Authorization of access to information
Access to information is authorized as follows;
- Access to information is controlled based on business and security requirements and access control rules defined for each information system.
- All Sm8rtHealth vendors will be permitted to access only those critical business information assets and processes which are required for performing their duties.
- Access to critical business information assets and activation of accounts for contractors, consultants, temporary workers, or vendor personnel will only be granted when the individual is actively performing service for Sm8rtHealth (as employee or contractor).
- Access for contractors, consultants or vendor personnel to Sm8rtHealth critical business information assets are subject signing the Sm8rtHealth Confidentiality Agreement (NDA).
Mobile computing and remote access
- All mobile computing facilities (e.g. laptop computers, palmtop computers, notebooks, mobile phones) will be used in a secured environment, using cryptographic controls for communication purposes.
- All mobile computing facilities (e.g. laptop computers, palm top computers, notebooks, mobile phones) will have boot or access password or pattern.
- All personnel using remote access will be provided with a secure connection (e.g. Secure Socket Layer, IPSec, Virtual Private Network, encryption) to information system networks.
- The maintenance and support, audit, monitoring, training on security controls and practices, management of access rights, and physical security for remote access, will be in accordance with the defined procedures.
Share folders (Dropbox)
- Access to shared folders will be authorised for specific persons only.
- Shared Folders will be used for work purpose only.
- Use of an approved document repository for remote and limited access to shared folders and files.
