description in this column but not Level 1, mark the Self Assessed Level in col L as 0.","If the connecting third party meets the description in this column but not Level 2, mark the Self Assessed Level in col L as 1.","If the connecting third party meets the description in this column, mark the Self Assessed Level in col L as 2.","Further explanation of the requirement or the source of the requirement","All organisations must self assess all requirements as level 0, 1, or 2. Evidence must be submitted demonstrating the self assessed level of each requirement. Where a certification from the following list is held, this may be used as your evidence:\n> You have a current in scope Cyber Essentials Plus Certification\n> You have a current in scope ISO 27001 certification \n> You have a current NACs / ODS code / DSPT Assurance from NHS Digital"]
[null,"No.","Requirements ","Description of Requirement ","Level 0 ","Level 1","Level 2 ","Explanation","Evidence Required for Audit ","Evidence \nattached \nY/N","Submission Comments","Self \nAssessed\n Level","Evidence Reviewed","Review Comments","Raw Scoring","Single Section Score","Single Section Percentage","Toolkit Average Percentage"]
[null,1,"Security Policies "]
[null,1.1000000000000001,"Information Exchange Policies and Procedures ","Formal exchange policies, procedures, and controls must be in place to protect the exchange of information throughout the use of all types of communication facilities. (e.g. email policy, data in transit policy, etc.)","No formal exchange policies, procedures or controls are in place. ","The organisation is in the process of developing formal exchange policies, procedures. ","The organisation has fully implemented policies, controls and procedures to protect the exchange of information. ","Information sharing agreement( i.e.. WASPI). Please refer to Annex  A13.1.2 & 13.1.3 ISO/IEC27001:2013","Formal Policies and Procedures which protect the exchange of information. ",null,"e.g.\n\"We have a formal exchange policy which has been signed off by senior management.\"\nor\n\"This requirement is evidenced by our ISO 27001 certificate.\"","Level 0",null,null,{"$f":"IF(L4= \"level 0\",0,IF(L4= \"level 1\",0.5,(IF(L4= \"level 2\",1))))","v":0},null,null,{"$f":" AVERAGE(Q:Q)","v":0}]
[null,1.2,"Information Security Policy","An information security policy must be approved by management and published and communicated to all employees and relevant external parties.","The organisation does not have a Information Security Policy.","The organisation has an Information Security Policy which has been approved by senior management. ","The organisation has an approved Information Security Policy which is actively communicated to all employees and relevant third parties. ","Please refer to Annex A5 - ISO27001:2013","An approved information security policy.",null,null,"Level 0",null,null,{"$f":"IF(L5= \"level 0\",0,IF(L5= \"level 1\",0.5,(IF(L5= \"level 2\",1))))","v":0},"Out of 3"]
[null,1.3,"Management commitment to information security ","Management must actively support information security within the organisation through clear direction, demonstrated commitment, explicit assignment, and acknowledgement of information security responsibilities. ","Management do not actively support information security within the organisation. ","Management have actively started to support information security within the organisation. However management may not have to gone so far that they have explicitly assigned and acknowledged information security responsibilities. ","Management actively support information security within the organisation through clear direction, demonstrated commitment, explicit assignment and acknowledgement of information security responsibilities.","Please refer to Annex A6.1.3 ISO27001:2013","Information Security Officer/Manager Job description. Relevant Management Job descriptions that detail their responsibilities towards Information Security.",null,null,"Level 0",null,null,{"$f":"IF(L6= \"level 0\",0,IF(L6= \"level 1\",0.5,(IF(L6= \"level 2\",1))))","v":0},{"$f":" SUM(O4:O6)","v":0},{"$f":"P6/3","v":0}]
[null,2,"Physical Security"]
[null,2.1,"Physical Entry Controls ","Secure areas must be protected by appropriate entry controls to ensure that only authorised personnel are allowed access. (e.g. Data Centres, Comms Rooms etc.)","Secure areas are only protected by rudimentary security controls such as lock and key. There is only one key that everyone uses that is kept in a central area.","Secure areas are protected by proximity cards but the proximity card entry system is not auditable. ","Secure areas are protected by auditable proximity locks, which retain data for a minimum of one year. ","Please refer to Annex A11.1.2 ISO27001:2013 (Physical & Environmental Security) ","Suitable proximity controls are in place",null,null,"Level 0",null,null,0,"Out of 2"]
