Information Management Strategy.pdf - Lincolnshire Police

NOT PROTECTIVELY MARKEDi) Information Technology Security officer (ITSO)j) Communication Security Officer (CoMSO)This list is not exhaustive and can be added to as the need arises.6.1.8 The Force Risk Register will be utilised to ensure that risks identified in the evolving planssupporting the delivery of the strategy are addressed. Any information risk identified onthe Risk Register will be reviewed at each meeting of the IMB.6.1.9The IMB will ensure ongoing compliance with the ACPO/ACPOS (2006) CommunitySecurity Policy (CSP).6.1.10The IMB will act as the forum for Information Security issues raised at the Force SecurityBoard and which require raising to a higher level.6.2 Executive6.2.1 The Chief Officer has ultimate ownership of the force IAS.6.2.2 As force Data Controller, the Chief Officer, in line with the Data Protection Act 1998(DPA), has the duty of a data controller to comply with the data protection principles inrelation to all personal data with respect to which s/he is the data controller, including thefollowing:i) Determines why, as well as how, personal data including sensitive personal data,is to be processed and what security measures will be appropriate;ii) Has a duty to ensure that the collection and processing of any personal datawithin the force complies with the data protection principles;iii) Retains full responsibility for the actions of the data processor;iv) Notifies all processing operations that involve personal data to the InformationCommissioner and keeps this notification up-to-date.6.2.3 The role of data controller is a primary legislative function. The controls for meeting theforce‟s legal obligations for personal data management can be delegated as appropriate,NOT PROTECTIVELY MARKED 35