Data Security Standard 5 - Process reviews

Past security breaches and near misses must be recorded, and used to inform periodic workshops to identify and manage problem processes. They also allow organisations to learn lessons and prevent future breaches.

Workshops should involve looking in detail at where high risk behaviours are most commonly seen, and then considering actions to address these issues. User representation (staff within your organisation who carry out the processes) at these workshops is crucial. It is important that the impact on the user is factored into considerations of how to address these issues, as a solution which is overly taxing could result in a workaround, creating more security risks.  

Standard 5, National Data Guardian (NDG) review