[null,2.2000000000000002,"Accommodation ","All hosts and network equipment are located in secure accommodation.","All hosts and network equipment are not located in secure accommodation","Some of the organisations hosts and network equipment is not stored in secure accommodation","All of the organisation hosts and network equipment is stored in secure accommodation","Please refer to Annex A11.1 ISO/IEC27001:2013\n","Evidence of secure hosting policy or procedure.",null,null,"Level 0",null,null,0,{"$f":" SUM(O8:O9)","v":0},{"$f":"P9/2","v":0}]
[null,3,"Access Controls"]
[null,3.1,"Identity checking","Background verification checks on all candidates for employment, contractors, and third party users must be carried out in accordance with relevant laws, regulations and ethics, and proportional to the business requirements, the classification of the information to be accessed, and the perceived risks.","The organisation does not carry out background verification checks on candidates for employment.","The organisation carries out background verification checks on some but not all employees. ","The organisation conducts background verification checks on all candidates","Please refer to Annex A7.1.1 ISO/IEC27001:2013","Evidence of vetting policy /  procedure and formal allocation of vetting responsibility with an organisational role.",null,null,"Level 0",null,null,0]
[null,3.2,"Registration and Deregistration ","A secure process for user registration and deregistration across all systems must be in place. User access privileges must be reviewed when a user changes role in organisation. ","The organisation does not have a process for registration and deregistration across all systems. User access privileges are not reviewed when a user changes role in the organisation. ","The organisation has a process for registration and deregistration of users to log onto the network however the process may not be in place across all the organisations systems. ","The organisation has robust process in place for the registration and deregistration of users across all the organisations systems. There is a process in place to ensure that access privileges are reviewed when a user changes role in the organisation. ","Please refer to Annex A9.2.1 ISO/IEC27001:2013","Formal policies and procedures for the registration and deregistration of users must be in place.",null,null,"Level 0",null,null,0]
[null,3.3,"Username and Passwords","Each user has an individual username and strong password that meets the current NCSC Password Guidance","Users authenticate themselves using a username and password but there are weak or no requirements for password policy in place and there is no MFA requirement. ","Users authenticate themselves using a username and password. The user name gives no indication of the users privileges. Either there is a strong password policy or MFA requirements in place. ","Users authenticate themselves using a username and password. The user name gives no indication of the users privileges. There is a strong password policy and MFA requirements in place. ","Please refer to Annex A9.2.4 ISO/IEC27001:2013","Detailed password policy which compiles to these standards",null,null,"Level 0",null,null,0,"Out of 4"]
[null,3.4,"Privilege Use ","Users are only to be granted the minimum privileges required to perform their duties.","When as new users starts within the organisation no assessment is made as to the users access and privilege requirements. ","When a new user starts within the organisation an assessment is made as to the users access and privilege requirements however the same assessment is not made when the user changes role within the organisation. ","When a new user starts within the organisation a thorough assessment is made as to the users access and privilege requirements. Additionally when a user changes roll within the organisation a new assessment is made and the users privileges and access accordingly which are then amended as necessary.","Please refer to Annex A9.2.3 & A9.2.5 ISO/IEC27001:2013","Evidence of policy and procedure in place showing how this system of registering / deregistering users works.",null,null,"Level 0",null,null,0,{"$f":" SUM(O11:O14)","v":0},{"$f":"P14/4","v":0}]
[null,4,"Logging and Monitoring"]
