Designing and implementing your security measures
GOV046
Put a range of physical and information security measures in place to keep your people, information, and assets safe when working away from the office.
When your people are working away from the office, your organisation must:
- ensure your people are appropriately briefed and trained to comply with your security and safety requirements and procedures
- mitigate the risks to your people, information, and assets to an acceptable level before you approve any arrangements for working away from the office
- apply security measures that give assurance in information and asset-sharing arrangements.
Reducing risks to your people
GOV047
Your chief security officer (CSO) and your health and safety officers should work together to develop responses that reduce risks to your people’s safety, and improve security when working away from the office.
To help you develop your responses, decide which security measures you will use to reduce the risks you’ve identified. You should also:
- identify preventive measures that apply before people leave the office
- detail actions to take in an emergency
- work out how your people should deal with clients and the public (if relevant)
- include vehicle safety and security if your people will be transporting protectively-marked information and equipment
- create procedures for reporting security incidents.
Developing incident reporting procedures
Advise your people to contact local police for assistance if they feel their safety is at risk. Once they’re safe, they should report the incident to your organisation.
You must have procedures in place for mobile or remote workers to report security incidents. These procedures should include reporting:
- any security incident involving your organisation’s information and assets
- other incidents at their work location.
When you’re developing your procedures, consider your ability to respond to, and investigate, incidents that occur outside your premises.
Reporting incidents and conducting security investigations has more information and advice.
Security alarm system options for mobile working
Consider the use of a security alarm system. Your organisations may use portable alarm systems to protect assets in other mobile work scenarios. For example, vehicles may be fitted with alarms and engine immobilisers.
Managing ICT security
GOV048
Meet ICT security requirements before you allow mobile or remote working arrangements to begin.
Before arrangements start, your organisation must meet all ICT security requirements specified in the New Zealand Information Security Manual (NZISM) - Working Off-Site.(external link)
Be mindful that ICT security for equipment can be difficult to enforce in working away from the office scenarios. However, when your people are using equipment your organisation has provided, it’s reasonable to expect them to use it in much the same way as they would in the office.
Include boundaries for use of ICT equipment in your policies
In your policies for mobile and remote working, you should clearly define boundaries for the use of equipment your organisation provides.
You should cover:
- what reasonable personal use means
- whether equipment can be used by family members or not
- any restrictions or rules you need your people to comply with.
Manage protectively-marked information
You must not allow your people to access protectively-marked information on public computers or other public ICT communication devices, such as internet cafes, hotel business centres, or airport lounges.
All information accessed on public ICT equipment is at risk. Your organisation has no control over who can access the equipment or the security features or applications that are enabled on the equipment by its owner or manager.
Consider the use of personal ICT equipment for work carefully
Today, more people are using their personal devices for corporate purposes, or their corporate devices for personal purposes. Both usage scenarios increase the risks to your organisation’s information. User education is crucial to managing the risks.
Before you approve the use of personal devices, refer to the following guidance on BYOD security controls you should have in place.
NZISM: 21.4. Non-Agency Owned Devices and Bring Your Own Device (BYOD)(external link)
Do not allow your people to use personal ICT equipment for processing information with a Business Impact Level (BIL) of high or above, or protectively marked RESTRICTED or above.
Be mindful that even when devices are turned off, information is still stored in memory and is therefore vulnerable.
Make sure your people understand the risk of information being lost when they’re working from a USB stick or similar storage device.
Protecting mobile devices
GOV049
Consider the following strategies for protecting mobile devices.
Mobile devices include portable computers, mobile communication devices, and USBs or other portable storage devices.
Prepare devices for use
- Ensure security and application updates are installed on each device, and that your people understand how to carry our further updates on their devices.
- Enable device security features and ensure that PINs and passwords are changed. Always use complex passwords containing upper and lower-case letters, numbers, and symbols.
- Remove any information that is not required to reduce the risk of information exposure.
- Back up information stored on the device. If a device becomes compromised, your opportunity to recover information from it may be limited.
- Evaluate the potential for compromise if the device will hold any encrypted information.
Give instructions for keeping devices safe and secure
Ensure each mobile device user gets as many of the following instructions as they apply.
- Maintain physical control of the device at all times. Do not leave it unattended in places where it may be an easy target for theft or tampering.
- Be vigilant at all times. When using a device, make sure that a conversation can’t be overheard and screen data can’t be seen by others.
