OFSM Information Documents

OFSM Data Security document

Data Security

Overview

The Online Free School Meals (OFSM) system, when hosted on our servers, will provide the highest level of data security and will comply with all appropriate regulations and codes of practice¹. The system will, of course, fully comply fully with the Department for Education (DfE) Eligibility Checking Service (ECS) connection requirements². It is not the intention of this document to give detailed accounts of the provisions of the ECS connection requirements, or their attainment, but the following is a brief outline of some major issues.

We have extensive experience in providing and managing systems involving the transferring and handling of large quantities of personal data, for example, the DfE’s Performance Tables and Key to Success (KtS) service. In addition to working on many projects and services for the DfE, we work for many other central government, local government and non-departmental public body organisations.

Personnel

Only trained staff with experience of handling personal data will be permitted to access the OFSM system. All staff are cleared to Baseline Personnel Security Standard³ and will have Enhanced Disclosure and Barring Service (DBS)⁴ clearance. We expect any Local Authority (LA) user of the OFSM system to be at least cleared to the Baseline Personnel Security Standard.

 

Physical Security

Our servers are located in one of TelecityGroup's data centres in London⁵. TelecityGroup is the leading operator of network-independent data centres in Europe and all of their data centres are certified to the ISO 27001⁶ (Information Security Management) standard and have Payment Card Industry Data Security Standard (PCI DSS) accreditation. The data centre has a permanent manned security presence and uses multi-layered physical security including a secure perimeter, biometric and video surveillance.

Entry to the data centre is tightly controlled - with strict procedures in place to monitor and control visitor access both into and within the data centre. Extensive CCTV video camera surveillance is in place accross each facility, along with security braeach alarms, biometric checks and vontolled physical barriers.

Intrusion Detection, Monitoring and Access Control

Intrusion detection mechanisms (both within the OFSM domain and between the OFSM domain and connected networks) are in place to identify potential attacks. The OFSM service has mechanisms in place to detect suspicious activity and to identify suspected multiple applications.

Information Security events are reported through appropriate management channels as quickly as possible. Management responsibilities between us and the LA will be established to ensure quick, effective and orderly responses to Information Security incidents.

The OFSM service incorporates reliable user authentication, including measures concerning password strength, renewal and re-use.

Audit logs recording the activities of all users, exceptions and information security events will be produced to assist in future investigations and access control monitoring.