[null,4.0999999999999996,"Time Synchronisation ","The clocks of all relevant information processing systems within an organisation or security domain should be synchronised with an agreed accurate time source.","The organisation does not have any procedures or technical mechanisms  to automatically synchronise information processing systems with an agreed accurate time source.","The organisation has a  procedures and  technical mechanism in place to  automatically synchronise information processing systems with an agreed accurate time source.","The organisation has a  procedures and  multiple technical mechanisms in place to  automatically synchronise information processing systems with agreed accurate internal & external time sources.","Please refer to Annex A 12.4.2 & A.12.4.4 ISO/IEC27001:2013","Evidence of procedures and technical mechanisms in place to manage and review time synchronisation on relevant information processing systems.",null,null,"Level 0",null,null,0]
[null,4.2,"Audit Logging ","Audit logs recording user activities, exceptions, and information security events should be produced and kept for an agreed period to assist in future investigations and access control monitoring.","The organisation does not have an audit logging policy in place and events overwrite rapidly because the correct events are not being logged. ","The organisation has configured its audit logging policy but a thorough assessment has not been made and logs may not be kept for as long as is necessary to conduct investigation.","The organisation has made a thorough assessment of all the events and necessary information required to be collated for the purpose of investigating incidents. Logs are retained for a minimum of one year. ","Please refer to Annex A 12.4.1 & 12.4.3 ISO/IEC27001:2013","Evidence of policy and design documentation detailing event logging.",null,null,"Level 0",null,null,0,"Out of 3"]
[null,4.3,"Monitoring System Use ","Procedures for monitoring use of information processing facilities should be established and the results of the monitoring activities reviewed regularly","The organisation does not have any procedures for monitoring use of information processing facilities. ","The organisation has some procedures for monitoring use of information facilities but these procedures have not been officially approved. ","The organisation has procedures in place for monitoring the use of information processing facilities. Staff are briefed on the content of these policies."," Please refer to Annex A 12.4.1 ISO/IEC27001:2013","Evidence that policies detailing staff requirement and expectations are in place. This will include access to internet & email systems as well as access to patient data.",null,null,"Level 0",null,null,0,{"$f":" SUM(O16:O18)","v":0},{"$f":"P18/3","v":0}]
[null,5,"Network / Host Controls "]
[null,5.0999999999999996,"Boundary Security Devices ","Suitable measures are in place between network segments, with an appropriate level of management for example Firewalls, Application Firewalls, ACL's etc. ","The organisation has installed firewalls on the perimeter of its network. ","The organisation has installed firewalls on the perimeter of its network. All connections are documented and justified.\n","The organisation has identified and documented the various security domains within its network; these are segmented by suitably configured firewalls. \nAll connections are documented and justified. Anti spoofing rules are in place. \n","Please refer to Annex A 13.1.1 ISO/IEC27001:2013","Detailed description of the firewalls and other boundary security devices the organisation has in place.  Design documentation detailing the configuration in available for inspection.",null,null,"Level 0",null,null,0]
[null,5.2,"Network Browsing Restrictions ","Domains used to restrict network browsing. ","Domains are not used to restrict network browsing.","Domains are in place to restrict network browsing. ","Domains are in place to restrict network browsing and it is periodically audited.","Please refer to Annex A 13.1.3 ISO/IEC27001:2013","Design documentation detailing configuration ",null,null,"Level 0",null,null,0]
[null,5.3,"Penetration Testing ","Penetration testing will be performed on ALL external facing infrastructure by a CLAS consultant using the CESG/ CHECK approved process / vendor at least annually. Reports must be made available to DHCW on request.\n\n","No Penetration testing is performed.","Internal Penetration testing or Penetration testing by a non CESG/ CHECK approved vendor is performed. ","The organisation annually commissions a penetration test which is performed by a CESG/ CHECK approved vendor. ","Please refer to Annex A12.6.1 &18.2.3 ISO/IEC27001:2013","Risk assessment on any residual risk",null,null,"Level 0",null,null,0]
