{"text_format":"1","workbook":"xlsx","n_sheets":10,"sheets":["Instructions","Unit Profile","Assessment","Summary","Action Plan","Database","Data","newcalc","conversion","Change Log"],"not_rendered":{"charts":1,"images":7,"macros":1,"external_links":1,"defined_names":53,"comments":4,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Instructions","index":0,"n_rows":55,"n_cols":3,"rows_kept":55,"cut":false,"hidden":false,"merged":[]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,"   "]

{"sheet":"Unit Profile","index":1,"n_rows":36,"n_cols":28,"rows_kept":36,"cut":false,"hidden":false,"merged":[[35,1,36,21],[9,2,9,7],[9,10,9,13],[11,10,11,13],[13,2,13,7],[13,10,13,13],[11,2,11,7],[30,15,30,21],[32,15,32,21],[32,1,32,4],[32,6,32,7],[32,9,32,13],[3,1,6,21],[17,6,17,7],[16,9,16,13],[16,1,16,4],[16,6,16,7],[8,15,8,21],[17,9,28,13],[17,15,28,21],[16,15,16,21],[9,15,13,21],[17,1,28,4],[27,6,27,7],[23,6,23,7],[8,2,8,7],[25,6,25,7],[19,6,19,7],[8,10,8,13],[30,9,30,13],[21,6,21,7],[30,1,30,4],[30,6,30,7]]}
[]
[]
[]
[null,"Instructions:\n-Fill in Unit Hierarchy, Contact Information and the Assessment Start Date. If others are helping with the assessment, put their names in the User Comments. \n-Provide any additional comments in User Comments and refer to Supplementary Information for further details.\n-Select which categories of PI you are assessing, and the scope of the assessment (all PI or High-Risk PI only).  \n-Once the Unit Profile tab is complete, click the 'Start Assessment' button to launch the Assessment."]
[]
[]
[]
[]
[null,null,"Unit Hierarchy",null,null,null,null,null,null,null,"Contact Information",null,null,null,null,"User Comments"]
[null,"Exec Unit","",null,null,null,null,null,null,"Name, Title",""]
[null,null,"",null,null,null,null,null,null,null,""]
[null,"Unit","",null,null,null,null,null,null,"Phone, Email",""]
[null,null,"",null,null,null,null,null,null,null,""]
[null,"Sub Unit","",null,null,null,null,null,null,"Assessment Start Date"]
[]
[]
[null,"Questions",null,null,null,null,"User Responses",null,null,"User Comments",null,null,null,null,null,"Supplementary Information"]
[null,"Which categories of PI are you assessing?",null,null,null,null,null,null,null,null,null,null,null,null,null,"Types of PI:\n● Employee (EMP): PI about UBC employees - including staff, faculty and student appointments\n● Student (STU):  PI about undergraduate, graduate, continuing studies, continuing professional education, and real estate students attending courses and activities at UBC\n● Personal Health Information (PHI): Health-related PI collected for UBC purposes (e.g. research or clinical services) on employees, students, donor, alumni and third-parties\n● Donor & Alumni (DA): PI about existing or potential donors and UBC alumni\n● Third-Party (TP): PI that does not fall into any other category including family members of employees and students, volunteers, vendors, children attending daycare or camps, consultants, and the general public\n● Credit Card (PCI): PI that is processed/stored and/or transmitted by UBC merchants during the processing of credit card transactions to support university processes\n",null,null,null,null,null,null,null,null,null,null,false,{"$f":"IF(AA18,Data!E23,\"\")","v":""}]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,false,{"$f":"CONCATENATE(AB18,IF(AA20,CONCATENATE(IF(AB18=\"\",\"\",\",\"&\" \"),Data!E25),\"\"))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CONCATENATE(AB19,IF(AA21,CONCATENATE(IF(AB19=\"\",\"\",\",\"&\" \"),Data!E26),\"\"))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,false,{"$f":"CONCATENATE(AB20,IF(AA22,CONCATENATE(IF(AB20=\"\",\"\",\",\"&\" \"),Data!E27),\"\"))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CONCATENATE(AB21,IF(AA23,CONCATENATE(IF(AB21=\"\",\"\",\",\"&\" \"),Data!E28),\"\"))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,false,{"$f":"CONCATENATE(AB22,IF(AA24,CONCATENATE(IF(AB22=\"\",\"\",\",\"&\" \"),Data!E29),\"\"))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CONCATENATE(AB23,IF(AA25,CONCATENATE(IF(AB23=\"\",\"\",\",\"&\" \"),Data!E30),\"\"))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,false,{"$f":"CONCATENATE(AB24,IF(AA26,CONCATENATE(IF(AB24=\"\",\"\",\",\"&\" \"),Data!E31),\"\"))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"CONCATENATE(AB25,IF(AA27,CONCATENATE(IF(AB25=\"\",\"\",\",\"&\" \"),Data!E32),\"\"))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,false,{"$f":"CONCATENATE(AB26,IF(AA28,CONCATENATE(IF(AB26=\"\",\"\",\",\"&\" \"),Data!E33),\"\"))","v":""}]
[]
[]
[null,"Please indicate the scope of this assessment",null,null,null,null,null,null,null,null,null,null,null,null,null,"To make the assessment more manageable, you may limit the assessment scope to specific types of PI and / or High-Risk PI only.\nHigh-Risk PI includes Social Insurance Number, Date of Birth, Bank Account Details, Government Issued ID (passport, drivers license), Personal Health Information, Biometric Data.\n"]
[]
[null,"What is your inherent risk rating?",null,null,null,null,null,null,null,null,null,null,null,null,null,"Inherent Risk Rating: the risk to an entity \"in the absence\" of any controls or mitigation activities.  The level of PI inherent risks considers factors such as number and sensitivity of PI records that a unit handles.\n\nThe Inherent Risk Rating will be provided by Risk Management Services.\n\n\n",null,null,null,null,null,null,null,null,null,1,{"$f":"INDEX(RiskRating,Z33)","v":"High"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,3]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"//comment: inherent risk rating is \"removed\". The way we implemented this is by setting the inherent risk rating to \"high\" for all iternity in Z33. the dropdown is not deleted but placed above instead, should some crappy PwC hardcode accesses it and crashes."]
