information asset management...comply for less!!

April 2023

Release 2013.1

System Overview

Author:

© ApiraUnauthorised reproduction, adaptation, translation or display is strictly prohibited. of 18

Information Asset Manager

April 2023

Table of ContentsTABLE OF CONTENTS.................................................................................................................................................... 2

TABLE OF FIGURES....................................................................................................................................................... 2

INTRODUCTION........................................................................................................................................................... 3

Information Governance Toolkit....................................................................................................................................4Roles and Responsibilities..............................................................................................................................................4

DEFINITION OF INFORMATION ASSETS......................................................................................................................... 5

Primary Assets...............................................................................................................................................................5Supporting Assets..........................................................................................................................................................5

USER PROFILES AND THE ORGANISATIONAL HIERARCHY..............................................................................................7

RECORDING ASSETS AND DATA FLOWS IN IAM............................................................................................................. 9

INFORMATION FLOWS.............................................................................................................................................................9

INFORMATION ASSETS............................................................................................................................................... 11

REPORTING................................................................................................................................................................ 12

CREATING YOUR INFORMATION MANAGER SYSTEM..................................................................................................13

INITIATION..........................................................................................................................................................................13START-UP...........................................................................................................................................................................13DEPLOYMENT......................................................................................................................................................................13

GLOSSARY.................................................................................................................................................................. 14

DOCUMENT HISTORY................................................................................................................................................. 16

DOCUMENT PROPERTIES........................................................................................................................................................16VERSION HISTORY................................................................................................................................................................16

APPENDIX A ISO27005 INFORMATION ASSETS DEFINITION.........................................................................................17

Table of FiguresFIGURE 1. DASHBOARD.......................................................................................................................................... 3FIGURE 2. MAPPING ASSETS AND BUSINESS PROCESSES..........................................................................................6FIGURE 3. INFORMATION ASSET MANAGER – USER RESPONSIBILITIES......................................................................7FIGURE 4. ORGANISATION HIERARCHY IN IAM.........................................................................................................8FIGURE 5.PICKING LISTS IN THE SYSTEM................................................................................................................. 8FIGURE 6. CREATING AN INFORMATION FLOW IN IAM...............................................................................................9FIGURE 7. PROCESS OF INFORMATION FLOW CREATION AND AUTHORISATION..........................................................10FIGURE 8. INFORMATION FLOW SCREEN SHOWING RISK SCORES.............................................................................10FIGURE 9. ASSET CREATION SCREEN IN IAM.........................................................................................................11FIGURE 10. ASSET CREATION PROCESS................................................................................................................11FIGURE 11. IAM REPORTING MODULE...................................................................................................................12


April 2023

Introduction

Health organisations collate, use and transfer probably the largest volumes of Personal Confidential Data (PCD) in the country, and do so within the legal regimes of the Data Protection Act 1998, Freedom of Information Act 2000, Access to Health Records Act 1990, Common Law Duty of Confidentiality, to name but a few. Many will be aware of the risk to losing data in the form of fines from the Information Commissioner. Coupled with NHS Policy on risk management and the requirements of the Information Governance Toolkit, the challenge is immense.

In response to the legal and policy requirements on the NHS, all assets and transfers of information must be risk assessed to ensure they are safe and properly protected.

Apira Information Asset Manager (IAM) has been to designed in response to that challenge and to customer demand for a system which answers those key questions; where is my information?, is it properly managed?, who has access to it?, where do I send it? and am I transferring it safely and securely?

IAM allows organisations to record those information assets it holds, record the information flowing around the organisation and as a key function, provide a risk score against the information and flows. Included is a dashboard and reporting function that allows the Senior Information Risk Owner (SIRO) to be confident that information risk is being managed throughout the organisation.

Figure 1. Dashboard


April 2023

Information Governance Toolkit

The Information Governance Toolkit (IGT) is the required standard for all NHS organisations in information governance. IAM is centred around two key areas of the toolkit; 308 – Data Flow Mapping and 301 - Information Asset Management Because IAM covers many of the operational requirements of information risk management, the following requirements are also greatly informed:

308 – Data flow mapping

303/304/305 – Access Control

110 – Contracts with third parties 309/310 – Buisness Continuity

and Disaster Recovery

202 – Appropriate use of patient data

311 – Virus Protection

206 – Confidentiality Audit 313- Network Security

207 – Information Sharing Agreements are in place

313 – Mobil, home and remote working security

209 – Information is shared outside the EU only with proper protections

404 – Multi-professional records audit

324 – Information is pseudonymised or anonymised where required

406 – Availability of records audit

301 – Risk Assessment programme in place for all assets

505 – internal and external coding audit

307 – A risk register of assets is in place

506 – coding audit programme

323 – appropriate technical measures are in place to protect all assets

507 – completeness and validity audit

604 – information lifecycle audit

Roles and Responsibilities

The Accounting Officer is accountable for the assets belonging to the organisation – the Chief Executive.