[null,5.4,"Malware Protection / \nAnti-Virus","Policy and controls to manage risks posed by all forms of malware / viruses.","No malware protection / Anti-Virus protection code in place.","Partial Deployment of malware protection / Anti-Virus  protection (e.g. Medical devices not protected)","Full deployment of updated malware protection / Anti-Virus protection.","Please refer to Annex A12.2.1 ISO/IEC27001:2013","Design documentation detailing configuration ",null,null,"Level 0",null,null,0]
[null,5.5,"Intrusion Detection","Intrusion detection mechanisms are in place to identify potential attacks for externally facing infrastructure.","There are no intrusion detection mechanisms in place to identify potential attacks. ","The organisation has intrusion detection mechanisms in place to identify potential attacks. ","The organisation has intrusion detection mechanisms in place to identify potential attacks. All potential attacks are investigated and handled using the organisations incident management procedures. ","Please refer to Annex A12.4 &16.1 ISO/IEC27001:2013","Design documentation detailing configuration ",null,null,"Level 0",null,null,0]
[null,5.6,"Patch Management Policy","A patch management policy is in place and documented for all software / hardware e.g. Operating Systems, Applications, and Firmware in use. The policy is audited for compliance to ensure that policy is followed.","The organisation does not have a patch management policy in place.","The organisation has a patch management policy in place but it mainly focuses on Microsoft updates and does not fully take into account updates provided by other vendors. ","The organisation has a comprehensive patch management policy in place.","Please refer to Annex A 12.1.2 ISO/IEC27001:2013","Policies detailing Patch Management & Change control",null,null,"Level 0",null,null,0]
[null,5.7,"Vulnerability Scanning ","All devices are scanned for the presence of security vulnerabilities at least quarterly. ","The organisation does not undertake any vulnerability scanning. ","The organisation scans some devices on a ad hoc basis.","The organisation scans all devices at least quarterly. ","Please refer to Annex A12.6.1 & 18.2.3 ISO/IEC27001:2013","Design documentation detailing configuration ",null,null,"Level 0",null,null,0]
[null,5.8,"Internet / Email Monitoring and Filtering Policy ","A content checking and blocking policy must be in place. ","The organisation does not have a content checking and blocking policy. ","The organisation has a content checking and blocking policy in place. ","The organisation has a content checking and blocking policy in place.  The organisation monitors the effectiveness of the policy. ","Please refer to Annex  A18.2.2 ISO/IEC27001:2013","Design documentation detailing configuration ",null,null,"Level 0",null,null,0]
[null,5.9,"Restrictions on Software Installation ","Governance around the installation of software by users shall be established and implemented","The organisation does not have any governance in place","The organisation has established governance in place but not implemented","The organisation has established governance in place and fully implemented","Please refer to A12.6.2 ISO/IEC 27001:2013","Governance documentation",null,null,"Level 0",null,null,{"$f":"IF(L28= \"level 0\",0,IF(L28= \"level 1\",0.5,(IF(L28= \"level 2\",1))))","v":0}]
[null,5.0999999999999996,"Electronic Communication","Person Identifiable Information (PII) involved in electronic communication shall be appropriately protected in line with the current NCSC Encryption Guidance.","PII is routinely sent via electronic communication without any encryption.","The organisations electronic communication is not protected with strong encryption but there are robust training and awareness programmes in place which educates users on the circumstances under which they are able/not able to send PII via electronic communication. ","The organisation protects PII in electronic communication by using strong encryption. ","Please refer to Annex A 13.2.3 ISO/IEC27001:2013","Design documentation detailing configuration ",null,null,"Level 0",null,null,0]
[null,5.1100000000000003,"Additional Links","List any additional ADSL or equivalent type of connection.\n\nProvide details regarding connection Purpose, Monitoring, Management and Assurance i.e. External Penetration Test / Remediation Reports.","Has additional links but no details of Purpose, Monitoring, Management and Assurance","Has additional links with partial details of Purpose, Monitoring, Management and Assurance","No additional links\nOr\nAdditional links with full details of Purpose, Monitoring, Management and Assurance","Please refer to Annex A13.2.1 ISO/IEC27001:2013","Design documentation detailing configuration\n\nFull details of Purpose, Monitoring, Management and Assurance.",null,null,"Level 0",null,null,0]
