Part V — Data, Technology and the Portal
Chapter 25 — Cybersecurity Requirements
Chapter 25
Cybersecurity Requirements
The security of the WISE system depends on the security of every
School that participates in it. This chapter sets out the
minimum cybersecurity standards an Affiliated School must
maintain, the alignment with ISO/IEC 27001, the specific
requirements for encryption, access control, and incident
response, and the obligations that arise where a security
incident occurs.
25.1 General Principle
25.1.1
A School must implement and maintain technical and
organisational measures appropriate to the risk to the
personal data and confidential information it processes in
the course of its participation in the WISE system.
25.1.2
The measures required by this chapter are the minimum. A
School whose operations, data volumes, or risk profile
warrant more stringent measures must implement them.
25.1.3
A School must designate a person as responsible for
cybersecurity. This may be the same person as the Data
Protection Officer, the person responsible for the Portal,
or the senior administrative officer, provided the person has
the competence and the authority to discharge the role.
25.2 Framework Alignment
25.2.1
The information security management requirements of this
chapter are aligned to ISO/IEC 27001, the international
standard for information security management systems.
Compliance with this chapter does not of itself constitute
certification to ISO/IEC 27001; certification is a separate
matter.
25.2.2
A School that holds a current ISO/IEC 27001 certification,
issued by an accredited certification body, is treated as
satisfying Sections 25.4 through 25.9 of this chapter,
subject to the School demonstrating that the scope of the
certification covers the systems and processes used for the
WISE programme.
25.2.3
WEQSC may recognise other information security frameworks
— including ISO/IEC 27002, the NIST Cybersecurity Framework,
and equivalent national standards — as satisfying the
requirements of this chapter, where the framework provides
an equivalent or higher level of assurance. Recognition is
granted by WEQSC on application by the School.
25.3 Risk Assessment
25.3.1
The School must conduct, at least annually, a risk assessment
in respect of the information systems and data used for the
WISE programme.
25.3.2
The risk assessment must identify:
- The information assets concerned, including personal data, confidential information, and credentials;
- The threats to those assets, including external attack, insider misuse, accidental loss, and natural disaster;
- The vulnerabilities through which threats might be realised;
- The likelihood and potential impact of each identified risk; and
- The measures in place to mitigate each risk.
25.3.3
The risk assessment must be documented, reviewed by the
Senior Officer, and retained for the duration of the
affiliation and for five years thereafter.
25.3.4
Where the risk assessment identifies a residual risk that
the School cannot adequately mitigate with its own
resources, the School must notify WEQSC and propose a remedy,
including, where appropriate, a request for support under
Chapter 19.
25.4 Access Control
25.4.1
Access to systems containing personal data or confidential
information must be controlled by individual authentication.
Shared credentials are prohibited.
25.4.2
Passwords must:
- Be not less than twelve characters in length;
- Contain at least three of the four character classes: lowercase letters, uppercase letters, digits, and symbols;
- Not be a dictionary word, a name, a date of birth, or any other easily guessable value;
- Not be reused across systems; and
- Be changed at least every ninety days, or immediately on any suspicion of compromise.
25.4.3
Two-factor authentication is mandatory for all accounts with
write access to the Portal. The second factor must be a
time-based one-time passcode generated by an authenticator
application, a hardware token, or a similarly secure method.
SMS-based verification is permitted only where no other
method is available to the user.
25.4.4
Access rights must be granted on the principle of least
privilege. A user must have access only to the data and
functions necessary for the discharge of their role.
25.4.5
Access rights must be reviewed at least once every six months,
and immediately upon any change of role, to confirm that
each user's access remains appropriate to the user's current
responsibilities.
25.4.6
The School must maintain a register of all persons with
access to systems containing personal data, showing the
role assigned, the date access was granted, and the date
of the most recent review. The register is produced at
audit.
25.5 Encryption
25.5.1
Personal data and confidential information must be encrypted
in transit and at rest.
25.5.2
Encryption in transit must use TLS 1.2 or higher, with a
cipher suite that is currently considered secure. Older
protocol versions — including SSL, TLS 1.0, and TLS 1.1
— are prohibited.