[null,"Once you have completed all the questions on this page please proceed to start the assessment by clicking on this button",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"//PwC. \"We make things difficult so clients know they need us.\""]

{"sheet":"Assessment","index":2,"n_rows":111,"n_cols":54,"rows_kept":111,"cut":false,"hidden":true,"merged":[[100,9,100,11],[100,2,100,7],[100,13,100,18],[100,34,100,37],[60,9,60,11],[62,9,62,11],[64,9,64,11],[67,9,67,11],[69,9,69,11],[71,9,71,11],[73,9,73,11],[76,9,76,11],[78,9,78,11],[81,9,81,11],[83,9,83,11],[85,9,85,11],[88,9,88,11],[96,2,96,7],[96,13,96,18],[96,34,96,37],[98,2,98,7],[98,13,98,18],[98,34,98,37],[96,9,96,11],[98,9,98,11],[91,2,91,7],[91,13,91,18],[91,34,91,37],[94,2,94,7],[94,13,94,18],[94,34,94,37],[91,9,91,11],[94,9,94,11],[91,27,91,32],[94,27,94,32],[96,27,96,32],[98,27,98,32],[91,20,91,25],[94,20,94,25],[96,20,96,25],[98,20,98,25],[85,2,85,7],[85,13,85,18],[85,34,85,37],[88,2,88,7],[88,13,88,18],[88,34,88,37],[81,2,81,7],[81,13,81,18],[81,34,81,37],[83,2,83,7],[83,13,83,18],[83,34,83,37],[81,27,81,32],[83,27,83,32],[85,27,85,32],[88,27,88,32],[81,20,81,25],[83,20,83,25],[85,20,85,25],[88,20,88,25],[76,2,76,7],[76,13,76,18],[76,34,76,37],[78,2,78,7],[78,13,78,18],[78,34,78,37],[71,2,71,7],[71,13,71,18],[71,34,71,37],[73,2,73,7],[73,13,73,18],[73,34,73,37],[71,27,71,32],[73,27,73,32],[76,27,76,32],[78,27,78,32],[71,20,71,25],[73,20,73,25],[76,20,76,25],[78,20,78,25],[53,2,53,7],[55,2,55,7],[48,13,48,18],[48,34,48,37],[67,2,67,7],[67,13,67,18],[67,34,67,37],[69,2,69,7],[69,13,69,18],[69,34,69,37],[62,2,62,7],[62,13,62,18],[62,34,62,37],[64,2,64,7],[64,13,64,18],[64,34,64,37],[64,27,64,32],[67,27,67,32],[69,27,69,32],[67,20,67,25],[69,20,69,25],[50,9,50,11],[53,27,53,32],[42,3,42,7],[44,3,44,7],[40,3,40,7],[36,9,36,11],[60,34,60,37],[60,2,60,7],[60,13,60,18],[57,13,57,18],[57,34,57,37],[48,9,48,11],[51,9,51,11],[53,9,53,11],[55,9,55,11],[57,9,57,11],[51,13,51,18],[51,34,51,37],[53,13,53,18],[53,34,53,37],[55,13,55,18],[55,34,55,37],[57,2,57,7],[58,2,58,7],[48,2,48,7],[51,2,51,7],[40,9,40,11],[42,9,42,11],[44,9,44,11],[36,13,36,18],[36,34,36,37],[38,13,38,18],[38,34,38,37],[40,13,40,18],[40,34,40,37],[36,27,36,32],[38,27,38,32],[40,27,40,32],[42,27,42,32],[44,27,44,32],[40,20,40,25],[42,20,42,25],[44,20,44,25],[42,34,42,37],[44,34,44,37],[29,9,29,11],[38,3,38,7],[25,2,25,7],[29,13,29,18],[29,34,29,37],[27,9,27,11],[29,2,29,7],[31,13,31,18],[31,34,31,37],[27,2,27,7],[32,2,32,7],[32,9,32,11],[32,13,32,18],[32,34,32,37],[36,3,36,7],[29,27,29,32],[31,27,31,32],[32,27,32,32],[29,20,29,25],[31,20,31,25],[32,20,32,25],[36,20,36,25],[38,20,38,25],[38,9,38,11],[21,9,21,11],[23,9,23,11],[23,13,23,18],[20,13,20,18],[27,13,27,18],[27,34,27,37],[25,9,25,11],[25,13,25,18],[25,34,25,37],[21,34,21,37],[23,34,23,37],[5,13,5,15],[5,2,5,3],[3,1,3,9],[3,13,3,15],[18,9,18,11],[18,2,18,7],[18,13,18,18],[16,3,16,7],[16,9,16,11],[16,13,16,18],[7,1,10,37],[12,2,12,7],[12,9,12,11],[12,13,12,18],[12,34,12,37],[14,34,14,37],[12,20,12,25],[21,2,21,7],[23,2,23,7],[14,2,14,7],[14,9,14,11],[16,34,16,37],[18,34,18,37],[21,13,21,18],[108,2,108,7],[108,9,108,11],[108,13,108,18],[108,34,108,37],[14,20,14,25],[16,20,16,25],[18,20,18,25],[20,20,20,25],[21,20,21,25],[23,20,23,25],[25,20,25,25],[27,20,27,25],[46,20,46,25],[46,27,46,32],[47,27,47,32],[48,27,48,32],[51,27,51,32],[110,2,110,7],[110,9,110,11],[110,13,110,18],[110,34,110,37],[102,2,102,7],[102,9,102,11],[102,13,102,18],[102,34,102,37],[104,2,104,7],[104,9,104,11],[104,13,104,18],[104,34,104,37],[106,2,106,7],[106,9,106,11],[106,13,106,18],[106,34,106,37],[110,27,110,32],[106,27,106,32],[108,27,108,32],[46,13,46,18],[14,13,14,18],[42,13,42,18],[47,13,47,18],[44,13,44,18],[3,34,3,35],[100,27,100,32],[102,27,102,32],[104,27,104,32],[55,27,55,32],[57,27,57,32],[60,27,60,32],[62,27,62,32],[12,27,12,32],[14,27,14,32],[16,27,16,32],[18,27,18,32],[20,27,20,32],[21,27,21,32],[23,27,23,32],[25,27,25,32],[27,27,27,32],[46,34,46,37],[47,34,47,37],[100,20,100,25],[102,20,102,25],[104,20,104,25],[106,20,106,25],[108,20,108,25],[110,20,110,25],[47,20,47,25],[48,20,48,25],[51,20,51,25],[53,20,53,25],[55,20,55,25],[57,20,57,25],[60,20,60,25],[62,20,62,25],[64,20,64,25]]}
[]
[]
[]
[null,"Assessment Progress",null,null,null,null,null,null,null,null,null,null,null,"Inherent Risk Rating",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Summary Results"]
[]
[null,{"$f":"100*progressPercent","v":0},"% completed",null,null,null,null,null,null,null,null,null,null,{"$f":"'Unit Profile'!AA33","v":"High"}]
[]
[null,"Instructions:\n1. Refer to Information Security Standards #1-9, and #11 as you complete the Assessment (all of the standards can be found here). Complete each question (the grey background colour of the response field will change once the question has been answered). There are different types of responses, depending on the question - simply choose the most appropriate response. The assessment uses the highest rating when a response has not been provided - please therefore ensure all questions are answered.\n2. Refer to the Supplementary Information for each question before you provide your response. Provide any additional comments in the User Comments field (e.g. a description of controls that are in place to address the requirement).\n3. During or after answering all questions, you can check your results by clicking the \"View Summary Results\" button."]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Inherent Risk",{"$f":"'Unit Profile'!AA33","v":"High"}]
[]
[null,"#","Questions",null,null,null,null,null,null,"Responses",null,null,null,"User Comments",null,null,null,null,null,null,"Action Plan",null,null,null,null,null,null,"RMS comments",null,null,null,null,null,null,"Supplementary Information",null,null,null,null,"Q ID","Row ",null,"Responses","Risk Ratings",null,null,null,null,null,null,null,null,2,1]
[null,"GENERAL",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,null,null,null,null,null,null,null,null,null,null,null,4,2]
[null,1,{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P6=\"Yes\",Database!L6=1),Database!F6,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P6=\"Yes\",Database!M6=1),Database!F6,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P6=\"yes\",Database!N6=1),Database!F6,\" \")))))))","v":"Have roles and responsibilities been assigned within your unit for key Privacy and Security tasks? "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F6=Assessment!C15, Database!J6, \" \")=0,\" \",Database!J6)","v":"Privacy and Information Security roles and responsibilities should be clearly defined and communicated (e.g. in Job Descriptions), on Unit websites). Roles and responsibilities should be aligned with <<Policy 104: Acceptable Use and Security of UBC Electronic Information and Systems>>"},null,null,4,null,1,4,4,{"$f":"INDEX(Responses,AP15)","v":"Select an option"},{"$f":"IF(AN15>0, (IF(ISNA(VLOOKUP(AQ15,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ15,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,6,3]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,3,null,null,null,null,null,null,null,null,null,null,null,9,4]
[null,null,{"$f":"B15+0.1","v":1.1000000000000001},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P7=\"Yes\",Database!L7=1),Database!F7,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P7=\"Yes\",Database!M7=1),Database!F7,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P7=\"yes\",Database!N7=1),Database!F7,\" \")))))))","v":"Do employees know who to contact within their unit for Privacy and Security matters?"},null,null,null,null,null," ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F7=Assessment!D17, Database!J7, \" \")=0,\" \",Database!J7)","v":"Users must immediately report all suspected information security incidents as follows:\n●  to Information Security at security@ubc.ca or via phone to the IT Service Centre at 604-822-6141. Information Security will coordinate the incident as required in accordance with the UBC Incident Response Plan;\n●  to their supervisor and University IT Support Staff who are assigned to their unit; and\n●  where the incident involves physical security issues on a UBC campus, in addition to information security issues, to Campus Security.\n\nFor further information refer to <<ISS #4:  Reporting Information Security Incidents>>\n\nFor all other security matters, employees should contact the employee in their unit with responsibility for information security."},null,null,null,null,2,4,4,{"$f":"INDEX(Responses,AP17)","v":"Select an option"},{"$f":"IF(AN17>0, (IF(ISNA(VLOOKUP(AQ17,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ17,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,11,5]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,5,null,null,null,null,null,null,null,null,null,null,null,13,6]
[null,{"$f":"B15+1","v":2},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P8=\"Yes\",Database!L8=1),Database!F8,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P8=\"Yes\",Database!M8=1),Database!F8,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P8=\"yes\",Database!N8=1),Database!F8,\" \")))))))","v":"Have all employees working with PI been made aware of the University's Information Security Standards, and fact sheets on privacy and paper-based security, which outline how PI must be collected, used and disclosed?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F8=Assessment!C19, Database!J8, \" \")=0,\" \",Database!J8)","v":"<<Information Security Standards>>\n\n<<Privacy Fact Sheets>>\n\n<<Information Security Fact Sheet: Security of Paper Records>>\n"},null,null,null,null,3,6,4,{"$f":"INDEX(Responses,AP19)","v":"Select an option"},{"$f":"IF(AN19>0, (IF(ISNA(VLOOKUP(AQ19,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ19,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,15,7]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,7,null,null,null,null,null,null,null,null,null,null,null,17,8]