The Senior Information Risk Owner (SIRO) for the organisation is required to assure the board that all information assets are accounted for and that proper controls are in place to manage the information – A Director on the Board.


April 2023

Information Asset Owners (IAOs) (assisted by Information Asset Administrators – IAAs) are responsible for the day to day information risk management of each information asset and reporting to the SIRO – Directors (IAOs) and Senior Managers (IAAs).

Definition of Information AssetsAn important concept in managing information assets using the Apira IAM system is the definition of an asset and the data flowing in and out of it (covered in more detail in our Information Assets information sheet).

Apira Information Asset Manager uses the ISO27005 definition of an Information Asset. ISO27005 defines information assets as follows:

Primary Assets

Information at rest – A patient database, staff database or any collection (grouping) of personal confidential information stored (at rest) in any medium – recorded in the Assets section of the system

Business Processes – Data Flow Items (see 11-308 of the information governance toolkit)1 which are ‘sub-sets’ of the information held in the information at rest, e.g. appointment lists, patient letters and move about the organisation and externally, recorded in the Data Flows section of the system.

Supporting Assets

Supporting Assets are recorded as a subset of the Assets recording module of IAM, and more closely defined in the metadata management section of the system. Examples include:

Hardware – PCs, Servers, Laptops, Filing Cabinets, Printer, Disk Drive, USB Memory Stick Software – Operating System, Office Software, Email software, Clinical System Software Network – Ethernet, ADSL lines, WiFi equipment, Switches, Fibre Optic, Routers, Bridges Personnel – Information Asset Owner, Information Asset Administrator, person with technical

expertise, (e.g. a network manager) Site – Physical requirements for operations to continue (as related to the information asset), gas

supply, electricity supply, water supply, cooling equipment (e.g. air conditioning for server rooms) Organisation Structure – maintenance contracts for support of the information asset (e.g. third party

maintenance contracts, software support and SLA contracts but also can include project support for the information asset.

See Appendix A for the ISO270005 definition of Information Assets with an example.

IAM allows Primary Information Assets at rest to be recorded. Users can then record business processes or the flows of subsets of those assets (in the form of letters, discharge notifications, appointment lists etc.) around the organisation or even to record flows coming from or going to external organisations such as GPs.For example, a PAS database is a static collection of information (information at rest) which can have subsets of data moved in and out of it (a data flow item - clinic letter) which is sent to a patient (a flow). The risks to the information in the database might be the siting of servers (environmental such as flood, electricity supply) and the risk to the clinic letter as it ‘flows’ might be lack of encrypted email or insecure post.

1 IGT 11-308 - https://www.igt.hscic.gov.uk/RequirementQuestionNew.aspx?tk=415313635414503&lnv=2&cb=6040cf47-dc1b-4218-a7cd-03837ae623f5&sViewOrgType=2&reqid=2420© ApiraUnauthorised reproduction, adaptation, translation or display is strictly prohibited. of 18

https://www.igt.hscic.gov.uk/RequirementQuestionNew.aspx?tk=415313635414503&lnv=2&cb=6040cf47-dc1b-4218-a7cd-03837ae623f5&sViewOrgType=2&reqid=2420

https://www.igt.hscic.gov.uk/RequirementQuestionNew.aspx?tk=415313635414503&lnv=2&cb=6040cf47-dc1b-4218-a7cd-03837ae623f5&sViewOrgType=2&reqid=2420

April 2023

Figure 2 is a diagrammatical representation of mapping assets at rest and business processes (data flows):

Figure 2. Mapping assets and business processes

Risk is therefore inherent and calculated by IAM in the attributes of:

The data at rest (Primary Asset) The data flow (Business Process)


April 2023

User Profiles and the Organisational Hierarchy

IAM uses a role based approach to managing Assets and Flows in the system.

