scope:

This manual describes the framework for governance management and of security requirements for information and information systems. This manual provides the baseline security principals to support the level 1 Information Security Policy.

This applies to all authorised Users of all Network Rail networks, IT systems, data and telecommunication equipment.

It covers the management of all accounts which are administered by Network Rail and by third parties on behalf of Network Rail

Purpose

The purpose of this manual is to:

a) support the consistent identification, understanding and assessment of information security risks;

b) provide up to date information against government guidelines, legislation, information security industry best practise and relevant ISO standards; and

c) provide guidance to those impacted to help them make the changes necessary to people, process and technology.

Through consistent identification, understanding and assessment of information security risks, Network Rail is able to apply appropriate controls in order to manage information security risk at the appropriate level for the company