# data[].attributes.body
Review policies, processes, standards and ensure they reflect the risks and are appropriate to protect the University but enable the delivery of service and strategy ​

# data[].attributes.body
Review the guidance, training, awareness and support given to the various user communities (staff, student etc) and the cultural change of the change in security positioning​

# data[].attributes.body
Review governance to ensure security policies, process and standards are compliant and to support audit and investigation activities and ensure training and awareness is effective.

# data[].attributes.body
Implement technical controls and improvements to strengthen the security defences and monitoring at the University to protect the Digital environment and to safeguard its Information. ​

# data[].attributes.body
Review/Create Network Connection Policy - overarching

# data[].attributes.body
Review/Create Patching Policy - overarching

# data[].attributes.body
Alumni 'email for life' Policy

# data[].attributes.body
Server 'admin account' Policy

Administrator rights policy

# data[].attributes.body
Review current training package - Consider mandating

# data[].attributes.body
Implement new packages if required - e.g. Phishing campaigns.

# data[].attributes.body
Increase comms and awareness

# data[].attributes.body
Mange the cultural change in the new approach to security – communications and training

# data[].attributes.body
Procurement security standards

# data[].attributes.body
Records management – where to store data and backing up

# data[].attributes.body
Identity management policy – Staff, Student, PGR

# data[].attributes.body
Data movement policy

# data[].attributes.body
Backup and DR policy

# data[].attributes.body
Mobile device storage policy – Memory sticks

# data[].attributes.body
UoP Guest wifi access policy – what can you connect to

# data[].attributes.body
Password Policy

# data[].attributes.body
AUP policy

# data[].attributes.body
Web filtering policy

# data[].attributes.body
Web site policy – security and change management

# data[].attributes.body
Apple device policy

# data[].attributes.body
Mobile device policy (phones and BYOD)

# data[].attributes.body
Research Kit Policy

# data[].attributes.body
Set up Cyber Security team

# data[].attributes.body
Cyber Security third party audit

# data[].attributes.body
Account management process – Leavers, starters(link to HRF prog?)

# data[].attributes.body
Business continuity and Recovery planning

# data[].attributes.body
Disaster Recovery for Estates systems

# data[].attributes.body
Business case for longer term SOC

# data[].attributes.body
Implement CMDB (Config Management Database)
Ensure system configurations recorded in CMDB

# data[].attributes.body
Review existing systems compliance to security policies

# data[].attributes.body
Validate Third Party VPN access

# data[].attributes.body
Audit security of websites

# data[].attributes.body
Confirm priority order for service restoration

# data[].attributes.body
Audit storage of data on PCs

# data[].attributes.body
Audit data stored on network stores

# data[].attributes.body
Audit Disaster Recovery setup for Public website

# data[].attributes.body
Implement Zero Trust framework and Strong authentication – Biometrics

# data[].attributes.body
Implement Access Control and Privilege Management

# data[].attributes.body
Network activity threat monitoring

# data[].attributes.body
Review and update security hardening on all platforms (Microsoft, Linux, Apple, Blackbox and others)

# data[].attributes.body
Alternative for LAR

# data[].attributes.body
Update to latest Single Sign On standards (SAML)

# data[].attributes.body
Review Legacy Estates systems

# data[].attributes.body
Implement Federated External Access (Partner users)

# data[].attributes.body
Complete Quarantine Client Device review

# data[].attributes.body
Remove (Federate) local accounts on systems e.g. StarRez

# data[].attributes.body
Implement regular penetration test process

# data[].attributes.body
Implement management system for all end point devices (Windows, Linux, Apple, Android, Others)

# data[].attributes.body
Review all legacy network connected devices

# data[].attributes.body
VPN, Network and Storage segregation

# data[].attributes.body
Implement network posturing checks

# data[].attributes.body
DDOS protection

# data[].attributes.body
New secure Service Status page

# data[].attributes.body
Staff email and storage policy

# data[].attributes.body
Data management policy overarching

# data[].attributes.body
clarifying and seek consultation/approval on how to confirm identify of people (service desk)