HomeMy WebLinkAboutP 074 IT - Information Technology Security •
EC7 -,- -
OTTAWA-CARLETON
DISTRICT SCHOOL BOARD
POLICY P 074 IT
TITLE: INFORMATION TECHNOLOGY SECURITY
Date Authorized: 27 January 1999
Last Revised: 25 February 2020
Last Reviewed: 12 February 2026
COMMITMENT TO INDIGENOUS RIGHTS, HUMAN RIGHTS, AND EQUITY
The Board recognizes its responsibility to ensure that OCDSB policies and procedures promote and
protect Indigenous, equity, and human rights and to seek to address and eliminate racism and
structural and systemic barriers for students, staff, and community.
1.0 RATIONALE
To ensure the safety, security, accessibility, confidentiality, integrity, and business continuity of
information technology systems to protect the information created, owned, processed, or
transmitted electronically by the Ottawa-Carleton District School Board.
2.0 DEFINITIONS
Please refer to Appendix A for a full list of definitions used in this policy.
3.0 GUIDING PRINCIPLES
3.1 The Board believes that:
a) a strong, reliable, and secure information technology infrastructure is essential to
ensuring an effective working and learning environment;
b) a secure infrastructure includes effective long-term contingency and incident
management planning to prevent, manage and quickly recover from a security
threat or any incident and reduce risk to the organization;
c) where data is shared with third parties, they must maintain the confidentiality,
integrity and security standards of the District;
d) systems and data will be secured by assigned and appropriate access to assure
the confidentiality, integrity and security of assets; and
e) a governance structure, as well as appropriate life-cycle asset management and
investment, are critical to promote risk management and the long-term security of
-1- P 074 IT
the board's information technology systems.
3.2 Physical and digital assets are corporate assets and are considered property of the
OCDSB.
4.0 SPECIFIC DIRECTIVES
4.1 All users of the District network, including staff, trustees, parents, students, vendors,
consultants, and partners, with OCDSB-owned and personal assets under their control,
shall:
a) safeguard the confidentiality, integrity and availability of District physical and
digital assets, preserving the privacy of electronically maintained personal
information in the custody or control of the District, whether stored on premises
or external to the District;
b) make ethical choices that abide by the parameters of the Appropriate Use of
Technology Procedure when utilizing assets;
c) identify and report all suspected or confirmed security incidents in accordance
with procedures for reporting information technology or information security
incidents or risks; and
d) monitor and enforce compliance with this policy within the scope of their duties
and responsibilities.
4.2 The District shall make every reasonable effort to protect and secure digital and
physical assets from threat, abuse and/or misuse, including through human error,
hardware malfunction, natural disaster, security breach, and/or malicious attack.
Security Safeguards
4.3 The District shall ensure the security of all information technology through classification
of data, control, and technical measures to ensure its use is in accordance with Board
policy.
4.4 The District shall have a formalized incident management, monitoring, compliance and
business continuity response plan in place, aligned with Emergency Response
Protocols.
Implementation
4.5 The Director of Education is authorized to issue procedures to ensure Information
Technology security is integrated with all aspects of the operations of the District.
5.0 APPENDICES
Appendix A: Policy Definitions
6.0 REFERENCE DOCUMENTS
The Education Act, 1998, ss. 170, 171
OCDSB Policy P 027 GOV - Management of Official Business Records
-2- P 074 IT
OCDSB Policy P 100 IT - Appropriate Use of Technology
OCDSB Policy P 128 GOV - Access to Information and Privacy Protection
OCDSB Procedure PR 516 GOV - Management of Official Business
OCDSB Procedure PR 564 IT - Information Technology Security
OCDSB Procedure PR 622 IT - Appropriate Use of Information Technology (Students)
OCDSB Procedure PR 669 GOV - Privacy Breach
OCDSB Procedure PR 685 IT - District-issued Mobile Devices
OCDSB Procedure PR 702 IT - Appropriate Use of Information Technology (Staff)
NIST Cyber Security Framework 2.0
ISO/IEC 27001, 2013
CIS Controls
-3- P 074 IT
APPENDIX A: POLICY DEFINITIONS
In this policy,
Access means direct or indirect use, attempt to use, instruct, communicate with, cause input to,
cause output from, or otherwise make use of any resources of a computer or other electronic device,
computer system, facility or network.
Authorization means having the express or implied consent or permission of the owner, or of the
person authorized by the owner to give consent or permission to access a computer, computer
system, or computer network in a manner consistent with the authorized consent or permission.
Availability means that systems, applications and data are available to users when they need them.
Board means the Board of Trustees.
Computer refers to any electronic device or communication device that stores, retrieves, processes,
or transmits data.
Computer network means the interconnection of computers, electronic devices, software, or other
equipment.
Computer property includes electronic impulses, electronically produced data, information, financial
instruments, software, or programs, in either machine or human readable form, any other tangible or
intangible item relating to a computer, computer system, computer network, and copies of any of
them.
Computer system refers to a set of related, connected or unconnected, devices, software, or other
related computer equipment.
Confidential means data, text, or computer property that is protected by a security system that
clearly evidences that the owner or custodian intends that it not be available to others without the
owner's or custodian's permission.
Digital assets refers to any form of information received, created or gathered on behalf of the
OCDSB in the course of District business.
District means the Ottawa-Carleton District School Board.
Encryption or encrypted data refers to the most effective way to achieve data security. To read an
encrypted file, you must have access to a secret key or password that enables you to decrypt it.
Information means all information holdings that are stored, transmitted, or processed electronically in
the course of District business.
Information Technology refers to a computer, device, or network on which there is a significant
operational dependency for the District, and/or which stores, transmits, or provides access to
sensitive information. This can refer to computers functioning as servers, and storage devices such
as USB keys and portable hard drives, personal computers, printers, and photocopiers which have
internal storage capability that could contain sensitive information.
-4- P 074 IT
Infrastructure refers to the set of information technology components that are the foundation of
information technology services; typically physical components, but also various software and
network components.
Integrity of information means safeguarding information from unauthorized alteration or destruction.
Physical Assets refers to the information technology infrastructure, such as computers, devices,
software applications, network equipment and peripherals, encryption devices, etc. used in the
processing, storage, and transmittal of information.
Privacy refers to the quality or condition of being secluded by the presence or view of others. The
state of being free from unsanctioned intrusion: a person's right to privacy.
Security Threats refers to any possible danger that might exploit a vulnerability to breach security
safeguards and therefore cause possible harm to the District's information and/or physical assets.
Security system refers to access control technologies such as encryption, password protection, and
other forced authentication or access controls designed to keep out unauthorized persons.
Sensitive information refers to an electronic set of information or data, such as a database, file or
document, that is classified as personal or confidential, whether it is stored on or off premises.
Third Party refers to external vendors or contractors which provide supporting services to the District.
-5- P 074 IT