The SIRO Role – has full access to view all primary information assets recorded in the system and all flows of data, with a dashboard displaying the resulting risk scores for those items (the Caldicott Guardian can also be given this role to fulfil key recommendations of the Caldicott Information Governance review).

The SIRO Administrator Role – has the above functions, and also acts as the System Administrator, being able to create users and manage the metadata and risk scoring attributes of the system (this can be the Information Governance Manager or system owner).

The Risk Owner and Risk Administrator Roles – have access to view and manage information assets they are responsible for, and their associated flows. It is also possible to make ROs and RAs administrators for the system for their work areas, meaning they can manage users of the system.

The Flow User Role – has access only to the management of the flows of information in their team or area of work.

This can be expressed in the diagram below:

Figure 3. Information Asset Manager – User Responsibilities


April 2023

The organisation hierarchy is represented in the system in the form of three tiers:

Figure 4. Organisation hierarchy in IAM

As the picking lists in the system are configurable, these can be renamed to the organisation’s preferred terms. Each user is assigned to an area of the hierarchy, which is shown below as an example:

Figure 5.Picking lists in the system


April 2023

Recording Assets and Data Flows in IAM

Information FlowsAll users can record a flow of information between their area of work and any other area of the organisation, as well as to external agencies such as GPs, Social Care and other care providers. The flow records what data item is moving, what it contains, how it gets there and any protection or ‘controls’ which are in place when it is transferred.

Figure 6. Creating an information flow in IAM

A flow is recorded by the flow user and authorised by the Information Asset Owner/Administrator or SIRO roles, creating a risk score for that flow and fulfilling the key recommendation of the new Caldicott Information Governance Review, that information transfers are reviewed and authorised by Caldicott Guardians and SIROs.As flows can be internal, the user or team on the receiving end of the information flow can accept the flow, ensuring that it is appropriate and exists to them. If not, they can reject it and enter a reason so that the originator can remove it.The process of information flow creation and authorisation can be expressed as below:


April 2023

Figure 7. Process of information flow creation and authorisation

Risk scores are displayed in aggregate on the dashboard and in full on the information flow screens:

Figure 8. Information flow screen showing risk scores


April 2023

Information AssetsInformation Asset Owners and Administrators are able to create and record the assets they are responsible for in the system for flow users to map their flows against. They record who are the Information Asset Owner and Administrator for the asset are, what the asset is called, what it contains, what the supporting assets are, and what data flow items (e.g. clinic letters) can be transferred to or from the asset.

Figure 9. Asset creation screen in IAM

A key function of the system is that should a flow user be unable to see the information asset they use, they can create it ‘on the fly’ as an unassigned or temporary information asset. This is essential in identifying information assets that the organisation may have previously been unaware of, thus enabling them to be accounted for and risk managed once approved. The process of creating an asset is described below:


April 2023

Figure 10. Asset creation process

Risk scores are displayed on the dashboard and in the SIRO/IAO/IAA information asset screens.

Reporting The SIRO, IAO and IAA user roles are all able to ‘drill down’ from the dashboard to specific information assets and flows by directorate, department or team as required (see Figure 1).

Every information flow and information asset list can be exported in the form of PDF, MS Excel or MS Word documents.

Additionally, a reports module is included which provides standard bespoke system reports, all of which can be exported in the above document formats.

Figure 11. IAM reporting module


April 2023

Creating your Information Manager SystemThe IAM system is a framework on which you can reflect your organisation’s risk appetite and strategy.All picking lists in the system are configurable, and any item on that picking list that contributes to a risk score is individually score-able. Risks are calculated on the options entered by the user and may be presented to the user in a number of ways (depending on the user profile):

The dashboard Information asset screen Information flow screen Reports.

Apira can support the rollout process with training for administrators and users of the system, as well as project management support in the early stages.Organisations may find the following approach beneficial in thinking about deployment of the system:

Initiation Agree organisation hierarchy for use of the system Agree picking lists, key assets and data flow items Agree user profiles and user list Create training plan Training for system admins.

Start-Up Implement training plan Input picking lists, key assets and data flow items Test flows in one department or area.

Deployment Continue training plan Rollout to main user base

Monitoring of system use and balancing of risk scoring mechanism (metadata).


April 2023

GlossaryInformation Governance (IG) terminology:

Term DefinitionData 1. Facts and statistics collected together for reference or analysis.

