This article contains guidance on the security of paper documents, including information about physical security, posting and destroying classified documents
Policy Requirement
31. “Classified papers must be locked away when not in use with keys held securely.”
31.1 All offices are to be locked when unattended. Because the University and its buildings are accessible by members of the public there is an increased risk of opportunistic compromise of classified information left on desks, or the theft of documents as well as portable IT equipment.
31.2 It is essential that classified documents are locked away overnight and at weekends.
31.3 It is important that keys to both offices and document storage facilities are managed securely so that they remain unavailable to unauthorised persons, but are accessible by anyone who is authorised to access the documents.
Policy Requirement
32. “Highly Confidential paper documents can only be taken outside the University with the appropriate controls in place.”
32.1 Highly Confidential documents may only be removed from the University when it is necessary in order to fulfil the operational requirements of the University.
32.2 If you are in a role where this is a requirement make sure that your line manager is aware of the requirement and is happy with the controls you will be implementing to keep the information secure.
32.3 Only take Highly Confidential documents outside the University for the shortest time possible, keeping them secure.
32.4 Highly Confidential documents must not be left on display in parked unattended cars and extra vigilance needs to be applied when taking them on public transport to prevent their contents from being read by unauthorised persons and to avoid their loss or theft.
32.5 Highly Confidential information obtained outside the University (e.g. through the collection of research data), must be kept securely, and brought into or posted to the University at the earliest opportunity.
Policy Requirement
33. “When posting classified documents envelopes must not display security markings which indicate the sensitivity of the contents.”
33.1 Confidential information may be single enveloped but should be addressed to a specific recipient ‘addressee only’ or ‘personal for’ if this is considered necessary.
33.2 When posting Highly Confidential documents double envelope them. The internal envelope should contain the name and address of the recipient and should be privacy marked if no-one else other than the recipient should see the contents. This envelope should also be marked Highly Confidential on the top and bottom of the envelope and on the front and back. The outer envelope should simply contain the name and address of the recipient and give no indication as to the nature of the contents.
33.3 Confidential documents can be posted either first or second class using Royal Mail postal services. Highly Confidential documents should only be posted via Royal Mail first class or through courier services.
Policy Requirement
34. “Classified documents must be securely disposed of as soon as they are no longer required.”
If you do not have access to a shredder or you have a large quantity of classified documents to dispose of you will need to use the Estates Cleaning Services classified waste disposal system. Classified waste should be put into special classified waste disposal bags (available through Estates Cleaning Services) and held securely until they are collected by Estates Cleaning Services staff for secure disposal. Arrangements for the collection of classified waste are to be made directly with Estates Cleaning Services.