[null,5.12,"Third Party Connectivity","List any third parties (who have access to the organisations network either by N3, Consumer Broadband or otherwise).\n\nProvide details regarding contact information, reason for connection and how each third party provides remote support i.e. RDP via N3.","No details of third party connectivity,  associated contact details, reasons for connection and connection methods.  ","Partial list of third party connections.\nOr\nFull list of third party connections with incomplete information in relation to associated contact details, reasons for connection and connection methods. ","No third party connections\nOr\nFull list of third party connections with associated contact details, reasons for connection and connection methods. ","Please refer to Clause C6.1.1 & Annex  A15.1 ISO/IEC27001:2013","List of authorised connecting parties with associated contact details, reasons for connection and connection methods.  ",null,null,"Level 0",null,null,0,"Out of 13"]
[null,5.13,"Data protection at rest","Person Identifiable Information (PII) whilst stored must be appropriately protected in line with the current NCSC Encryption Guidance.","PII is stored without any encryption.","Some PII is stored with encryption, but this is either not deployed fully or uses weak encryption protocols. For example the local cache may not be encrypted","The organisation protects PII by using full disk encryption. ","Please refer to Annex A 13.2.3 ISO/IEC27001:2013","Design documentation detailing configuration ",null,null,"Level 0",null,null,{"$f":"IF(L32= \"level 0\",0,IF(L32= \"level 1\",0.5,(IF(L32= \"level 2\",1))))","v":0},{"$f":" SUM(O20:O32)","v":0},{"$f":"P32/13","v":0}]
[null,6,"Incident Response"]
[null,6.1,"Reporting Information Security Incidents & Events (Near Misses or Widespread Vulnerability) ","Information Security Incidents and events  are reported / escalated through appropriate internal management channels as quickly as possible.\n\nEscalation process needs to be established.","The organisation does not have an Incident Response policy.","The organisation has an approved Incident Response policy.","The organisation has an incident response policy, incidents are reported through internal management reporting channels in accordance with the policy. ","Please refer to Annex A 16.1.2 & 16.1.3 ISO/IEC27001:2013","Evidence of policy",null,null,"Level 0",null,null,0,"Out of 2"]
[null,6.2,"Responsibilities and procedures ","User and management responsibilities must be established to ensure quick, effective and orderly reporting of and response to Information Security Incidents.","The organisation has not established user and management responsibilities. ","The organisation has established user and management responsibilities to ensure quick, effective and orderly reporting of, and response to, Information Security Incidents. ","The organisation has established user and management responsibilities to ensure quick, effective and orderly reporting of and response to Information Security Incidents. These responsibilities are periodically reviewed for effectiveness. ","Please refer to Annex A 16.1.1 ISO/IEC27001:2013","Evidence of policy including Problem Management ",null,null,"Level 0",null,null,0,{"$f":" SUM(O34:O35)","v":0},{"$f":"P35/2","v":0}]
[null,7,"User Education "]
[null,7.1,"Acceptable Use Policy","An approved acceptable use policy must be in place with particular reference to Email,  Internet use and access to PII / Medical Records. Users must positively confirm their acceptance of the policy.","The organisation does not have an acceptable use policy in place. ","The organisation has an acceptable use policy in place. However there is no documented evidence that the policy is accepted by users. ","The organisation has an approved acceptable use policy in place. Users positively confirm their acceptance of the policy. ","Approved Acceptable Use Policy - Documented evidence of users confirming their acceptance of the policy. Signature on a declaration form, electronic acceptance. Please refer to Annex A 7.1.2 ISO/IEC27001:2013","Evidence of policy and signoff",null,null,"Level 0",null,null,0,"Out of 2"]