2. Things known or assumed as facts, making the basis of reasoning or calculation

Record A collection of data related to a common origin, source, or subject, i.e. a person

Data set A number of records from a common origin or source comprising common or linked data component

Information Data that (1) has been verified to be accurate and timely, (2) is specific and organized for a purpose, (3) is presented within a context that gives it meaning and relevance, and (4) that can lead to an increase in understanding and decrease in uncertainty.The value of information lies solely in its ability to affect a behaviour, decision, or outcome. A piece of information is considered valueless if, after receiving it, things remain unchanged.

Knowledge Data, information, and skills acquired by a person through experience or education; the theoretical or practical understanding of a subject.A person with knowledge can apply this to data for it to become information and to determine actions arising.

Information Asset A data set in any media. The Information Asset may comprise patient information, person information (as defined by the Data Protection Act), or corporate information.‘Information Asset’ refers to the data, not the media in which it is held. This distinction is similar to the definition in ISO27005 between primary assets and secondary assets.

Risk The likelihood and impact of an adverse event

Information Risk The total subjective value of risk attributed only to Information Assets held by an organisation.Related to an overview of risk related to that Information Asset, who is accountable for that Information Asset (the Information Asset Owner) and who has operational responsibility for that Information Asset.

Risk Assessment The process and results of determining likelihood and impact of an adverse event occurring

Residual Risk The amount of risk remaining after risk mitigating controls have been implemented following a risk assessment

Dependency The gross class of elements on which an Information Asset depends for storage, transport and operation.In ISO 27005, this is referred to as a secondary asset.


April 2023

Attribute A single characteristic of a dependency. Some attributes increase or decrease the information risk to the dependent Information Asset (see risk attribute). Attributes that raise or lower information risk are a sub-set of attributes called risk attributes. These risk attributes have values attached to them. These are called Meta Values.

Risk Attribute A characteristic of a dependency that increases or decreases the risk to the Information Asset and from which the Information Asset’s risk can be calculated. Risk Attributes have a pre-defined sub-range of valued characteristics – Meta Values.

Meta Value The subjective value allocated to a Risk Attribute which, multiplied together generate the Risk Assessment of an Information Flow and Information Asset.

Information Flow A set of attributes that are the characteristics of an Information Asset when transported/in transit

Information Flow Mapping

The process of identifying Information Flows emanating or terminating in an Information Asset, i.e. in transit, and its beginning or end state, i.e. at rest.

Information Asset Register

A presentation of Information Assets held by an organisation which displays a limited range of Attributes, especially to the SIRO, IAO and IAA.

Data Collection Template

A form comprising data fields for the collection of Attributes related to a Dependency type or Information Asset

Meta Data Collection Template

A form comprising data fields for the collection and valuation of attributes that appear as linked fields in DCTs when entering data. The MDCT.

Role-based Access Control

A range of controls that allow Super Administrators to determine which roles are allocated to which users and to what functionality that user type will have access.


April 2023

Document History

Document PropertiesItem DetailsTitle System OverviewAuthorCreated 20/09/13Last Updated 28/01/14Published [Publish Date]

Version HistoryVersion Description Justification Date0.1 First draft September

20130.2 Second draft 9th September

0130.3 Third draft 20th September

20130.4 Fourth Draft 1st October

20130.5 Fifth Draft 24th

October20131.0 Final version 23rd December

2013


April 2023

Appendix A ISO27005 Information Assets Definition

ISO27005 Definition of Information Assets with an Example

Primary Information Asset Supporting Assets

Information (at rest) Business Processes (Information in motion, Data Flow Items)

Patient Administration Database (PAS) – the patient information contained in the database

Appointment ListsWard Bed Occupancy ListsDischarge NotificationsLetters to patientsPatient ReportsClinic Letters

Hardware – Server, PC, Laptop etc. which must be used to access the PAS database

Software – Operating Systems and software on which the information asset relies, such as PAS software, Windows server operating system software, Windows PC operating system software, Java Software

Network – Hub, Switch, Ethernet cable used to access the PAS database

Personnel –expertise in the organisation to manage and properly run the database, eg technical developers, system admins

Site – the risks at the physical location of the database or servers on which it relies – gas, water, electricity, air conditioning system, flood

Organisation structure – agreed supplier maintenance agreement, SLA, project management of upgrades to system, back up regime in placeIAO assigned, IAA assigned


April 2023


information asset management...comply for less!!

Health & Medicine

information flows

information manager

information flow screen

figures figure

information governance

recording assets

mapping assets

primary assets