Guidance

Information Security & Governance Policy

Published 27 October 2026

Policy Statement

The purpose of this Information Security & Governance Policy is to establish a framework that ensures the responsible and effective and secure management of information, system and knowledge across Nuclear Waste Services (NWS). Information is a critical asset, and its proper governance is essential for maintaining trust, security and compliance with law and regulation, and support the NWS mission and objectives.

In addition the Policy will enable knowledge sharing, strengthen collaboration, encourage learning, and support our expertise for safe, secure, effective application and will embed these principles into the business, supported by the relevant systems

It is the overarching policy for information security and governance and supported by specific technical, operational and management policies. NWS recognise that it cannot protect against all threats or prevent all risks, but this policy will ensure by implementation of robust policies inclusive of design principles, threats and risks are identified, protected, detected against and responded to appropriately.

NWS commits to	We achieve this by
Govern - Implementing and maintaining an organisational information security & governance capability; underpinned by appointed senior responsible leadership, robust governance, adequate management and accountability, security arrangements, to safeguard the Confidentiality, Integrity, Availability and Value of Information and Knowledge Assets.	A clear governance and information risk escalation structure reporting to the NWS board with agreed terms of reference. As a minimum appoint the following roles with documented responsibilities: Senior Responsible Officer - Permanent Board Member (SRO); Senior Information Risk Owner (SIRO); Chief Information Security Officer (CISO); Information Governance Officer (IGO); Information Asset Owners (IAO); IT Director; Head of Engineering; Design Authorities (OT and IT). Ensuring that an Information Security & Governance Framework is supported by a strategy and an assurance plan. Ensure information ownership is clear and responsibilities are understood and delivered. Ensuring legal and regulatory requirements are fulfilled.
Design - Ensuring security, privacy and information management is seamlessly woven into all facets of our business as a consideration at project, service, procurement, or system conception stage.	Provide process, guidance and standards that implement National Technical Authority frameworks for “by Design” (Secure by Design, Data Protection by Design & Default and Information Architecture); Establish the context; Making compromise difficult; Making disruption difficult; Making compromise detection easier; Reducing the impact of compromise; Data Protection as an essential component; Process the right data; Use of Security & Privacy Enhancing Technology; Apply Information architecture. Ensure that “by Design” principles are applied and integrated into IT & digital, OT, information management and commercial lifecycles. Use disciplined commissioning processes to ensure that the right information is effectively migrated into new systems and they achieve secure operational outcomes. Having a ‘right to audit’ clause in all contracts and ensure adequate levels of protection are provided within the supply chain. Design knowledge enabled solutions to identify, create, store, share and apply our knowledge both structured and unstructured.
Identify - Clearly identifying NWS Information and System Assets,their value and associated risks.	Providing a coherent Information Risk Management Framework where information risks can be identified, considered, managed and shared. Setting an Information Risk Appetite and using an Information Risk Methodology that will allow for risk-based decisions to be made. Identify the NWS cyberspace environment. Ensuring that information that resides in people is identified, captured, retained and shared.Having information, knowledge and system asset management processes in place.
Protect - Protecting information assets and systems to ensure delivery of critical services and to limit or contain the impact of a potential information or cyber events.	Providing awareness and training across all IS&G functional areas to all staff, based upon their role, to ensure a positive information culture is maintained. Have an ongoing audit and assurance programme in place to ensure controls are effective and that information and systems are maintained and reviewed by system owners. Assure protection of our intellectual property – both tangible and intangible
Exploit - Use information strategically and tactically to gain an efficiency, generate value from information or achieve specific NWS objectives.	Ensuring information is architected so that it is stored in the right place, is not duplicated, is searchable and can be connected. Providing the right tools and guidance to effectively generate value and efficiency from our information and knowledg, as (tangible) digital assets but also from our people`s tacit (intangible asset), expertise and insights.
Detect - Detecting the occurrence of an information or cyber initiated event.	Installing and continuous protective monitoring solutions where possible to ensure anomalies and events are detecte and verify the effectiveness of protective measures. Ensuring physical protection and user awareness is robust on systems which have no protective monitoring installed. Promoting a positive reporting culture to ensure all information events including near misses are captured and learnt from.
Respond - Respond appropriately to a detected information incident	Having a Cyber Incident Response Plan in place to recover information and systems to a safe and operationally viable state. Maintaining and testing the response plan. Ensuring lessons learned from previous detection/response activities are documented.
Recover - Recover from an information or cyber incident that impairs any capability or service that NWS relies on.	Ensuring Business Continuity and Disaster Recovery plans are produced, maintained and tested. Implementing Improvements based on exercising and lessons learned reviews.