[null,"PRIVACY",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,8,null,null,null,null,null,null,null,null,null,null,null,20,9]
[null,{"$f":"B19+1","v":3},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P9=\"Yes\",Database!L9=1),Database!F9,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P9=\"Yes\",Database!M9=1),Database!F9,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P9=\"yes\",Database!N9=1),Database!F9,\" \")))))))","v":"Is PI only collected when it is necessary for an operating program or activity of UBC?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,5,null,null,null,null,null,null,5,{"$f":"IF(IF(Database!F9=Assessment!C22, Database!J9, \" \")=0,\" \",Database!J9)","v":"<<Privacy Fact Sheet: Collecting PI>>\n\nThe collection is “necessary” if the information is essential for the effective operation of the program or activity, and there are no reasonable alternatives to the collection.\n"},null,null,5,null,4,5,5,{"$f":"INDEX(Privacy_Options,AP22)","v":"Select an option"},{"$f":"IF(AN22>0, (IF(ISNA(VLOOKUP(AQ22,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ22,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,24,10]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,10,null,null,null,null,null,null,null,null,null,null,null,26,11]
[null,{"$f":"B22+1","v":4},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P10=\"Yes\",Database!L10=1),Database!F10,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P10=\"Yes\",Database!M10=1),Database!F10,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P10=\"yes\",Database!N10=1),Database!F10,\" \")))))))","v":"Is a privacy notification provided whenever PI is collected from an individual?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F10=Assessment!C24, Database!J10, \" \")=0,\" \",Database!J10)","v":"<<Privacy Fact Sheet: Collecting PI>>\n\nSample Privacy Notification: “Your personal information is collected under the authority of section 26(c) of the Freedom of Information and Protection of Privacy Act (FIPPA). This information will be used for the purpose of evaluating your application for admission to UBC. Questions about the collection of this information may be directed to admissions@ubc.ca.”\n"},null,null,null,null,5,11,5,{"$f":"INDEX(Privacy_Options,AP24)","v":"Select an option"},{"$f":"IF(AN24>0, (IF(ISNA(VLOOKUP(AQ24,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ24,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,28,12]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,12,null,null,null,null,null,null,null,null,null,null,null,30,13]
[null,{"$f":"B24+1","v":5},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P11=\"Yes\",Database!L11=1),Database!F11,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P11=\"Yes\",Database!M11=1),Database!F11,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P11=\"yes\",Database!N11=1),Database!F11,\" \")))))))","v":"Is the consent of affected individuals secured before you store or make their PI accessible outside Canada?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F11=Assessment!C26, Database!J11, \" \")=0,\" \",Database!J11)","v":"<<Privacy Fact Sheet: Disclosing PI Outside Canada>>\n\nGenerally, UBC cannot allow personal information to be stored or accessed outside Canada without the written consent of the individual the personal information is about.\n"},null,null,null,null,6,13,5,{"$f":"INDEX(Privacy_Options,AP26)","v":"Select an option"},{"$f":"IF(AN26>0, (IF(ISNA(VLOOKUP(AQ26,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ26,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,32,14]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,14,null,null,null,null,null,null,null,null,null,null,null,36,15]
[null,{"$f":"B26+1","v":6},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P12=\"Yes\",Database!L12=1),Database!F12,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P12=\"Yes\",Database!M12=1),Database!F12,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P12=\"yes\",Database!N12=1),Database!F12,\" \")))))))","v":"Is PI only used for the purpose it was collected, or for a consistent purpose?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F12=Assessment!C28, Database!J12, \" \")=0,\" \",Database!J12)","v":"PI must be used either for the purpose it was collected, or a consistent purpose. A “consistent purpose” is one that (a) has a reasonable and direct connection to the purpose, and (b) is necessary for performing an operating program or activity of UBC."},null,null,null,null,7,15,5,{"$f":"INDEX(Privacy_Options,AP28)","v":"Select an option"},{"$f":"IF(AN28>0, (IF(ISNA(VLOOKUP(AQ28,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ28,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,39,16]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,16,null,null,null,null,null,null,null,null,null,null,null,41,17]
[null,{"$f":"B28+1","v":7},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P13=\"Yes\",Database!L13=1),Database!F13,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P13=\"Yes\",Database!M13=1),Database!F13,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P13=\"yes\",Database!N13=1),Database!F13,\" \")))))))","v":"Is paper-based and electronic PI only disclosed to UBC employees and contractors on a need-to-know basis? "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Database!F13=Assessment!C30, Database!J13, \" \")","v":"Employees and contractors are authorized to view PI when this is necessary for the performance of their duties (the 'need-to-know' principle).\n\nA 'need-to-know' basis in this context is when their role at UBC requires them to have access to perform their duties."},null,null,null,null,8,17,5,{"$f":"INDEX(Privacy_Options,AP30)","v":"Select an option"},{"$f":"IF(AN30>0, (IF(ISNA(VLOOKUP(AQ30,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ30,Data!$E$10:$F$18,2,FALSE)))))","v":""},{"$f":"IF(AQ33 = \"None\", (AR30+AR34)/2, \" \")","v":" "},null,null,null,null,null,null,null,43,18]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,18,null,null,null,null,null,null,null,null,null,null,null,45,19]
[null,"PAPER SECURITY",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,19,null,null,null,null,null,null,null,null,null,null,null,48,20]
[null,{"$f":"B30+1","v":8},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P14=\"Yes\",Database!L14=1),Database!F14,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P14=\"Yes\",Database!M14=1),Database!F14,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P14=\"yes\",Database!N14=1),Database!F14,\" \")))))))","v":"Which of the following types of paper-based PI is handled in your unit?\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,null,null,null,null,null,null,2,{"$f":"IF(IF(Database!F14=Assessment!C33, Database!J14, \" \")=0,\" \",Database!J14)","v":"High-Risk PI includes: Social Insurance Number, Date of Birth, Bank Account Details, Passport ID, Personal Health Information, Biometric Data)  Note: Biometric data, e.g. fingerprint and retina scanning, is used to uniquely identify people. \n\nOther PI includes PI that is not identified in the above paragraph such as student names, class lists, donor names, employee home address."},null,null,2,null,9,2,4,{"$f":"INDEX(PIOptions,AP33)","v":"Select an option"},{"$f":"IF(AN33>0, (IF(ISNA(VLOOKUP(AQ33,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ33,Data!$E$10:$F$18,2,FALSE)))))","v":""},{"$f":"IF(AQ33 =\"Other PI\", AR37, \" \")","v":" "},null,null,null,null,null,null,null,50,21]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,21,null,null,null,{"$f":"IF(AQ33 = \"High-Risk PI\", AVERAGE(AR39,AR41,AR43,AR45), \" \")","v":" "},null,null,null,null,null,null,null,52,22]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,22,null,null,null,null,null,null,null,null,null,null,null,55,23]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,23,null,null,null,null,null,null,null,null,null,null,null,57,24]
[null,null,8.1,{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P15=\"Yes\",Database!L15=1),Database!F15,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P15=\"Yes\",Database!M15=1),Database!F15,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P15=\"yes\",Database!N15=1),Database!F15,\" \")))))))","v":"Is paper-based PI  secured as per the Security of Paper Records Fact Sheet?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F15 = Assessment!D37, Database!J15, \" \")=0,\" \",Database!J15)","v":"<<Information Security Fact Sheet: Security of Paper Records>>\n\nSecurity measure needs to be applied across the complete lifecycle of a record which includes collection, storage, transmission, and disposition / destruction."},null,null,null,null,10,24,4,{"$f":"INDEX(Responses,AP37)","v":"Select an option"},{"$f":"IF(AN37>0, (IF(ISNA(VLOOKUP(AQ37,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ37,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,59,25]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,25,null,null,null,null,null,null,null,null,null,null,null,61,26]
