IT Security Procedure Manual - Purpose and Compliance

Nov 4, 2026

IT Security Procedure Manual sets out practical procedures for all University of Huddersfield staff and affiliates to implement the IT Security Policy. It defines scope across IT systems, hardware, services, facilities, and cloud or network environments, including personally owned devices used for University activities. The manual explains why information classification and Data Protection requirements matter, and details compliance expectations. It introduces information confidentiality levels—Sensitive, Confidential, and General—then covers access to personal data and foundational Personal Computer Security controls such as password practices.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages35

Reading Time1 h 28 min

AccessFree to download

Purpose and Context

Scope

Compliance

Data Confidentiality Levels

Introduction

Access to personal data

Personal Computer Security

Passwords

Good passwords

Bad passwords

IT Security Procedure Manual Purpose and Context The IT Security Procedure Manual is designed to be used in conjunction with the University of Huddersfield IT Security Policy. The procedures in this document apply to all University staff and affiliates and are not intended for students. It gives practical advice to members of the University and describes procedures that must be followed in order to implement the provisions of the IT Security Policy, the purpose of which is to reduce the opportunity for information security and cyber security breaches to occur as well as limit the impact of these on the University should they do so This document will be updated regularly in light of the ever-evolving security threats we face and as the University’s technological environment changes. Terms defined in this Procedure will have the same meaning as those used in the IT Security Policy. Scope These procedures apply to all IT-related systems, hardware, services, facilities and processes owned or otherwise made available by the University of Huddersfield or on its behalf, whether utilising the University’s network and servers or those provided through cloud-based environments. These procedures include , for the avoidance of doubt any personally owned devices that are used in connection with University activities (together, IT Systems) . 1. Compliance All staff members of the University, affiliates and third parties will comply with this IT Security Procedure. 2. Data Confidentiality Levels 2.1. Introduction The security procedures that are appropriately applied to a given set of information will depend on the characteristics of that information and the impact to the University should that information be inadvertently disclosed, changed, or destroyed without proper authorisation. It is important, therefore, to have an easy-to-understand information classification scheme that indicates the level of protection that must be applied. Information classification | | Access | Examples | | --- | --- | --- | | Sensitive | To be accessed by a strictly controlled group of users, with the data owner’s consent, and with the highest security levels applied. Not to be passed on without consent. Subject to the Data Protection Act. | •Aligns to the GDPR’s definition of special category data
• Sensitive personal data (i.e. information about a person’s racial or ethnic origin, political opinions, religious beliefs, health, criminal record and trade union membership)
• HR record
• Business critical information such as financial or contractual details.
• Research data concerning topics such as terrorism or radicalisation. | | | Access | Examples | | --- | --- | --- | | Confidential | To be kept secure and accessed only for business need. To be passed to third parties only as required for the fulfilment of the University’s contract with the individual, except with permission. Subject to the Data Protection Act. | •Aligns to GDPR’s definition of personal data
•A person’s address, phone number, student record, results, general financial information. Information which is covered by ethical guidelines, or by research-related subject consent. | | | Access | Examples | | --- | --- | --- | | General | Not restricted | • Non-confidential business information about the University, it’s people , partners and affiliates.
• Non-confidential information relating to the University's research projects. | 2.2.Access to personal data It is important that those who, as part of their system management or troubleshooting roles, have access to personal data understand the implications of the Data Protection Act and how it affects them. For further information on Data Protection atthe University see: [https://www.hud.ac.uk/informationgovernance/dataprotection/](https://www.hud.ac.uk/informationgovernance/dataprotection/) Where a role requires access to specific business systems that contain sensitive personal or financi

FAQs

Who is this IT Security Procedure Manual intended for?

The procedures apply to all University staff and affiliates and are not intended for students.

What is the purpose of the procedures described in the manual?

The procedures provide practical guidance to implement the IT Security Policy, reducing opportunities for information security and cyber security breaches and limiting their impact.

What are the password requirements for secure access?

Passwords must follow the guidance in the manual, including using strong passphrases and meeting minimum complexity requirements such as length and a mix of uppercase and lowercase letters.

Nov 4, 2026

Uploaded by PakDamar76