[null,7.2,"Awareness Training ","All employees of the organisation and, where relevant, contractors and third party users receive appropriate awareness training and awareness updates in organisational policies and procedures relevant for their job function.","The organisation does not ensure that employees contractors and third party users receives appropriate awareness training.","The organisation ensures that employees receive appropriate awareness training, however this awareness training does not extend to relevant contractors and third party users. ","The organisation ensures that all employees and where relevant, contactors and third party users receive appropriate awareness training and awareness updates in organisational policies and procedures relevant for their job function.","Documented Training records, relevant power point presentations, feedback forms. Please refer to Annex A 7.2.2 & 7.2.3 ISO/IEC27001:2013","Evidence of policy and signoff",null,null,"Level 0",null,null,0,{"$f":" SUM(O37:O38)","v":0},{"$f":"P38/2","v":0}]
[null,8,"Mobile/home working"]
[null,8.1,"Mobile working policy","A formal policy must be in place, and appropriate security measures must be adopted to protect against the risks of using mobile computing and communication facilities. ","The organisation does not have a formal policy or appropriate security measures to protect against the risks associated with  mobile computing and communication facilities. ","The organisation has an appropriate policy in place but have not fully implemented it.","The organisation has a formal policy and appropriate security measures are in place which protect against the risks of using mobile computing and communication facilities","Please refer to Annex A 6.2.1 & 6.2.2 & A11.2.6 & A11.2.5 ISO/IEC27001:2013","Evidence of policy",null,null,"Level 0",null,null,0]
[null,8.1999999999999993,"Portable Electronic Devices \n\n","Any use of Portable Electronic Devices will be authorised, managed, configured and operated in accordance with the current NCSC Encryption Guidance.\n\nIncludes Physical Media in transit. (including a variety of communication methods for digital media i.e. CD's, DVD's, USB Sticks, etc.)","The use of Portable Electronic Devices are not managed and unauthorised devices are routinely in use throughout the organisation. ","The organisation does have a number of authorised and managed Portable Electronic Devices but there are still some devices used by staff that have not been authorised and staff use of Portable Electronic Devices is not managed in accordance with the current NCSC Encryption Guidance.","The organisations use of Portable Electronic Devices is authorised, managed and configured and operated in accordance with the current NCSC Encryption Guidance.","Please refer to Annex A 6.2.1 & 8.3 ISO27001:2005","Risk Assessment identifying local devices at risk",null,null,"Level 0",null,null,0,"Out of 3"]
[null,8.3000000000000007,"Remote Access ","Multi-factor authentication is used for remote access from remote working devices.","The organisation does not use multi-factor authentication mechanisms for remote access."," Multi-factor authentication is used for remote access to some systems/infrastructure.","The organisation uses multi-factor authentication for all remote access. ","Please refer to Annex A 6.2 ISO/IEC27001:2013","Overview of MFA solution implemented",null,null,"Level 0",null,null,0,{"$f":" SUM(O40:O42)","v":0},{"$f":"P42/3","v":0}]
[null,9,"Business Continuity "]
[null,9.1,"Business Continuity Management ","A managed process must be developed and maintained for business continuity  that addresses the information security requirements throughout the organisation.","The organisation does not have a managed process for business continuity. ","The organisation has started developing a managed process for business continuity throughout the organisation however this is still not complete and has not been ratified by senior management. ","The organisation has developed a managed process for business continuity throughout the organisation. The process is maintained and it address the information security requirements need for organisation business continuity.","Business Continuity Plan - and associated documentation in developing the BCP - e.g. Business Impact Analysis. Please refer to Annex A 17.1.1 ISO/IEC27001:2013","Evidence of plan and signoff",null,null,"Level 0",null,null,0]
[null,9.1999999999999993,"Disaster Recovery Planning, Testing, Initiation Process","Plans must be developed and implemented to maintain or restore operations and ensure availability of information at the required level and in the required time scales following interruption to or failure of critical business processes. These plans must be tested using a suitable methodology on a regular basis. ","The organisation has not developed any plans to maintain or restore operations and ensure the availability of information at the required level and in the required time scales following interruption to or failure of critical business processes. ","The organisation has developed the plans but they are not fully implemented.","The organisation has fully developed and implemented disaster recovery plans, these are regularly tested and proven","Annex A17.1.2 & 17.1.3 ISO/IEC27001:2013","Evidence of plan and testing together with an outline of Software escrow provisions (especially if developing software for NHS Wales) if applicable",null,null,"Level 0",null,null,0,"Out of 3"]