[null,null,8.1999999999999993,{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P16=\"Yes\",Database!L16=1),Database!F16,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P16=\"Yes\",Database!M16=1),Database!F16,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P16=\"yes\",Database!N16=1),Database!F16,\" \")))))))","v":"Are reasonable measures in place to secure High-Risk paper-based PI?\nRefer to Supplementary Information for guidance on 'reasonable measures'.\n\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F16 = Assessment!D39, Database!J16, \" \")=0,\" \",Database!J16)","v":"<<Information Security Fact Sheet: Security of Paper Records>>\n\nOwing to the significant volume of paper-based records that are handled by the University, it is not possible, nor required, to protect all records to the same extent. The University follows a risk-based approach, where the overall aim is to implement a reasonable level of control, taking into account the probability and impact of a security breach. More extensive safeguards are required for High-Risk PI, particularly in larger volumes.  \n\n"},null,null,null,null,11,26,4,{"$f":"INDEX(Responses,AP39)","v":"Select an option"},{"$f":"IF(AN39>0, (IF(ISNA(VLOOKUP(AQ39,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ39,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,64,27]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,27,null,null,null,null,null,null,null,null,null,null,null,66,28]
[null,null,{"$f":"IF(C39=\" \", \" \",(C39+0.1))","v":8.2999999999999989},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P17=\"Yes\",Database!L17=1),Database!F17,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P17=\"Yes\",Database!M17=1),Database!F17,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P17=\"yes\",Database!N17=1),Database!F17,\" \")))))))","v":"Are large volumes of High-Risk paper-based PI sent using the secure delivery service provided by Campus Mail or some other secure transmission method?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F17 = Assessment!D41, Database!J17, \" \")=0,\" \",Database!J17)","v":"Examples include T4s, transcripts, medical records, appointment and benefit enrolment forms. "},null,null,null,null,12,28,5,{"$f":"INDEX(Privacy_Options,AP41)","v":"Select an option"},{"$f":"IF(AN41>0, (IF(ISNA(VLOOKUP(AQ41,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ41,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,69,29]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,29,null,null,null,null,null,null,null,null,null,null,null,71,30]
[null,null,{"$f":"IF(C41 = \" \", \" \", (C41+0.1))","v":8.3999999999999986},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P18=\"Yes\",Database!L18=1),Database!F18,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P18=\"Yes\",Database!M18=1),Database!F18,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P18=\"yes\",Database!N18=1),Database!F18,\" \")))))))","v":"Is a formal record retention schedule in operation to ensure High-Risk paper-based PI records are archived / destroyed when no longer required?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F18 = Assessment!D43, Database!J18, \" \")=0,\" \",Database!J18)","v":"Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>\n\nThe FIPPA requires that PI must be retained for at least one year after it is used to make a decision that affects the individual.  In addition, other relevant UBC and external retention requirements need to be considered."},null,null,null,null,13,30,4,{"$f":"INDEX(Responses,AP43)","v":"Select an option"},{"$f":"IF(AN43>0, (IF(ISNA(VLOOKUP(AQ43,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ43,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,73,31]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,31,null,null,null,null,null,null,null,null,null,null,null,76,32]
[null,null,{"$f":"IF(C43 = \" \", \" \", (C43+0.1))","v":8.4999999999999982},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P19=\"Yes\",Database!L19=1),Database!F19,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P19=\"Yes\",Database!M19=1),Database!F19,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P19=\"yes\",Database!N19=1),Database!F19,\" \")))))))","v":"Is High-Risk paper-based PI securely destroyed (e.g. by cross-shredding or incineration)?\n\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F19 = Assessment!D45, Database!J19, \" \")=0,\" \",Database!J19)","v":"Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>"},null,null,null,null,14,32,4,{"$f":"INDEX(Responses,AP45)","v":"Select an option"},{"$f":"IF(AN45>0, (IF(ISNA(VLOOKUP(AQ45,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ45,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,79,33]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,33,null,null,null,null,null,null,null,null,null,null,null,82,34]
[null,"ELECTRONIC INFORMATION SECURITY",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,34,null,null,null,null,null,null,null,null,null,null,null,84,35]
[null,"1. Security Classification of UBC Electronic Information",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,35,null,null,null,null,null,null,null,null,null,null,null,86,36]
[null,{"$f":"B33+1","v":9},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P20=\"Yes\",Database!L20=1),Database!F20,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P20=\"Yes\",Database!M20=1),Database!F20,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P20=\"yes\",Database!N20=1),Database!F20,\" \")))))))","v":"Have all electronic repositories containing PI been identified and captured on an inventory for your unit? "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F20=Assessment!C49,Database!J20,\" \")=0,\" \",Database!J20)","v":"The Administrative Head of Unit is responsible for creating an inventory of all UBC Electronic Information under his/her control and detmining its information security classification.  For a sample PI Inventory Template please contact Risk Management Services."},null,null,null,null,15,36,5,{"$f":"INDEX(Privacy_Options,AP49)","v":"Select an option"},{"$f":"IF(AN49>0, (IF(ISNA(VLOOKUP(AQ49,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ49,Data!$E$10:$F$18,2,FALSE)))))","v":""},{"$f":"AR49","v":""},null,null,null,null,null,null,null,88,37]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,37,null,null,null,null,null,null,null,null,null,null,null,90,38]
[null,"2. Password and Passphrase Protection",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,38,null,null,null,null,null,null,null,null,null,null,null,92,39]
[null,{"$f":"B49+1","v":10},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P21=\"Yes\",Database!L21=1),Database!F21,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P21=\"Yes\",Database!M21=1),Database!F21,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P21=\"yes\",Database!N21=1),Database!F21,\" \")))))))","v":"Do employees use strong passwords/passphrases to access electronic PI? Note: Passwords must contain a minimum of 8 characters including upper and lower case letters, numbers and symbols. Alternatively, use a passphrase with a minimum of 16 characters.\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F21=Assessment!C52,Database!J21,\" \")=0,\" \",Database!J21)","v":"This may include:\n●  mobile computing devices such as laptop computers, smartphones, and tablet computers (including encryption passwords to these devices)\n●  electronic storage media such as CDs, USB memory sticks, and portable hard drives\n●  email systems\n●  software applications\n\nNote:  Strong CWL passwords are automatically enforced however due consideration should be given to all other passwords that are used to access PI.\n\nDetails of passwords/passphrases requirements can be found in <<ISS #2: Password and Passphrase Protection>>"},null,null,null,null,16,39,6,{"$f":"INDEX(Range,AP52)","v":"Select an option"},{"$f":"IF(AN52>0, (IF(ISNA(VLOOKUP(AQ52,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ52,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,94,40]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,40,null,null,null,null,null,null,null,null,null,null,null,96,41]
[null,{"$f":"B52+1","v":11},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P22=\"Yes\",Database!L22=1),Database!F22,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P22=\"Yes\",Database!M22=1),Database!F22,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P22=\"yes\",Database!N22=1),Database!F22,\" \")))))))","v":"Do employees change their passwords/passphrases annually? Note: Passwords/passphrases must be immediately changed if there are suspicions that they could have been compromised and the incident must be reported to UBC Information Security\n\n "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F22=Assessment!C54,Database!J22,\" \")=0,\" \",Database!J22)","v":"This requirement must be met regardless of whether it is enforced by the system or not.  However, wherever possible, systems should be configured to enforce annual changes to passwords/passphrases."},null,null,null,null,17,41,6,{"$f":"INDEX(Range,AP54)","v":"Select an option"},{"$f":"IF(AN54>0, (IF(ISNA(VLOOKUP(AQ54,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ54,Data!$E$10:$F$18,2,FALSE)))))","v":""},null,null,null,null,null,null,null,null,98,42]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,42]
[null,{"$f":"B54+1","v":12},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P23=\"Yes\",Database!L23=1),Database!F23,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P23=\"Yes\",Database!M23=1),Database!F23,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P23=\"yes\",Database!N23=1),Database!F23,\" \")))))))","v":"Are employees prohibited from reusing any of the previous 10 passwords/ passphrases? \n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F23=Assessment!C56,Database!J23,\" \")=0,\" \",Database!J23)","v":"This requirement must be met regardless of whether it is enforced by the system or not. However, wherever possible, systems should be configured to prevent the reuse of any of the previous 10 passwords/ passphrases. \n"},null,null,null,null,18,43,6,{"$f":"INDEX(Range,AP56)","v":"Select an option"},{"$f":"IF(AN56>0, (IF(ISNA(VLOOKUP(AQ56,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ56,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,44]
