vvcb/pytgithub-test

pytgithub-test's Issues

1.2.1.:You must ensure that changes to policies and standard operating procedures can only be made by trusted individuals.

It is important to ensure that policies and SOPs are relevant, up-to-date and carefully controlled to maintain the integrity and security of your TRE organisation.

1.5.5.:You must have robust and secure applications in place to authenticate users (and services) within the TRE.

The number of authentication applications should be kept to a minimum with common controls and standards applied across all such as MFA, password complexity etc..

1.4.6.:You must keep a complete record of all the data assets held within the system.

Details of all data assets (current and past) held by the system should be retained along with meta-data useful for ensuring compliance can be demonstrated. This would include ownership, data lifecycle, contracts, risk assessments and other quality data. This is likely to already exist within the wider organisation but may require augmenting for the TRE.

1.2.11.:You should collect and maintain quality management data for measuring the effectiveness of a TRE.

Large amounts of data will be produced by elements within the TRE. These data should be analysed with reports and dashboards provided to guide TRE implementer’s improvements and provide re-assurance to data consumers and data subjects.

1.1.1.:You must gather and monitor the information governance requirements needed to fulfil any legal, regulatory and ethical standards.

Requirements will come from a variety of sources including legislation, contractual obligations and ethical standards. Requirements must be monitored to ensure the TRE controls remain appropriate.

Test Issue

1.4.5.:You could implement a portal that can provide a workflow engine and database which automates the processes within this capability.

A portal should automate as much of the processes within the capability as possible. Where processes are automated, process maturity is easier to achieve, with more consistent completion and automatic production of quality control and monitoring data.

1.2.4.:You must audit your TRE organisation against relevant requirements and standards.

If you are publicly accredited against a standard, for instance ISO27001, DSPT, CE+ etc., you must have processes in place to ensure you remain compliant.

1.6.5.:You should accept proof of relevant training certifications from trusted third parties.

You might choose to trust certifications provided by known training providers or your institution’s partner organisations.

1.2.6.:You must ensure that suppliers, contractors and sub-contractors with access to your TRE align with your security requirements.

These should be included as mandatory, non-functional requirements in during procurement and contracting. This will also include contractor staff contracts for example, legal liability and NDAs.

1.6.2.:You must ensure that relevant training is available for all roles within the TRE organisation.

All TRE organisation members need to complete all relevant training and keep their training current. You may need to provide help or guidance to enable them to do so. Details of what training is needed will have been determined above.

1.4.4.:You must have standard processes in place for the end of a project, that follow all legal requirements and data security best practice.

This includes the archiving of quality and log data along with the archiving or deletion of data sets.

1.5.4.:You must not give anyone access to datasets without agreement from the Data Controller.

The Data Controller may choose to delegate this authority.

1.2.8.:You must track and maintain any physical assets used by your TRE.

All physical assets should be maintained and covered by warranty if applicable. At the end of their lifetime, assets should be securely disposed of in such a way that data cannot be recovered from them.

1.3.1.:You must have a way to score risk to understand the underlying severity.

You have a risk assessment methodology for scoring risks on multiple axes such as impact and likelihood.

1.4.7.:You should keep a complete record of all the research studies and projects within the TRE current and past.

The study register should contain all data related to a study including a reference to data assets, project team members, information asset owners and any compliance activities required.

1.1.1.:You must gather and monitor the information governance requirements needed to fulfil any legal, regulatory and ethical standards.

Requirements will come from a variety of sources including legislation, contractual obligations and ethical standards. Requirements must be monitored to ensure the TRE controls remain appropriate.

1.3.5.:You must understand the risk appetite of your TRE organisation.

This includes understanding ownership of risk, and ability to accept risk which falls outside of the appetite should that become necessary.

1.2.3.:You should measure the performance of information governance within the TRE with regular reporting available to your TRE organisation’s management team.

This may include reports and dashboards showing security incidents, quality management deviations and audit findings.

1.2.12.:You could use a QMS (Quality Management System) to standardise and automate quality management tasks and workflows, and to generate quality data and reports automatically.

A basic QMS could be a set of spreadsheets or documents held in a repository which are manually maintained. More mature applications will provide workflows and generate quality data through manual and automated actions.

1.1.3.:You must ensure there are adequate resources to meet information governance requirements.

Ensuring information governance controls are suitable and enforced requires an investment of funding and people appropriate to the size of the TRE.

1.5.1.:You must have a robust method for identifying accredited members of your TRE organisation, prior to their accessing of sensitive data.

This may include ID checks or email/phone verification.

2.2.7.:You should understand the availability and uptime guarantees of any providers that you rely on.

For remote TREs this might include your cloud provider(s) and/or data centre operators. For on-premises TREs, it might be worth using an uninterruptable power supply (UPS) and planning how you would deal with internet outages.

1.6.1.:You must determine what training is relevant for all roles within the TRE organisation.

This may include, for instance, cyber security training, GDPR training, and higher level training for system operators. Specialised roles are likely to need more tailored training. Identification of these specialities should be done through a systematic training needs analysis. Specific training may also be required based on the data or information asset owner such as GCP.