- Avoid taking devices into situations where a sensitive or private conversation is likely. If you can’t avoid this situation, turn off the device and, when possible, remove the battery.
- If you lose physical control of the device (for example, when it is secured outside a meeting), ask your ICT security people for guidance before you use it again.
- Use corporate devices with all relevant security measures enabled. Only use a personal device for official business when BYOD polices allow and appropriate security measures are in place.
- If you’re concerned about the risk of tracking, disable any GPS capability. For extra security, turn off the device and, when possible, remove the battery.
- Disable any features or capabilities that you don’t need. For example, disable wireless, Bluetooth, and location services. Consider doing this before having confidential conversations.
- Always confirm the integrity of any new storage media with your ICT security people before you connect it to a device. All storage media should be regularly scanned for threats.
Ensure email usage is secure
To help keep emails secure, provide clear instructions in line with your policies on the following topics.
- Use of private email accounts to store or communicate official information.
- Forwarding emails from corporate email systems to personal email accounts, such as Gmail. This policy is especially relevant for emails with a classification of ‘restricted’ or higher.
- When you need additional email security and how to achieve it.
- How to reduce the risk of downloading hidden malware.
Keep internet usage secure
To help keep internet usage from becoming a security concern, provide clear instructions in line with your policies on the following topics.
- Using the privacy mode in an internet browser.
- Use of cookies.
- Disabling autofill to prevent your browser from storing usernames and passwords.
- Connecting to external networks. The simplest precaution is to not connect to the internet using unknown hotspots and instead use mobile 3G or 4G mobile networks.
Secure devices after use
- Following travel it is a good idea to change all device passwords.
- Treat any unencrypted information on a device that is lost as compromised.
Protecting conversations
GOV050
You need to protect your important information from being overheard or recorded.
You must develop procedures for protecting conversations that involve sensitive or protectively-marked information.
It is much easier to record a conversation than it is to record a laptop screen, so conducting these conversations in unsecured places is very risky.
The following measures may reduce the threat of conversations being accidentally overheard or recorded.
Avoid high-risk areas
Remind your people that high-risk conversations, including phone calls, should not be held in hire cars, taxis, shuttles, official vehicles, hotel rooms, or conference rooms unless measures are in place to ensure audio security. These areas are at high-risk of audio surveillance.
Also discourage your people from holding sensitive conversations or conversations involving classified information in closed public spaces while sitting or standing in one place, as the conversations can easily be overheard or recorded. Discussing classified information in public, on aircraft, in airport lounges, while at the local café, or in other locations known to be frequented by your people puts this information at significant risk and should be discouraged.
Use secure facilities when possible
The risk of audio interception is greatly increased when travelling overseas. Advise your people to use secure facilities for conversations or phone calls involving sensitive or classified information whenever possible. Using the secure facilities of an allied government is acceptable if the facilities are accredited to the appropriate level and the information being discussed is permitted to be shared with that government.
Use an open area
When no secure facility is available and a conversation or phone call is essential, direct your people to find an open public place, such as a park or open area. They should then talk while walking, being careful to ensure the conversation is not overheard by casual observers.
Parks and open areas offer the greatest protection from casual audio surveillance. 'White noise', such as running water from fountains, may also make it harder for someone to remotely record a conversation without specialist equipment.
Protect classified information
‘Audio secure areas’ are used to keep conversations involving classified information secure.
Outside these areas, it may be impossible to prevent determined adversaries, including foreign intelligence services, from listening in. You should only allow conversations involving classified information to happen outside audio secure areas if it is critical to an operation.
For SECRET information, seek advice from the originator of the information before you allow any conversations outside of audio secure areas.
For TOP SECRET information, seek advice from the New Zealand Security Intelligence Service and the originating organisation before you allow any conversations outside of audio secure areas.
Protecting information
GOV051
You must protect information when it is being used away from your office or being transported to another location. You must also comply with the handling requirements for protectively-marked information.
Securing official information in private facilities
You might find it difficult to adequately secure your information when your people are working in private facilities, such as commercial or client facilities. You’re unlikely to have control over key security controls such as alarm or keying systems.
Unless your organisation has full control over the space, you should treat the facilities as zone 1 security areas for information and asset storage.