25.5.3
Encryption at rest must use AES-256 or an equivalent
algorithm. Encryption keys must be stored separately from
the data they protect, and must be rotated at least
annually.
25.5.4
Offline backups must be encrypted with the same standard as
live data. Unencrypted backups are prohibited.
25.5.5
Portable devices — laptops, tablets, smartphones, USB
drives — used to store or access personal data must be
encrypted in full, and must be protected by a strong
passcode or biometric authentication.
25.5.6
Where encryption is not feasible for a specific system or
dataset — for example, where a legacy system cannot support
it — the School must notify WEQSC, explain the reason, and
implement compensating controls. WEQSC determines whether
the compensating controls are adequate.
25.6 Network and Endpoint Security
25.6.1
School networks used for the WISE programme must be
protected by a firewall, configured to deny traffic by
default and to permit only necessary services.
25.6.2
All devices that access the Portal or that hold personal
data must run a current operating system with security
patches applied. Patches designated as critical by the
vendor must be applied within thirty days of release.
25.6.3
All such devices must run current anti-malware protection,
updated automatically, and must perform a full scan at least
once per month.
25.6.4
Wireless networks used to transmit personal data must use
WPA3 or WPA2-Enterprise encryption. Open networks and
networks using WEP or WPA are prohibited for such
transmissions.
25.6.5
Remote access to School systems or to the Portal must be
through an encrypted channel. Direct exposure of internal
systems to the public internet is prohibited.
25.7 Data Backup and Recovery
25.7.1
In addition to the retention obligations in Chapter 21, the
School must maintain backup copies of its systems and data
sufficient to permit recovery from a security incident, a
hardware failure, or a natural disaster.
25.7.2
Backups must be taken at least weekly. Critical data —
student records, examination data, and fee records — must
be backed up at least daily.
25.7.3
Backup restoration must be tested at least once per Academic
Session. The test must demonstrate that a backup can be
restored within twenty-four hours and that the restored data
is complete and unaltered.
25.7.4
At least one backup copy must be held offline or in an
immutable form, so as to be protected against ransomware
and similar attacks.
25.8 Incident Response
25.8.1
The School must maintain a written incident response plan,
setting out the steps to be taken in the event of a
security incident.
25.8.2
A security incident includes:
- Unauthorised access to or disclosure of personal data;
- Loss or theft of a device containing personal data;
- Ransomware or other malware affecting the School's systems;
- Denial of service or other disruption of the School's ability to access the Portal;
- Compromise of a user account with access to personal data; and
- Any other event that may affect the confidentiality, integrity, or availability of personal data.
25.8.3
Where the School becomes aware of a security incident, it
must:
- Take immediate steps to contain the incident and prevent further harm;
- Preserve evidence of the incident, including logs and copies of affected systems, in accordance with legal requirements and any instruction from WEQSC;
- Notify WEQSC within twenty-four hours, or immediately where the incident involves personal data of students;
- Where the incident involves personal data, assess whether the incident constitutes a data breach requiring notification under Section 25.9;
- Cooperate with any investigation conducted by WEQSC or by a competent authority; and
- Take steps to prevent recurrence.
25.8.4
Where the incident requires the intervention of a specialist
third party — for example, a forensic investigator or a
cybersecurity consultancy — the School must engage one, or
must request assistance from WEQSC, without delay.
25.8.5
The School must produce a written post-incident report within
thirty days of the incident being resolved. The report must
describe the incident, its cause, the steps taken to contain
and remediate it, and the steps taken to prevent recurrence.
25.9 Data Breach Notification
25.9.1
A data breach is a security incident that results in the
accidental or unlawful destruction, loss, alteration,
unauthorised disclosure of, or access to, personal data.
25.9.2
Where a data breach occurs and is likely to result in a risk
to the rights and freedoms of the data subjects affected, the
School must:
- Notify WEQSC within twenty-four hours of becoming aware of the breach;
- Notify the competent data protection authority in its jurisdiction without undue delay, and in any event within seventy-two hours of becoming aware of the breach, where required by applicable law;
- Notify the affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms; and
- Record the breach in the register maintained under Section 25.9.5.
