Page 28 - Data and Digital Technology Strategy 2024-2026

STRATEGIC PRINCIPLES STRATEGIES AND ACTIONS
SECURITY
PRINCIPLES
 Appropriate governance will be used
to secure the RVC’s networks and
information systems.
 A risk-based approach will be used
to identify, assess, and understand all
security risks.
 Asset management will be used to
manage everything required to secure the
RVC’s essential operations and functions.
 The RVC will manage security risks
to essential functions resulting from
dependencies on external suppliers and
third-party services in its supply chain.
 The RVC will defi ne, implement,
communicate, and enforce policies and
procedures to secure RVC systems and
data.
 The RVC will understand, document,
and manage access to networks and
information systems to ensure all access
is verifi ed, authenticated, and authorised,
using the principle of least privilege.
28
 The RVC will proactively detect potential
 RVC data will be stored and transmitted or actual malicious activity affecting the
with effective controls to prevent
unauthorised access, modifi cation, or security of its networks and systems.
deletion.  The RVC will defi ne and test its incident
 The RVC will limit opportunities to management processes to ensure
continuity of essential functions in the
compromise networks and systems with
event of failure.
robust, reliable, and protective security
measures.  When incidents occur, the RVC takes
steps to understand root causes and
 The RVC will build networks and systems
learn lessons to ensure similar incidents
resilient to cyber-attack and system
failure using multiple layers using the do not reoccur by using principles of
principle of defence in depth. continuous feedback and improvement.
 The effectiveness of the RVC’s cyber
 All staff and students will have
security measures will be externally
appropriate awareness and training to
be secure custodians of RVC’s data and verifi ed and accredited.
information systems.
 The RVC will continually monitor
its networks and systems to detect
potential security problems and track the
effectiveness of existing measures.
28