1.2.9.:You must log, track and resolve any issues resulting from deviations from processes, incidents and audit findings.

This process could, for example, be tracked through an electronic record and workflow system with records retained.

1.6.6.:You could have a training platform capable of delivering online training in a variety of formats.

This could be a simple content delivery platform or a more comprehensive LMS platform. It could also include a range of multimedia delivery formats, and accessible training modules for those with access requirements.

1.6.8.:You could ensure that any courses you use are available in standard, transferable formats.

Support for standard formats such as SCORM allows courses to be shared between providers. This could help facilitate standardisation of training provision for TRE users across organisations.

1.3.2.:You must carry out a data processing assessment for all projects requiring a TRE.

A data processing assessment is a process designed to identify risks arising out of the processing of sensitive data and to minimise these risks as far and as early as possible. This may take the form of an existing regulatory requirements such as Data Protection Impact Assessment.

1.2.10.:You must use reported issues to inform changes, such as for process improvement and risk management.

All issues should be analysed for their root cause and improvements put in place to prevent further occurrence.

1.2.7.:You must monitor compliance of your suppliers with the terms of the contracts.

This will include monitoring changes in the services and infrastructure being delivered and quality management within the contractor’s organisation. This may be done through formal audit or by monitoring change and quality documentation provided by the supplier.

1.2.5.:You must report on and share outcomes of each audit of your TRE organisation with the required bodies.

This may include regulatory bodies or the organisations that manage accreditations you have.

1.5.2.:You must have clear onboarding processes in place for all roles within your TRE organisation.

This may include all members signing role-specific terms of use or confirming that they have completed role specific training.

1.3.4.:You must have a clear set of roles and responsibilities relating to risk including who owns risks and how they are escalated and delegated.

The highest level of risk ownership is the Top Management of the TRE organisation (see Governance Roles). In order to ensure escalations to this level are rare, suitable structures should be put in place to own, mitigate and accept risk.

1.4.1.:You must have checks in place to ensure a project has the legal, financial and ethical requirements in place for the duration of the project.

This includes checks that contracts are in place where required, adequate funding is available for the duration of the project, and responsibilities concerning data handling are understood by all parties.

1.5.6.:You must give each user of the TRE a unique logon with changes to any records strictly controlled.

The unique identifier and all associated records for a user should be traceable across the entire TRE. This will include training records, affiliations, contract agreements and ethics approvals where required.

1.3.3.:You must have a process for designing, implementing and recording risk mitigations where indicated by a risk assessment.

Actions that are taken or not taken following a risk assessment must be recorded.

1.4.2.:You must have checks in place to ensure that any time limited compliance requirements are maintained.

This includes ensuring contracts remain in valid and action is promptly taken should they expire. Any changes in the status of responsible persons should also be monitored, for example a data owner leaving an organisation.

1.6.3.:You must provide repeat or updated training where necessary to account for changes in competency requirements.

Training is not a one-off event. Electronic reminders for refresher training should be considered. Ideally, training should remain relevant and so policies and processes should enable people to demonstrate competency rather than unnecessarily repeating training.

1.6.7.:You could implement a learning management system (LMS) to manage courses and deliver training as required.

Where possible an LMS should support a variety of course content and testing.

1.5.3.:You must have a set of services to manage access to resources based on identity.

This will include a security model for role based access with technical controls to ensure the principle of least privilege is enforced.

2.2.8.:You should develop an availability target or statement and share this with your users.

Understanding how and when the TRE might be unavailable will help your projects in planning their work.

1.2.2.:You must use versioning and a codified change procedure for all policies and standard operating procedures.

This includes recording dates of changes, person responsible for carrying out changes, and summary of changes.

2.2.6.:You must have a documented procedure for removing infrastructure when it is no longer needed.

Removing unused infrastructure not only reduces costs and management burden but also reduces the attack surface of a TRE and reduces the risk of unaddressed vulnerabilities.

1.1.2.:You must ensure controls are implemented to ensure the requirements are met.

Control implementation should be systematic and directly aligned to the internal and stakeholder requirements.

2.2.5.:You should have a development environment that mirrors your production environment which you use to test infrastructure changes before committing them to production.

If possible, you should automate application of changes between development and production environments. Consider the costs and practicality of whether this will work for your situation.

Test Issue

1.6.4.:You must maintain accurate training records that are directly tied to the role and access levels within the TRE.

Training records should be tied to a user record and carefully maintained. Maintaining training records enables you to ensure all people have completed the required training and that repeat training happens regularly.

1.4.3.:You must have checks in place to ensure that changes in regulations are met for a project.

2.2.9.:Your TRE must control and manage all of its network infrastructure in order to protect information in systems and applications.

Network infrastructure must prevent unauthorised access to resources on the network. This may include firewalls, network segmentation, and restricting connections to the network.

1.6.9.:You could keep historical copies of courses in order to demonstrate competency at a given point in time.

Information asset owners and regulators may be required to audit historical records, e.g. for clinical trials. It may be necessary to retain copies of superseded training along with versions of certifications within the training record.