MASS UK Industry Conduct Principles and Code of Practice 2022 (V6)

6.1.4 Information about product safety will be shared with customers and within the Industry and it will try to learn from
anything about the performance and use of products that can be used to improve safety.
6.1.5 Everyone within the industry should be aware of the product safety implications of their role and ensure that operations
are in full compliance both with the law and with each company’s safety policies and processes. Any concerns
regarding the safety of a product, or the application of policies and processes, should be raised immediately.
Assuranc
INDUSTRY PRINCIPLE 4 – CUSTOMER INFORMATION
Users of this Code will handle customer protectively marked and commercially sensitive information
confidentially and, as a minimum, in accordance with appropriate regulations, policies and processes.
6.1.6 The MASS industry will ensure that it employs Suitably Qualified and Experienced Personnel (SQEP) in the
design and construction of its systems. It will source good quality, traceable, consistent materials and components
and use appropriate design, build and test standards where applicable to ensure quality, safe and predictable
products are delivered to customers.
6.2 CYBER SAFETY AND SECURITY
8
Assurance Certification
and Authorisation for use
6.2.1 All aspects of Cyber Safety and Security should be embedded in the initial design of all software and hardware
in MASS. The integration of these systems needs to be considered throughout the design process. Consequent
updates and patches could have unforeseen, undesirable adverse effects on the functions and security integrity
of the whole system.
INDUSTRY PRINCIPLE 3 – PRODUCT SAFETY DESIGN AND CONSTRUCTION
Users of this Code will work with each customer to agree the level of safety required for a specific
operational situation of each product through its life. They will suggest designs or modifications to
mitigate, where possible, any identified or perceived risks.
8.1 PROCEDURES
8.1.1 The MASS industry recognises the critical importance of Assurance, Certification and Authorisation for the use
of all MASS, including Cyber Security. It will incorporate existing standards, where appropriate, Industry wide: a
common agreed Risk Assessment Based Assurance Framework; an agreed Certification process using a Testing
and Evaluation Roadmap; and an appropriate process to issue a Certified Clearance for Use for MASS.
8.1.2 Manufacturers and operators that hold correct ISO9001:2015 certification will have rigorous quality systems in
place that ensure high and consistent design, test, build and operational standards. ISO 27001 gives details of the
International Standard that lays out the specifications for implementing an information security management system.
8.1.3 The industry recognises that achieving international standardisation will take time. However, it will participate fully
in its development and will ensure that it adopts its own best practice complementary to achieving the end state.
7
Customer Information
INDUSTRY PRINCIPLE 5 – ASSURANCE AND AUTHORISATION
Users of this Code are fully committed to developing and applying agreed Assurance, Certification
and Clearance for Use processes to enable demonstrable confidence in its products and systems and
compliance with existing regulations
7.1 PROTECTIVE MARKING
7.1.1 Improper or unauthorised handling of protectively marked and commercially sensitive information may damage
the national security of the countries in which business is done. It also damages the Industry and may harm the
operational and financial performance of companies within the industry.
7.1.2 The MASS industry has responsibility to:
9
Trade Restrictions and Export Controls
n Handle Classified and/or Protectively marked information in accordance with all applicable laws and local procedures.
n Refrain from discussing or working with classified information in a public area where the conversation may
be overheard, or information compromised.
n Not discuss classified information with anyone unless it is confirmed that they have a need to know and the
appropriate clearance.
9.1 RESTRICTIONS
9.1.1 The MASS industry will be involved with International, cross-border business and as such must be familiar with
the appropriate national policies and procedures for handling goods, technology and data or providing services
which may come into or go outside of a country.
12
MASS UK Industry Conduct Principles and Code of Practice Version 6 MASS UK Industry Conduct Principles and Code of Practice Version 6 13