scope:

This standard covers the security classification of all Network Rail Information including:

• Information owned and processed by Network Rail

• Information processed by a 3^rd party on behalf of Network Rail

• Information processed by Network Rail on behalf of a 3^rd party

Purpose

Network Rail processes information that is sensitive because if disclosed could impact Network Rail's commercial interests, community relationships or the welfare of individuals.

This standard provides a framework to protect sensitive information from unauthorised disclosure through the introduction of Information Security Classifications and the formal ownership of information within Network Rail. A Classification scheme and associated Controls Framework allows appropriate controls to be applied to information according to the classification. Data Communities provide a structure of clear ownership and the responsibility to classify the information and govern the correct application of controls.