scope:

This standard applies to all people that are responsible for creating, processing, handling, storing and destroying data and information for and on behalf of Network Rail.

Purpose

This standard sets out how users apply information security classifications to all of Network Rail data and information, and covers the marking and protection of artefacts, including those held in IT systems, and the security controls that are to be followed and provides a process to comply with NR/L2/INF/02223.

The classification of Network Rail data and information, and its associated handling instructions and security controls, help to mitigate the risk of failing to protect the organisation from incidents which might lead to the loss of confidentiality, integrity or availability of data and information.