Definisjoner og begreper

Access control

Access control is a set of guidelines and rules for managing who should have access to what information, systems, or services within the organisation.

Accessibility

The principle of accessibility involves ensuring that information is available when needed. In the university context, accessibility is crucial to ensure that critical information about exams or student admissions is available when needed.

Application/software

An application or software or app is a computer program designed for performing specific tasks on a computer or a mobile device. These can range from games and productivity tools to social media and online banking services.

Archival decisions

Assessing whether a document should be archived involves determining whether it should be preserved or not. This decision is made based on legal regulations and judgment, considering factors like the need for retention, confidentiality, accessibility, and duration. Documents subject to processing or that have value as documentation require archiving. The decision to archive is made based on the content, not medium. Whether a document is an email, a letter, an SMS, or received via UiA's official social media channels is inconsequential.

Classification

Classification involves categorising information based on its sensitivity. At UiA, we use four classifications: Public (green), Protected (yellow), Confidential (red), and Highly Confidential (black). These classifications determine the level of security required to protect the information.

Cloud service

A cloud service is a service provided over the internet, where data storage, data processing, and software delivery take place remotely on servers, rather than on the user's local computer or device.

Confidentiality

Confidentiality is the principle of keeping information confidential and protected against unauthorised access. For instance, it ensures that only authorised individuals can access health information or other sensitive data.

Consent

Consent means that an individual willingly grants permission or authorisation for their personal information to be collected, processed, or shared in a specific way.

Data processor agreement

This refers to a legal agreement between two parties, where one party processes personal data on behalf of the other. It is crucial to have such agreements in place when sharing personal data with third parties.

Data protection

Data protection relates to the right to privacy and the right to control one's personal data, including the right to know what information is held about oneself and what it is used for. Data protection is a fundamental right enshrined in both the Constitution of Norway and the European Convention on Human Rights (ECHR).

Data security

Data security involves safeguarding our digital files, documents, and data from threats, risks, and unauthorised access. This includes the implementation of various security measures, such as firewalls, antivirus software, encryption, and classification. Employee training is another vital measure to prevent security breaches and maintain a robust security culture.

DPIA (Data Protection Impact Assessment)

A DPIA is an assessment that helps organisations identify and assess the privacy risks associated with processing personal data. This is essential to ensure compliance with privacy legislation.

Encryption

Encryption is a technique used to secure data confidentiality during transmission or storage, rendering information unintelligible without a decryption key. Only those with the correct key can decode and read the original information. This safeguards data from unauthorised access.

Incident

In a general sense, an incident refers to an undesirable event that goes against the established guidelines at the university. Information security incidents often involve human errors, such as mishandling of personal data, the use of unauthorised software, poor password management, or inadequate document access control.

Integrity

Integrity is about ensuring that information remains accurate and unaltered, meaning that data should not be changed by unauthorised individuals, and that users can rely on the information’s accuracy.

Lawful basis for processing

The legal foundation for the processing of personal data, consent for example.

Personal data

Personal data comprises information or assessments that can be linked to an individual. This can include name, address, phone number, vehicle registration number, behavioural data, political opinions, religious beliefs. We differentiate between ordinary personal data and special categories of personal data (sensitive data).

Risk and vulnerability assessment (ROS)

A ROS analysis is a method used to assess risks related to information security in UiA's systems and services. This analysis involves identifying threats, identifying weaknesses, assessing potential outcomes if threats materialise, and devising strategies to reduce risk by implementing security measures. The goal is to protect the organisation against possible security breaches.

Security incident

A security incident refers to an undesirable event that leads to adverse consequences for individuals or processes. An example could be unauthorised access to data systems, applications, or information. Such incidents can occur due to human error, data breaches, or system malfunctions and can result in data leakage, information becoming unavailable, or a loss of trustworthiness.

System administrator

A system administrator is responsible for carrying out information security tasks within their department or unit on behalf of the system owner or research manager.

System owner

The system owner is responsible for ensuring that information security guidelines are adhered to within their areas of responsibility. This includes ensuring security in IT systems/services for which they have ownership. This also includes oversight of the data being processed and ensuring that required security tasks are completed.