[null,{"$f":"B56+1","v":13},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P24=\"Yes\",Database!L24=1),Database!F24,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P24=\"Yes\",Database!M24=1),Database!F24,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P24=\"yes\",Database!N24=1),Database!F24,\" \")))))))","v":"Do employees keep their passwords/passphrases secure once they have been created?\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F24=Assessment!C58,Database!J24,\" \")=0,\" \",Database!J24)","v":"It is preferred that passwords are not written down; however, if it is necessary to do so, the password must be locked away in a secure, inaccessible location such as a safe. If a password safe (an application for securely storing multiple passwords) is to be used, refer to the <<IS Guideline: Password Safes>>\n\nEmployees should be given clear instructions never to provide passwords/passphrases in response to emails or phone call requests for this information. Even if these requests appear to be from a trusted source, they may actually be attempts to steal a user's credentials."},null,null,null,null,19,45,6,{"$f":"INDEX(Range,AP58)","v":"Select an option"},{"$f":"IF(AN58>0, (IF(ISNA(VLOOKUP(AQ58,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ58,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,46]
[null,"3. Transmission and Sharing of UBC Electronic Information",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,47]
[null,{"$f":"B58+1","v":14},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P25=\"Yes\",Database!L25=1),Database!F25,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P25=\"Yes\",Database!M25=1),Database!F25,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P25=\"yes\",Database!N25=1),Database!F25,\" \")))))))","v":"Do employees only extract, store, and/or transmit the minimum amount of PI necessary to complete a task? "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F25=Assessment!C61,Database!J25,\" \")=0,\" \",Database!J25)","v":"Wherever possible, PI should not be extracted from protected systems as the risk of unauthorized access becomes greater. However, it is recognized that, in many instances, tasks cannot be performed without removing PI from the system.  In these instances, do not transmit any information that is not required, to minimize the potential impact if a privacy breach occurs. \n\nFor further information refer to <<ISS #3:  Transmission and Sharing of UBC Electronic Information>>\n\nIn addition, always ensure PI is stored in a secure location and / or transmitted in a secure manner.  Details of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>"},null,null,null,null,20,48,6,{"$f":"INDEX(Range,AP61)","v":"Select an option"},{"$f":"IF(AN61>0, (IF(ISNA(VLOOKUP(AQ61,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ61,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,49]
[null,{"$f":"B61+1","v":15},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P26=\"Yes\",Database!L26=1),Database!F26,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P26=\"Yes\",Database!M26=1),Database!F26,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P26=\"yes\",Database!N26=1),Database!F26,\" \")))))))","v":"Does your unit only use computing services within Canada to store, transmit, or access PI?\n\n\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F26=Assessment!C63,Database!J26,\" \")=0,\" \",Database!J26)","v":"Computing services based outside of Canada (such as Gmail, Dropbox, Hotmail, and Yahoo) are not suitable for transmission or sharing of PI because the British Columbia Freedom of Information and Protection of Privacy Act prohibits UBC from transmitting, storing, or allowing access to PI outside of Canada (this includes backups and temporary storage). Also, these services are generally less secure than UBC-based systems.\n\nDetails of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>"},null,null,null,null,21,50,6,{"$f":"INDEX(Range,AP63)","v":"Select an option"},{"$f":"IF(AN63>0, (IF(ISNA(VLOOKUP(AQ63,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ63,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,51]
[null,{"$f":"B63+1","v":16},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P27=\"Yes\",Database!L27=1),Database!F27,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P27=\"Yes\",Database!M27=1),Database!F27,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P27=\"yes\",Database!N27=1),Database!F27,\" \")))))))","v":"Is High-Risk PI encrypted, as required in the UBC Encryption Requirements Standard, when employees are sharing the information via email?  "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Database!F27=Assessment!C65,Database!J27,\" \")","v":"Wherever possible, more-secure communication / sharing methods should be used for sharing High-Risk PI. Examples include:\n●   placing a document on a shared network drive and sharing the link by email. \n●   using the University's Workspace application, which is a simple, secure, and easy to use file sharing service, hosted within UBC that enables employees to share documents with internal and external parties.\n\nPassword protecting files and / or devices does not provide the same security that encryption provides. The differences are explained here <<ISS #5: Encryption Requirements>>"},null,null,null,null,22,52,6,{"$f":"INDEX(Range,AP65)","v":"Select an option"},{"$f":"IF(AN65>0, (IF(ISNA(VLOOKUP(AQ65,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ65,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,53]
[null,"5. Encryption Requirements",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,54]
[null,{"$f":"B65+1","v":17},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P28=\"Yes\",Database!L28=1),Database!F28,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P28=\"Yes\",Database!M28=1),Database!F28,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P28=\"yes\",Database!N28=1),Database!F28,\" \")))))))","v":"Do employees store PI on mobile devices? Refer to Supplementary Information for examples of mobile devices.\n\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F28=Assessment!C68,Database!J28,\" \")=0,\" \",Database!J28)","v":"Mobile Devices are any portable computing or data storage devices. These include:\n●  Laptops (a mobile computer small enough to fit on a user's lap);\n●  Mobile computing devices (computing devices smaller than laptops, such as smartphones, tablet computers and PDAs); and \n●  Mobile storage devices / media (portable devices used to store electronic information, such as USB sticks, portable drives, memory cards, CDs, DVDs)\n\nPI should only be stored on mobile devices if more secure alternatives are not feasible, e.g. network drives, file share applications including SharePoint and Workspace."},null,null,1,null,23,1,4,{"$f":"INDEX(Responses,AP68)","v":"Select an option"},{"$f":"IF(AN68>0, (IF(ISNA(VLOOKUP(AQ68,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ68,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,56]
[null,{"$f":"B68+1","v":18},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P29=\"Yes\",Database!L29=1),Database!F29,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P29=\"Yes\",Database!M29=1),Database!F29,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P29=\"yes\",Database!N29=1),Database!F29,\" \")))))))","v":"Is encryption enabled on all laptop computers, mobile computing devices, mobile storage devices/media, and High-Risk desktop computers, that contain PI? Note: UBC's minimum encryption standard is AES-128 bit encryption or equivalent.\n\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Database!F29=Assessment!C70,Database!J29,\" \")","v":"High-Risk desktop computers are those that are at a higher risk of theft due to their location and lack of strong physical security measures, e.g. reception desks, ground floor buildings close to windows / doors. If possible, PI should not be stored locally on the desktop; this will increase the security of the PI and potentially remove the need to encrypt the computer.\n\nFurther details can be found at:  <<ISS #5: Encryption Requirements>>"},null,null,null,null,24,57,6,{"$f":"INDEX(Range,AP70)","v":"Select an option"},{"$f":"IF(AN70>0, (IF(ISNA(VLOOKUP(AQ70,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ70,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,58]
[null,{"$f":"B70+1","v":19},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P30=\"Yes\",Database!L30=1),Database!F30,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P30=\"Yes\",Database!M30=1),Database!F30,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P30=\"yes\",Database!N30=1),Database!F30,\" \")))))))","v":"If a device containing PI was lost or stolen, would it be possible to confirm the encryption status?\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Database!F30=Assessment!C72,Database!J30,\" \")","v":"To meet this requirement, employees must be able to:\n●   ensure that encrypted UBC-owned devices automatically report their encryption status (whenever connected to the UBC network) to validate that encryption was active at the time of loss or theft (UBC’s Encryption Service offers this functionality); or\n●   provide a written confirmation of the encryption status at the time of loss or theft."},null,null,null,null,25,59,6,{"$f":"INDEX(Range,AP72)","v":"Select an option"},{"$f":"IF(AN72>0, (IF(ISNA(VLOOKUP(AQ72,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ72,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,60]