Storing protectively-marked information
Protectively-marked information must not be stored outside your offices unless you have implemented:
You should not allow TOP SECRET information to be stored outside your premises unless it is critical for an operation. The New Zealand Security Intelligence Service must certify all storage of TOP SECRET information.
Transferring information away from the office
It is unrealistic to expect people to maintain physical custody of information at all times if it can’t be carried on their person.
However, you should restrict the use of removable ICT media, such as USB sticks and portable hard drives, for carrying large quantities of information, as they are easily lost.
Information is at considerable risk when it is being transported. Consider all alternatives before you allow your people to transport information to remote locations.
Some alternatives to consider are:
- giving people remote secure access to your ICT networks (if a connection can be arranged)
- transporting the information to nearby New Zealand Government or jurisdictional facilities using endorsed couriers or secure networks
- storing the information on a portable device approved by the Government Communication Security Bureau — a device that provides additional logical controls to prevent unauthorised access.
When you can’t arrange alternative transport, consider arranging for information to be secured in suitable New Zealand Government or New Zealand Government-approved facilities during breaks in trips.
For more information, go to:
Disposing of official information securely
Your organisation should have procedures in place for the secure disposing of official information for all working away from the office scenarios.
You must ensure all protectively-marked information is returned to your premises for destruction unless you have approved destruction equipment located off-site.
For more information, refer to:
Protecting assets
GOV052
Follow this guidance to protect your organisation’s assets when they’re away from the office.
Add to your asset management register
Include assets used by people working away from the office in your asset management register, even when the value of the assets is below the threshold you normally apply to control assets.
Permit removal only when necessary
Only allow your people to remove assets from your facilities if they are necessary for performing their out-of-the-office duties.
Assign custody
Assign custody of each asset to an individual before you allow the asset to be removed from your premises. And consider requiring people to sign for equipment before taking it.
Brief your people and implement security measures
Advise your people of their responsibilities for safeguarding any assets entrusted to them. Ensure they know about your security measures and how to uphold them.
Make sure your people know and follow your incident reporting procedures for assets that are lost or damaged. Treat as compromised any information contained in misplaced, lost, or stolen physical assets.
Protecting assets in vehicles
Tell your people not to leave assets in vehicles unless it is unavoidable or physical security measures are in place to protect the vehicle and its contents.
Protecting assets in hotels
Remind your people that assets left in hotel rooms or hotel safes will be at risk, particularly when travelling overseas. Ensure you evaluate and treat the risks before your people depart to stay at a hotel.
Protecting assets in planes
When travelling, assets in carry-on luggage are more secure than checked-in baggage, providing the carry-on luggage remains in the employee's control.
For more information, go to Physical security zones.
Protecting assets in private facilities
You may not be able to control the security of assets located in client premises, even when given a dedicated work space. In that case, evaluate the risks to your assets in a similar way to any other unsecure off-site work environment.
If you have assets that are used to regulate the client's activities, those assets may need extra protection. For example, when you need to protect assets from tampering or other actions that would compromise your regulation activities.
Arrangements for working remotely from home
GOV053
Working remotely from home is subject to an agreement between management and the employee.
Note that if your people work from locations that haven’t been approved or had a risk assessment, you must treat their arrangements as mobile working.
Assess the home office or work site
An agreement for working remotely normally requires you to assess the home office or work site. You should assess compliance with any occupational health and safety, and human resource requirements that apply to your organisation through a self-assessment process.
Include the right information in an agreement
In an agreement, you must include at least the following:
- conditions of employment
- occupational health and safety requirements
- security requirements.
The agreement should cover technology and equipment; safety and security; and communication and availability.
Technology and equipment
Identify which technology is appropriate for accessing information from the remote location.
- Work out what equipment your organisation will provide, what equipment the remote worker will provide, and what will be shared (including any specific controls relating to use of personal equipment).
- If you provide equipment, include a schedule of equipment.
- Detail how you will provide technical assistance in the event of equipment failure or disruption.
Safety and security
- Find out if the physical attributes of the remote workplace conform to safety and security standards.
- Ensure remote workers have your emergency procedures.
- Include your procedures for disposing of official information securely (if relevant).
Communication and availability
- State your expectations for communication and availability. For example, that remote workers must be contactable by phone or email during a set time.
- Identify which processes you will use if you need to change the agreement.
For advice on employment agreements, go to Employment New Zealand’s site: Employment agreements