25.9.3
The notification under Section 25.9.2 must describe:
- The nature of the breach;
- The categories and approximate number of data subjects concerned;
- The categories and approximate number of records concerned;
- The name and contact details of the DPO or of the person who may be contacted for further information;
- The likely consequences of the breach; and
- The measures taken or proposed to address the breach and to mitigate its adverse effects.
25.9.4
Where the breach involves data held by WEQSC, WEQSC is
responsible for notifying the competent authority in
Switzerland and for notifying the data subjects where
required. The School remains responsible for any
notification required under the law of its own
jurisdiction.
25.9.5
The School must maintain a register of data breaches,
recording every breach, its cause, its effects, and the
remedial action taken. The register is retained for the
duration of the affiliation and for five years thereafter,
and is produced at audit.
25.9.6
Failure to notify WEQSC of a data breach within twenty-four
hours, or to record the breach in the register, is a
Critical Finding.
25.10 Personnel Security
25.10.1
Staff with access to personal data must receive training in
data protection and information security, ordinarily within
thirty days of appointment and annually thereafter.
25.10.2
Where the law of the jurisdiction permits and the School
considers it appropriate, staff with access to personal data
of students must be subject to a background check before
appointment.
25.10.3
Staff must be made aware of their obligations under this
Framework and must acknowledge in writing their
understanding of those obligations.
25.11 Supplier and Third-Party Security
25.11.1
Where the School engages a third party to process personal
data on its behalf — for example, a cloud service provider,
a payroll bureau, or an IT support contractor — the
engagement must be governed by a written agreement that
imposes on the third party obligations equivalent to those
in this chapter.
25.11.2
The School must satisfy itself, before engaging a third
party and at least annually thereafter, that the third party
maintains security standards equivalent to those required
by this chapter.
25.11.3
A third party that processes personal data of students is
subject to the same obligations of confidentiality,
integrity, and availability as the School itself. Breach by
the third party is treated as breach by the School for the
purposes of this Framework.
25.11.4
The School must maintain a register of third parties that
process personal data on its behalf, with the purpose, the
categories of data concerned, and the location of processing.
The register is produced at audit.
25.12 Audit and Certification
25.12.1
Compliance with this chapter is assessed at the annual
digital audit under Chapter 28.
25.12.2
Where the School holds a current information security
certification, it provides evidence of the certification at
audit, and the scope of the certification is verified.
25.12.3
Where the School does not hold such a certification, it
demonstrates compliance with this chapter through the
documentation required by Sections 25.3, 25.4.6, 25.8.5,
25.9.5, and 25.11.4.
25.12.4
WEQSC may require an independent security assessment where
the School has experienced a data breach, where audit
findings indicate a systemic weakness, or where the School
processes a volume or category of data warranting additional
assurance.
25.13 Breach — Consequences
25.13.1
A Breach of any provision of this chapter is subject to the
audit regime in Chapter 28 and, where applicable, to the
suspension and termination regime in Chapter 29.
25.13.2
The following are classified as indicated:
| Breach | Classification |
|---|
| Failure to notify WEQSC of a data breach within twenty-four hours |
Critical |
| Failure to notify a competent data protection authority within the statutory period |
Critical |
| Failure to notify affected data subjects of a high-risk breach |
Critical |
| Holding unencrypted personal data at rest or in transit |
Major |
| Shared credentials for accounts with write access to the Portal |
Major |
| Failure to implement two-factor authentication for write-access accounts |
Major |
| Failure to maintain an incident response plan |
Major |
| Failure to conduct a risk assessment |
Minor (Major if repeated) |
| Failure to test backup restoration |
Minor (Major if no test has ever been conducted) |
| Failure to maintain a register of third-party processors |
Minor |
| Failure to train staff in data protection and information security |
Minor (Major if repeated) |
25.13.3
Nothing in this chapter displaces the School's right of appeal
under Chapter 35.
Further Resources
- Incident response plan template —
wise.weqsc.org/forms/irp
- Data breach register template —
wise.weqsc.org/forms/breach-register
- Risk assessment template —
wise.weqsc.org/forms/risk-assessment
- Access register template —
wise.weqsc.org/forms/access-register-security
- Third-party processor register —
wise.weqsc.org/forms/processor-register
- ISO/IEC 27001 —
iso.org/standard/27001