[null,{"$f":"B72+1","v":20},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P31=\"Yes\",Database!L31=1),Database!F31,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P31=\"Yes\",Database!M31=1),Database!F31,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P31=\"yes\",Database!N31=1),Database!F31,\" \")))))))","v":"Can your unit recover device encryption passwords if they are forgotten?\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Database!F31=Assessment!C74,Database!J31,\" \")","v":"If the password (also called a “key”) is forgotten or lost, the data may be unrecoverable. Therefore, it is essential to have a key recovery strategy. Employees can use the University’s central encryption service that includes key escrow, or simply write down the password and store it in a secure location such as a safe."},null,null,null,null,26,61,4,{"$f":"INDEX(Responses,AP74)","v":"Select an option"},{"$f":"IF(AN74>0, (IF(ISNA(VLOOKUP(AQ74,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ74,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,62]
[null,"6. Working Remotely",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,63]
[null,{"$f":"B74+1","v":21},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P32=\"Yes\",Database!L32=1),Database!F32,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P32=\"Yes\",Database!M32=1),Database!F32,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P32=\"yes\",Database!N32=1),Database!F32,\" \")))))))","v":"Do employees take reasonable measures to prevent or reduce the possibility of loss or theft of devices used to access PI when working remotely?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F32=Assessment!C77,Database!J32,\" \")=0,\" \",Database!J32)","v":"Working remotely means accessing UBC Electronic Information from outside of a UBC campus.\nReasonable measures include:\n●   being aware of others looking over your shoulder at your screen when working in public locations such as coffee shops, aircraft and other public transport; \n●   not leaving mobile devices unattended in a public place, especially well-travelled areas such as airport lounges, and coffee shops; and\n●   keeping devices secured when working from home, e.g. storing them in a physically-secured area and ensuring UBC Electronic Information cannot be accessed by family members.\n\nFor further information refer to: <<ISS #6: Working Remotely>>"},null,null,null,null,27,64,6,{"$f":"INDEX(Range,AP77)","v":"Select an option"},{"$f":"IF(AN77>0, (IF(ISNA(VLOOKUP(AQ77,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ77,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,65]
[null,{"$f":"B77+1","v":22},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P33=\"Yes\",Database!L33=1),Database!F33,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P33=\"Yes\",Database!M33=1),Database!F33,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P33=\"yes\",Database!N33=1),Database!F33,\" \")))))))","v":"Do employees access PI securely when working remotely?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F33=Assessment!C79,Database!J33,\" \")=0,\" \",Database!J33)","v":"Secure access methods e.g. Virtual Desktop Interface (VDI) and Virtual Private Network (VPN), should be used wherever possible.  For further information refer to: <<ISS #6: Working Remotely>>\n\nAdditionally, third-party devices, such as kiosks in public libraries, hotels, airports, and cyber cafes, should not be used, and public Wi-Fi networks, such as those in airports, coffee shops, should be used with caution."},null,null,null,null,28,66,6,{"$f":"INDEX(Range,AP79)","v":"Select an option"},{"$f":"IF(AN79>0, (IF(ISNA(VLOOKUP(AQ79,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ79,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,67]
[null,"7. Securing Computing and Mobile Storage Devices/Media",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,68]
[null,{"$f":"B79+1","v":23},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P34=\"Yes\",Database!L34=1),Database!F34,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P34=\"Yes\",Database!M34=1),Database!F34,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P34=\"yes\",Database!N34=1),Database!F34,\" \")))))))","v":"Are reasonable electronic security measures in place to protect PI on all computing devices, e.g. servers, desktop and laptop computers, tablets and smartphones?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F34=Assessment!C82,Database!J34,\" \")=0,\" \",Database!J34)","v":"Reasonable measures include:\nAll computing devices:\nAutomatically activate screensaver locks after 30 minutes for all devices except servers, which should be set to 5 minutes.\n\nTablets & Smartphones:\nEnable any features that:\n● will allow the device to be remotely located in the event of loss or theft\n● automatically erases data if 10 consecutive incorrect passwords are entered\n● will allow data stored on the device to be erased in the event of loss or theft\n\nIn addition, antivirus software and firewalls should be in place, and operating systems should be kept updated.\n\n<<ISS #7: Securing Computing and Mobile Storage Devices/Media>>"},null,null,null,null,29,69,6,{"$f":"INDEX(Range,AP82)","v":"Select an option"},{"$f":"IF(AN82>0, (IF(ISNA(VLOOKUP(AQ82,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ82,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,70]
[null,{"$f":"B82+1","v":24},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P35=\"Yes\",Database!L35=1),Database!F35,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P35=\"Yes\",Database!M35=1),Database!F35,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P35=\"yes\",Database!N35=1),Database!F35,\" \")))))))","v":"Are all devices that contain PI regularly backed up to a secure location (e.g. UBC network drive), and periodically restored to ensure the integrity and availability of the information are intact?\n\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F35=Assessment!C84,Database!J35,\" \")=0,\" \",Database!J35)","v":"The nature and frequency of backups should be determined by considering the risk of losing the data, and the internal and external data retention requirements. If the impact of losing a few hours / days of work is significant, more frequent backups should be taken.\n\nAlso, backups should not be taken to unsecured devices such as unencrypted portable hard drives.\n\nFor further information refer to <<IS Guideline: Backup>>"},null,null,null,null,30,71,6,{"$f":"INDEX(Range,AP84)","v":"Select an option"},{"$f":"IF(AN84>0, (IF(ISNA(VLOOKUP(AQ84,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ84,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,72]
[null,{"$f":"B84+1","v":25},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P36=\"Yes\",Database!L36=1),Database!F36,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P36=\"Yes\",Database!M36=1),Database!F36,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P36=\"yes\",Database!N36=1),Database!F36,\" \")))))))","v":"Are reasonable physical security measures in place to protect all devices containing PI? Note: Personally owned devices used for UBC work purposes must be addressed."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F36=Assessment!C86,Database!J36,\" \")=0,\" \",Database!J36)","v":"Reasonable physical security measures include:\n●  unattended devices (e.g. fax machines, photocopiers, laptops, tablets and smartphones) handling PI are stored in a physically-secured location that is access controlled or locked\n●  servers containing PI are hosted in UBC datacentres\n●  swipe cards are used to restrict access to devices storing PI to authorized individuals"},null,null,null,null,31,73,6,{"$f":"INDEX(Range,AP86)","v":"Select an option"},{"$f":"IF(AN86>0, (IF(ISNA(VLOOKUP(AQ86,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ86,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,74]
[null,"8. Destruction of UBC Electronic Information",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,75]
[null,{"$f":"B86+1","v":26},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P37=\"Yes\",Database!L37=1),Database!F37,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P37=\"Yes\",Database!M37=1),Database!F37,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P37=\"yes\",Database!N37=1),Database!F37,\" \")))))))","v":"Is PI on all devices destroyed prior to the device being discarded or reassigned?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F37=Assessment!C89,Database!J37,\" \")=0,\" \",Database!J37)","v":"All devices should be considered including desktop and laptop computers, tablets, smartphones, USB keys, and portable hard drives.\n\nNote: Personally owned devices used for UBC work purposes must be addressed.\n\nDetails on acceptable destruction methods can be found at:\n<<ISS #8: Destruction of UBC Electronic Information>>"},null,null,null,null,32,76,6,{"$f":"INDEX(Range,AP89)","v":"Select an option"},{"$f":"IF(AN89>0, (IF(ISNA(VLOOKUP(AQ89,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ89,Data!$E$10:$F$18,2,FALSE)))))","v":""},{"$f":"AR89","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,77]
[null,"9. Outsourcing and Service Provider Access",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,78]