[null,9.3000000000000007,"Information Back -up ","An information back up policy and procedure must be established. The back up & restore process must be routinely tested to ensure that it can be relied upon for use after an incident. ","The organisation does not have a backup policy and procedure. ","The organisation has a backup policy and procedure however the back up process is not routinely tested and therefore can't be relied upon for use after an incident. ","The organisation has a backup policy and procedure. The backup and restore process is routinely rested to ensure that they it can be relied upon for use after an incident.","Please refer to Annex A 12.3.1 ISO/IEC27001:2013","Design documentation detailing configuration ",null,null,"Level 0",null,null,0,{"$f":" SUM(O44:O46)","v":0},{"$f":"P46/3","v":0}]
[null,10,"Compliance"]
[null,10.1,"Disposal Policy","A media disposal policy is in place, the policy is audited for compliance in-line with appropriate disposal standards i.e. DOD 5220.22-M and WEEE Environmental Directive.","The organisation does not have a media disposal policy.","A media disposal policy is in place but the policy is not audited for compliance. ","The organisation has a media disposal policy and it is regularly audited for compliance. ","Disposal of sensitive media such as documents containing PII Person Identifiable Information and sensitive business information e.g. financial. The organisation should consider. Please refer to Annex A11.2.7 ISO/IEC27001:2013","Evidence of policy and auditing.",null,null,"Level 0",null,null,0,"Out of 2"]
[null,10.199999999999999,"Data Protection and Privacy of Personal Information","Data protection and privacy must be ensured as required in relevant legislation, regulations, and if applicable, contractual clauses. The organisation must have an individual with documented responsibility for implementing the data protection agenda. ","The organisation has not ensured data protection and privacy.","The organisation ensures data protection and privacy as required in relevant legislation, regulation and contractual clauses. ","The organisation ensures data protection and privacy as required in relevant legislation, regulation and contractual clauses. The organisation has a Data Protection Officer. ","Person in the organisation designated Data Protection and IT Security Officer Role - this does not necessarily mean that this is a full time post it can be  part of another roll. But this must be fully documented in the job description. Please refer to Annex A 18.1.4 &6.1.3 & 6.1.4 & 8.2.1 ISO/IEC27001:2013","Evidence of job description for individual",null,null,"Level 0",null,null,0,{"$f":" SUM(O48:O49)","v":0},{"$f":"P49/2","v":0}]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Level?"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Level 0"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Level 1"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Level 2"]

{"sheet":"5. Interim Connection","index":17,"n_rows":11,"n_cols":6,"rows_kept":11,"cut":false,"hidden":true,"merged":[[0,1,0,5],[1,1,1,5],[2,1,2,5]]}
[null,"\nInterim Connection\n"]
[null,"A temporary 3 month connection will only be granted in exceptional circumstances e.g. Business Continuity, Emergency Care"]
[null,"Justification:"]
[null,"Requirements","Description of requirements","Answer","Evidence","Evidence attached"]
[null,"IT Security Certification","The organisation has ISO27001, Cyber Essentials+ (CE+) or equivalent certification achieved within the last 3 years",null,"Certificate"]
[null,"Information Governance","The organisation has Information Governance policy and processes in place",null,"Policy, Process"]
[null,"Service Level Agreement","There is an SLA in place for the service under this connection",null,"SLA"]
[null,"Hardware Management","All ports are hardened e.g. closed",null,"Port Report"]
[null,"Patch Management","Hardware patches relevant to the connection have been applied ",null,"Hardware Patch Report"]
[null,"Patch Management","Software patches relevant to the connection have been applied ",null,"Software Patch Report"]
[null,"Patch Management","Application patches relevant to the connection have been applied ",null,"Application Patch Report"]