Cybersecurity Requirements

General Principle

The security of the WISE system depends on the security of every school that participates in it. An accredited school must implement and maintain technical and organisational measures appropriate to the risk to the personal data and confidential information it processes in the course of its participation in the WISE system.

The measures required by this page are the minimum. A school whose operations, data volumes, or risk profile warrant more stringent measures must implement them.

A school must designate a person as responsible for cybersecurity. This may be the same person as the Data Protection Officer, the person responsible for the Portal, or the senior administrative officer, provided the person has the competence and the authority to discharge the role.

Framework Alignment

The information security management requirements of this page are aligned to ISO/IEC 27001, the international standard for information security management systems.

A school that holds a current ISO/IEC 27001 certification, issued by an accredited certification body, is treated as satisfying the technical requirements of this page, subject to the school demonstrating that the scope of the certification covers the systems and processes used for the WISE programme.

WEQSC may recognise other information security frameworks — including ISO/IEC 27002, the NIST Cybersecurity Framework, and equivalent national standards — as satisfying the requirements of this page, where the framework provides an equivalent or higher level of assurance. Recognition is granted by WEQSC on application by the school.

Risk Assessment

The school must conduct, at least annually, a risk assessment in respect of the information systems and data used for the WISE programme.

The risk assessment must identify:

• The information assets concerned, including personal data, confidential information, and credentials;
• The threats to those assets, including external attack, insider misuse, accidental loss, and natural disaster;
• The vulnerabilities through which threats might be realised;
• The likelihood and potential impact of each identified risk;
• The measures in place to mitigate each risk.

The risk assessment must be documented, reviewed by the Senior Officer, and retained for the duration of the accreditation and for five years thereafter.

Access Control

Access to systems containing personal data or confidential information must be controlled by individual authentication. Shared credentials are prohibited.

Passwords must:

• Be not less than twelve characters in length;
• Contain at least three of the four character classes: lowercase letters, uppercase letters, digits, and symbols;
• Not be a dictionary word, a name, a date of birth, or any other easily guessable value;
• Not be reused across systems;
• Be changed at least every ninety days, or immediately on any suspicion of compromise.

Two-factor authentication is mandatory for all accounts with write access to the Portal. The second factor must be a time-based one-time passcode generated by an authenticator application, a hardware token, or a similarly secure method.

Access rights must be granted on the principle of least privilege. A user must have access only to the data and functions necessary for the discharge of their role.

Encryption

Personal data and confidential information must be encrypted in transit and at rest.

Encryption in transit must use TLS 1.2 or higher, with a cipher suite that is currently considered secure. Older protocol versions — including SSL, TLS 1.0, and TLS 1.1 — are prohibited.

Encryption at rest must use AES-256 or an equivalent algorithm. Encryption keys must be stored separately from the data they protect, and must be rotated at least annually.

Offline backups must be encrypted with the same standard as live data. Unencrypted backups are prohibited.

Portable devices — laptops, tablets, smartphones, USB drives — used to store or access personal data must be encrypted in full, and must be protected by a strong passcode or biometric authentication.

Network and Endpoint Security

School networks used for the WISE programme must be protected by a firewall, configured to deny traffic by default and to permit only necessary services.

All devices that access the Portal or that hold personal data must run a current operating system with security patches applied. Patches designated as critical by the vendor must be applied within thirty days of release.

All such devices must run current anti-malware protection, updated automatically, and must perform a full scan at least once per month.

Wireless networks used to transmit personal data must use WPA3 or WPA2-Enterprise encryption. Open networks and networks using WEP or WPA are prohibited for such transmissions.

Remote access to school systems or to the Portal must be through an encrypted channel. Direct exposure of internal systems to the public internet is prohibited.

Backup and Recovery

The school must maintain backup copies of its systems and data sufficient to permit recovery from a security incident, a hardware failure, or a natural disaster.

Backups must be taken at least weekly. Critical data — student records, examination data, and fee records — must be backed up at least daily.

Backup restoration must be tested at least once per academic session. The test must demonstrate that a backup can be restored within twenty-four hours and that the restored data is complete and unaltered.

At least one backup copy must be held offline or in an immutable form, so as to be protected against ransomware and similar attacks.

Incident Response

The school must maintain a written incident response plan, setting out the steps to be taken in the event of a security incident.

A security incident includes:

• Unauthorised access to or disclosure of personal data;
• Loss or theft of a device containing personal data;
• Ransomware or other malware affecting the systems of the school;
• Denial of service or other disruption of the ability of the school to access the Portal;
• Compromise of a user account with access to personal data;
• Any other event that may affect the confidentiality, integrity, or availability of personal data.

Where the school becomes aware of a security incident, it must:

• Take immediate steps to contain the incident and prevent further harm;
• Preserve evidence of the incident, including logs and copies of affected systems;
• Notify WEQSC within twenty-four hours, or immediately where the incident involves personal data of students;
• Assess whether the incident constitutes a data breach requiring notification;
• Cooperate with any investigation conducted by WEQSC or by a competent authority;
• Take steps to prevent recurrence.

The school must produce a written post-incident report within thirty days of the incident being resolved.

Staff Training

Staff with access to personal data must receive training in data protection and information security, ordinarily within thirty days of appointment and annually thereafter.

Where the law of the jurisdiction permits and the school considers it appropriate, staff with access to personal data of students must be subject to a background check before appointment.

Staff must be made aware of their obligations under the WEQSC framework and must acknowledge in writing their understanding of those obligations.

Supplier and Third-Party Security

Where the school engages a third party to process personal data on its behalf — for example, a cloud service provider, a payroll bureau, or an IT support contractor — the engagement must be governed by a written agreement that imposes on the third party obligations equivalent to those in this page.

The school must satisfy itself, before engaging a third party and at least annually thereafter, that the third party maintains security standards equivalent to those required by this page.

Breach by the third party is treated as breach by the school for the purposes of the WEQSC framework.

The school must maintain a register of third parties that process personal data on its behalf, with the purpose, the categories of data concerned, and the location of processing.

Breach — Consequences

The following are classified as indicated:

Conclusion

The cybersecurity requirements set out in this page ensure that the personal data and confidential information processed under the WEQSC framework is protected against unauthorised access, disclosure, alteration, or destruction. All cybersecurity procedures not expressly set out in this portal must follow the Secretariat's official bylaws.