| If you have information that you want included in the registry, or you want
your name added to the resource list, contact the registry moderator
by sending mail to forty2::billington.
You cannot volunteer anyone else's name for the resource list, though you can,
of course, try to persuade them to volunteer themselves!
|
| Information Protection | No. 10.0
Information Protection Policy | Effective: 02-JAN-1991
| Page 1 of 3
-------------------------------------------------------------------------------
Summary
Information is one of Digital's important business resources, along with
people, materials and components, and financial assets. Information is
expensive and critical to Digital's success in the highly competitive
computer industry.
This Digital information security policy has two purposes:
1. To protect Digital's information from unauthorized disclosure,
destruction or modification; and,
2. To establish Digital's legal rights to its information, should it
be necessary to defend those rights in a court of law.
Scope
This policy applies to all employees of Digital Equipment Corporation
worldwide, unless in conflict with law, in which case the appropriate
Digital manager must devise effective lawful processes to establish
equivalent protection.
Requirements
Information protection applies to all information forms: mental, electronic
(machine-readable), and written (human-readable). The effort expended on
protection will be appropriate to the information's value and sensitivity.
1. Information risk/value/sensitivity is determined through the Digital
information classification process. The Digital information
classifications are:
DIGITAL RESTRICTED DISTRIBUTION
DIGITAL PERSONAL
Greatest Risk / Value / Sensitivity
DIGITAL CONFIDENTIAL
Moderate Risk / Value / Sensitivity
DIGITAL INTERNAL USE ONLY
Routine Risk / Value / Sensitivity
Corporate Security Standard 10.1 establishes definitions, rules and
procedures for information classification and resulting protection
measures.
<REF: Information Protection ! 10.1 >
FOR DIGITAL INTERNAL USE ONLY
Information Protection | No. 10.0
Information Protection Policy | Effective: 02-JAN-1991
| Page 2 of 3
-------------------------------------------------------------------------------
Requirements Cont'd
2. Proper information classification is the responsibility of all
Digital employees who are information originators and/or information
custodians. When routine business information has little risk
associated with possible unauthorized disclosure, no assignment of a
Digital classification is required. However, all business information
used in the course of Digital operations is considered private to
Digital and there is no blanket approval for outside release of
unclassified information in any case.
3. Information protection is the responsibility of all Digital employees.
All Digital information assigned a Digital information classification
will be provided protection as specified in the Corporate or Business/
Geography Information Security Standards.
4. Protection requirements established in the Digital Security Standard
10.1 apply also to information entrusted to Digital by others, unless
Digital is contractually obligated to follow other protection methods,
or if government regulations apply.
Exception to Policy
Digital Security Standard 10.1 establishes a process by which appropriate
Digital managers may authorize alternative protection methods when business
requirements justify an acceptance of risk.
Supporting Responsibilities
Corporate Security, through the area, geography, and business security
functions, coordinates, issues, and maintains security policies, and
monitors program effectiveness.
The Digital Security Council represents the Digital businesses/geographies/
staffs in identifying security requirements, and in proposing, approving,
and implementing security policies.
The Digital Information Security Strategy Committee establishes information
security program strategy, identifies information security issues and
solutions, and commits to the worldwide implementation thereof.
Digital managers will ensure that all employees are aware of, and comply
with, Digital information security requirements as specified in Corporate
Security Standards and business/geography Security Standards.
Corporate Audit will monitor compliance with Security Standards.
Purchasing will ensure that contractors and suppliers are aware of Digital
information protection requirements applicable to business relationships.
FOR DIGITAL INTERNAL USE ONLY
Information Protection | No. 10.0
Information Protection Policy | Effective: 02-JAN-1991
| Page 3 of 3
-------------------------------------------------------------------------------
References
Digital Corporate Security Standard 10.1, "Protection of Digital
Information" (see other references therein)
FOR DIGITAL INTERNAL USE ONLY
|