13.9 Information security

The organisation shall protect the confidentiality, integrity and availability of land referencing information.

Controls shall address:

user identity and access;

least-privilege permissions;

secure storage and transfer;

encryption where appropriate;

backup and recovery;

protection of portable and paper records;

supplier and system access;

logging and monitoring;

incident response;

secure disposal; and

continuity of access to authoritative records.

The control set should be aligned with an established information-security framework appropriate to the organisation and risk.