[null,{"$f":"B89+1","v":27},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P38=\"Yes\",Database!L38=1),Database!F38,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P38=\"Yes\",Database!M38=1),Database!F38,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P38=\"yes\",Database!N38=1),Database!F38,\" \")))))))","v":"Does your unit perform a service provider security risk assessment before granting a service provider access to UBC information or systems containing PI?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F38=Assessment!C92,Database!J38,\" \")=0,\" \",Database!J38)","v":"Before service providers are granted access to UBC electronic information and systems, information security risks must be assessed and managed using the following checklist: \n<<Service Provider Security Risk Assessment Checklist>>\n\nThe checklist is used to manage key privacy and security risks relating to service providers having access to PI, such as ensuring:\n● service providers agree to comply with all relevant UBC privacy and security requirements;\n● confidentiality agreements are signed;\n● service providers store and transmit PI in a secure manner; and, \n● service providers agree to destroy any of the PI they store locally, at the end of their contract.\n\n<<ISS #9: Outsourcing and Service Provider Access>>\n\n"},null,null,null,null,33,79,6,{"$f":"INDEX(Range,AP92)","v":"Select an option"},{"$f":"IF(AN92>0, (IF(ISNA(VLOOKUP(AQ92,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ92,Data!$E$10:$F$18,2,FALSE)))))","v":""},{"$f":"AR92","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,80]
[null,"11. User Account Management",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,81]
[null,{"$f":"B92+1","v":28},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P39=\"Yes\",Database!L39=1),Database!F39,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P39=\"Yes\",Database!M39=1),Database!F39,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P39=\"yes\",Database!N39=1),Database!F39,\" \")))))))","v":"Does your unit have a formal user account provisioning process, based on the principle of 'least privilege', for systems storing PI? "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F39=Assessment!C95,Database!J39,\" \")=0,\" \",Database!J39)","v":"The principle of “least privilege” is when users are granted the minimum level of access required for their defined job function.\n\nExamples of user accounts: FASmail; Student email; Student Information System (SIS); Financial Management System (FMS); Workspace; Home network drive; Login account (Active Directory or equivalent).\n\nRequests and approvals must be retained for at least one year.\n<<ISS #11:  User Account Management>>"},null,null,null,null,34,82,6,{"$f":"INDEX(Range,AP95)","v":"Select an option"},{"$f":"IF(AN95>0, (IF(ISNA(VLOOKUP(AQ95,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ95,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,83]
[null,{"$f":"B95+1","v":29},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P40=\"Yes\",Database!L40=1),Database!F40,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P40=\"Yes\",Database!M40=1),Database!F40,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P40=\"yes\",Database!N40=1),Database!F40,\" \")))))))","v":"Do employees in your unit have uniquely identifiable user accounts?\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F40=Assessment!C97,Database!J40,\" \")=0,\" \",Database!J40)","v":"Individual user accounts facilitate accountability as all activities can be traced back to a specific account. Therefore, wherever possible, unique user accounts should always be used and they should not be shared with other employees.\n\nPlease indicate in the User Comments field where shared accounts are used and why (except test accounts in the pre-production phase)."},null,null,null,null,35,84,6,{"$f":"INDEX(Range,AP97)","v":"Select an option"},{"$f":"IF(AN97>0, (IF(ISNA(VLOOKUP(AQ97,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ97,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,85]
[null,{"$f":"B97+1","v":30},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P41=\"Yes\",Database!L41=1),Database!F41,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P41=\"Yes\",Database!M41=1),Database!F41,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P41=\"yes\",Database!N41=1),Database!F41,\" \")))))))","v":"Does your unit update user accounts in a timely manner when an employee leaves or changes roles or responsibilities?  "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F41=Assessment!C99,Database!J41,\" \")=0,\" \",Database!J41)","v":"Timely deactivation of user accounts is particularly important when an employee is terminated and / or when the employee has had access to a significant amount of PI. \n\nWhen an employee leaves, all PI, physical access rights, UBC-owned devices, etc. must be returned / deactivated, in a timely manner; they must also delete any UBC Electronic Information stored on their personally-owned devices. "},null,null,null,null,36,86,6,{"$f":"INDEX(Range,AP99)","v":"Select an option"},{"$f":"IF(AN99>0, (IF(ISNA(VLOOKUP(AQ99,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ99,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,87]
[null,{"$f":"B99+1","v":31},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P42=\"Yes\",Database!L42=1),Database!F42,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P42=\"Yes\",Database!M42=1),Database!F42,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P42=\"yes\",Database!N42=1),Database!F42,\" \")))))))","v":"Does your unit periodically review employee access rights to ensure they are aligned with current roles and responsibilities?"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F42=Assessment!C101,Database!J42,\" \")=0,\" \",Database!J42)","v":"The frequency of the review must be risk based (e.g. access rights to High-Risk PI such as bank account information and personal health information, should be reviewed more frequently than access rights to class lists containing student name and class details)."},null,null,null,null,37,88,6,{"$f":"INDEX(Range,AP101)","v":"Select an option"},{"$f":"IF(AN101>0, (IF(ISNA(VLOOKUP(AQ101,Data!$E$10:$F$18,2,FALSE)),\"\",(VLOOKUP(AQ101,Data!$E$10:$F$18,2,FALSE)))))","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,89]
[null,{"$f":"B101+1","v":32},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P43=\"Yes\",Database!L43=1),Database!F43,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P43=\"Yes\",Database!M43=1),Database!F43,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P43=\"yes\",Database!N43=1),Database!F43,\" \")))))))","v":" "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F43=Assessment!C103,Database!J43,\" \")=0,\" \",Database!J43)","v":""},null,null,null,null,38,90,4,{"$f":"INDEX(Responses,AP103)","v":"Select an option"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,91]
[null,{"$f":"B103+1","v":33},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P44=\"Yes\",Database!L44=1),Database!F44,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P44=\"Yes\",Database!M44=1),Database!F44,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P44=\"yes\",Database!N44=1),Database!F44,\" \")))))))","v":" "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F44=Assessment!C105,Database!J44,\" \")=0,\" \",Database!J44)","v":""},null,null,null,null,39,92,6,{"$f":"INDEX(Range,AP105)","v":"Select an option"}]
[null,{"$f":"IF(AND(Database!P48 = \"Yes\", Database!L48 = 1), Database!F48, \" \")","v":" "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,93]
[null,{"$f":"B105+1","v":34},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P45=\"Yes\",Database!L45=1),Database!F45,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P45=\"Yes\",Database!M45=1),Database!F45,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P45=\"yes\",Database!N45=1),Database!F45,\" \")))))))","v":" "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F45=Assessment!C107,Database!J45,\" \")=0,\" \",Database!J45)","v":""},null,null,null,null,40,94,6,{"$f":"INDEX(Range,AP107)","v":"Select an option"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,95]
[null,{"$f":"B107+1","v":35},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P46=\"Yes\",Database!L46=1),Database!F46,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P46=\"Yes\",Database!M46=1),Database!F46,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P46=\"yes\",Database!N46=1),Database!F46,\" \")))))))","v":" "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F46=Assessment!C109,Database!J46,\" \")=0,\" \",Database!J46)","v":""},null,null,null,null,41,96,6,{"$f":"INDEX(Range,AP109)","v":"Select an option"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,97]
[null,{"$f":"B109+1","v":36},{"$f":"IF('Unit Profile'!$AA$33=\"High\",(IF(AND(Database!P47=\"Yes\",Database!L47=1),Database!F47,\" \")),(IF('Unit Profile'!$AA$33=\"Medium\",(IF(AND(Database!P47=\"Yes\",Database!M47=1),Database!F47,\" \")),(IF('Unit Profile'!$AA$33=\"Low\",(IF(AND(Database!P47=\"yes\",Database!N47=1),Database!F47,\" \")))))))","v":" "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(IF(Database!F47=Assessment!C111,Database!J47,\" \")=0,\" \",Database!J47)","v":""},null,null,null,null,42,98,4,{"$f":"INDEX(Responses,AP111)","v":"Select an option"}]

{"sheet":"Summary","index":3,"n_rows":48,"n_cols":25,"rows_kept":48,"cut":false,"hidden":true,"merged":[[9,14,9,15],[9,17,9,20],[47,15,47,17],[45,15,45,17],[43,15,43,17],[29,15,29,17],[33,15,33,17],[31,15,31,17],[41,15,41,17],[39,15,39,17],[37,15,37,17],[35,15,35,17],[27,14,27,18],[17,1,17,20],[15,14,15,15],[15,17,15,20],[11,3,11,7],[13,3,13,7],[15,3,15,7],[13,9,13,12],[15,10,15,11],[9,10,11,11],[9,3,9,7],[3,1,5,20],[7,1,7,2],[7,14,7,15],[7,17,7,20],[7,3,7,7],[7,9,7,12],[13,14,13,15],[13,17,13,20],[21,3,21,11],[23,3,23,11],[25,3,25,11],[27,3,27,11],[19,3,19,11],[19,14,19,19],[21,14,21,18],[23,14,23,18],[25,14,25,18]]}
[]
[]
[]
[null,"Instructions:\n1. Fill in/update the Last Assessment Completed Date.\n2. View the Overall Risk Rating (top right corner, above the View Action Plan button).\n3. View the Risk Rating for each Focus Area (General, Privacy, Paper Security, Electronic Information Security).\n4. View the Risk Rating for each applicable Information Security Standard (click \"Expand EIS Standards\").\n5. If you would like to go back to the Assessment page, click the \"Return to Assessment Tab\" button."]
[]
[]
[]
[null,"Exec Unit",null,{"$f":"IF('Unit Profile'!$C$10=\"\",\"\",'Unit Profile'!$C$10)","v":""},null,null,null,null,null,"Categories of PI"]
[]
[null,"Unit",null,{"$f":"IF('Unit Profile'!$C$12=\"\",\"\",'Unit Profile'!$C$12)","v":""},null,null,null,null,null,null,{"$f":"IF('Unit Profile'!$AB$28=\"\",\"\",'Unit Profile'!$AB$28)","v":""},null,null,null,"Overall Risk Rating",null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(\"Total\",calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,"Sub Unit",null,{"$f":"IF('Unit Profile'!$C$14=\"\",\"\",'Unit Profile'!$C$14)","v":""}]
[]
[null,"Name, Title",null,{"$f":"IF('Unit Profile'!$K$10=\"\",\"\",'Unit Profile'!$K$10)","v":""},null,null,null,null,null,"Scope of Assessment",null,null,null,null,"Assessment Start Date",null,null,{"$f":"IF('Unit Profile'!K14=\"\",\"\",'Unit Profile'!K14)","v":""}]
[]
[null,"Phone, Email",null,{"$f":"IF('Unit Profile'!$K$12=\"\",\"\",'Unit Profile'!$K$12)","v":""},null,null,null,null,null,null,{"$f":"INDEX(Scope,'Unit Profile'!$AA$31)","v":{"$error":"#VALUE!"}},null,null,null,"Last Assessment Completed Date"]
[]
[null,"Survey Results"]
[]
[null,null,null,"Focus Area",null,null,null,null,null,null,null,null,null,null,"Risk Rating"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J9","v":"Low"}]
[null,null,null,"General",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(D22),E22,D22),calc_outputgroup,0))","v":"Incomplete Assessment"},null,null,null,null,null,null,null,null,null,{"$f":"Data!J10","v":"Medium"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J11","v":"High"}]
[null,null,null,"Privacy",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(D24),E24,D24),calc_outputgroup,0))","v":"Incomplete Assessment"},null,null,null,null,null,null,null,null,null,{"$f":"Data!J12","v":"Very high"}]
[]
[null,null,null,"Paper Security",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(D26),E26,D26),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,"Electronic Information Security",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(D28),E28,D28),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,1,"Security Classification of UBC Electronic Information",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E30),F30,E30),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,2,"Password and Passphrase Protection",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E32),F32,E32),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,3,"Transmission and Sharing of UBC Electronic Information",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E34),F34,E34),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,4,"Reporting Information Security Incidents",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E36),F36,E36),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,5,"Encryption Requirements",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E38),F38,E38),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,6,"Working Remotely",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E40),F40,E40),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,7,"Securing Computing and Mobile Storage Devices/ Media",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E42),F42,E42),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,8,"Destruction of UBC Electronic Information",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E44),F44,E44),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,9,"Outsourcing and Service Provider Access",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E46),F46,E46),calc_outputgroup,0))","v":"Incomplete Assessment"}]
[]
[null,null,null,11,"User Account Management",null,null,null,null,null,null,null,null,null,null,{"$f":"INDEX(calc_outputrisklevel,MATCH(IF(ISNUMBER(E48),F48,E48),calc_outputgroup,0))","v":"Incomplete Assessment"}]

{"sheet":"Action Plan","index":4,"n_rows":101,"n_cols":66,"rows_kept":101,"cut":false,"hidden":true,"merged":[[96,53,96,58],[98,53,98,58],[100,53,100,58],[87,53,87,58],[88,53,88,58],[90,53,90,58],[91,53,91,58],[93,53,93,58],[94,53,94,58],[76,53,76,58],[78,53,78,58],[80,53,80,58],[81,53,81,58],[83,53,83,58],[85,53,85,58],[66,53,66,58],[67,53,67,58],[69,53,69,58],[71,53,71,58],[73,53,73,58],[75,53,75,58],[55,53,55,58],[57,53,57,58],[59,53,59,58],[60,53,60,58],[62,53,62,58],[64,53,64,58],[44,53,44,58],[47,53,47,58],[48,53,48,58],[50,53,50,58],[51,53,51,58],[53,53,53,58],[29,53,29,58],[32,53,32,58],[36,53,36,58],[38,53,38,58],[40,53,40,58],[42,53,42,58],[16,53,16,58],[18,53,18,58],[21,53,21,58],[23,53,23,58],[25,53,25,58],[27,53,27,58],[98,39,98,44],[98,46,98,51],[100,39,100,44],[100,46,100,51],[2,55,2,56],[4,55,4,56],[8,55,8,56],[10,55,10,56],[12,53,12,58],[14,53,14,58],[93,39,93,44],[93,46,93,51],[94,39,94,44],[94,46,94,51],[96,39,96,44],[96,46,96,51],[88,39,88,44],[88,46,88,51],[90,39,90,44],[90,46,90,51],[91,39,91,44],[91,46,91,51],[83,39,83,44],[83,46,83,51],[85,39,85,44],[85,46,85,51],[87,39,87,44],[87,46,87,51],[78,39,78,44],[78,46,78,51],[80,39,80,44],[80,46,80,51],[81,39,81,44],[81,46,81,51],[73,39,73,44],[73,46,73,51],[75,39,75,44],[75,46,75,51],[76,39,76,44],[76,46,76,51],[67,39,67,44],[67,46,67,51],[69,39,69,44],[69,46,69,51],[71,39,71,44],[71,46,71,51],[62,39,62,44],[62,46,62,51],[64,39,64,44],[64,46,64,51],[66,39,66,44],[66,46,66,51],[57,39,57,44],[57,46,57,51],[59,39,59,44],[59,46,59,51],[60,39,60,44],[60,46,60,51],[51,39,51,44],[51,46,51,51],[53,39,53,44],[53,46,53,51],[55,39,55,44],[55,46,55,51],[47,39,47,44],[47,46,47,51],[48,39,48,44],[48,46,48,51],[50,39,50,44],[50,46,50,51],[40,39,40,44],[40,46,40,51],[42,39,42,44],[42,46,42,51],[44,39,44,44],[44,46,44,51],[32,39,32,44],[32,46,32,51],[36,39,36,44],[36,46,36,51],[38,39,38,44],[38,46,38,51],[25,46,25,51],[27,39,27,44],[27,46,27,51],[29,39,29,44],[29,46,29,51],[18,39,18,44],[18,46,18,51],[21,39,21,44],[21,46,21,51],[23,39,23,44],[23,46,23,51],[12,39,12,44],[12,46,12,51],[14,39,14,44],[14,46,14,51],[16,39,16,44],[16,46,16,51],[98,32,98,37],[100,32,100,37],[2,41,2,42],[2,48,2,49],[4,41,4,42],[4,48,4,49],[8,41,8,42],[8,48,8,49],[10,41,10,42],[10,48,10,49],[88,32,88,37],[90,32,90,37],[91,32,91,37],[93,32,93,37],[94,32,94,37],[96,32,96,37],[78,32,78,37],[80,32,80,37],[81,32,81,37],[83,32,83,37],[85,32,85,37],[87,32,87,37],[67,32,67,37],[69,32,69,37],[71,32,71,37],[73,32,73,37],[75,32,75,37],[76,32,76,37],[57,32,57,37],[59,32,59,37],[60,32,60,37],[62,32,62,37],[64,32,64,37],[66,32,66,37],[47,32,47,37],[48,32,48,37],[50,32,50,37],[51,32,51,37],[53,32,53,37],[55,32,55,37],[36,32,36,37],[38,32,38,37],[40,32,40,37],[42,32,42,37],[44,32,44,37],[18,32,18,37],[21,32,21,37],[23,32,23,37],[25,32,25,37],[27,32,27,37],[29,32,29,37],[96,25,96,30],[98,25,98,30],[100,25,100,30],[2,34,2,35],[4,34,4,35],[8,34,8,35],[10,34,10,35],[12,32,12,37],[14,32,14,37],[16,32,16,37],[87,25,87,30],[88,25,88,30],[90,25,90,30],[91,25,91,30],[93,25,93,30],[94,25,94,30],[76,25,76,30],[78,25,78,30],[80,25,80,30],[81,25,81,30],[83,25,83,30],[85,25,85,30],[66,25,66,30],[67,25,67,30],[69,25,69,30],[71,25,71,30],[73,25,73,30],[75,25,75,30],[55,25,55,30],[57,25,57,30],[59,25,59,30],[60,25,60,30],[62,25,62,30],[64,25,64,30],[2,27,2,28],[4,27,4,28],[8,27,8,28],[10,27,10,28],[12,25,12,30],[14,25,14,30],[44,25,44,30],[47,25,47,30],[48,25,48,30],[29,25,29,30],[32,25,32,30],[36,25,36,30],[38,25,38,30],[40,25,40,30],[42,25,42,30],[62,2,62,7],[62,9,62,11],[62,13,62,18],[62,20,62,23],[55,2,55,7],[55,9,55,11],[16,25,16,30],[18,25,18,30],[21,25,21,30],[23,25,23,30],[25,25,25,30],[27,25,27,30],[50,25,50,30],[51,25,51,30],[53,25,53,30],[53,9,53,11],[53,13,53,18],[53,20,53,23],[47,13,47,18],[47,20,47,23],[48,2,48,7],[48,9,48,11],[48,13,48,18],[48,20,48,23],[57,13,57,18],[57,20,57,23],[50,9,50,11],[51,2,51,7],[51,9,51,11],[51,13,51,18],[51,20,51,23],[53,2,53,7],[44,3,44,7],[44,9,44,11],[44,13,44,18],[44,20,44,23],[46,20,46,23],[88,20,88,23],[91,2,91,7],[91,9,91,11],[91,13,91,18],[91,20,91,23],[83,2,83,7],[83,9,83,11],[83,13,83,18],[83,20,83,23],[87,13,87,18],[85,9,85,11],[85,13,85,18],[85,20,85,23],[93,13,93,18],[90,13,90,18],[2,2,2,3],[2,4,2,8],[2,10,2,13],[2,15,2,16],[4,4,4,8],[50,13,50,18],[59,13,59,18],[88,2,88,7],[88,9,88,11],[88,13,88,18],[8,15,8,16],[8,18,8,21],[58,2,58,7],[60,2,60,7],[60,9,60,11],[60,13,60,18],[60,20,60,23],[55,13,55,18],[55,20,55,23],[57,2,57,7],[57,9,57,11],[85,2,85,7],[98,2,98,7],[98,9,98,11],[98,13,98,18],[98,20,98,23],[100,2,100,7],[100,9,100,11],[100,13,100,18],[100,20,100,23],[94,2,94,7],[94,9,94,11],[94,13,94,18],[94,20,94,23],[96,2,96,7],[96,9,96,11],[96,13,96,18],[96,20,96,23],[78,2,78,7],[78,9,78,11],[78,13,78,18],[78,20,78,23],[81,2,81,7],[81,9,81,11],[81,13,81,18],[81,20,81,23],[80,13,80,18],[73,2,73,7],[73,9,73,11],[73,13,73,18],[73,20,73,23],[76,2,76,7],[76,9,76,11],[76,13,76,18],[76,20,76,23],[75,13,75,18],[69,2,69,7],[69,9,69,11],[69,13,69,18],[69,20,69,23],[71,2,71,7],[71,9,71,11],[71,13,71,18],[71,20,71,23],[64,2,64,7],[64,9,64,11],[64,13,64,18],[64,20,64,23],[67,2,67,7],[67,9,67,11],[67,13,67,18],[67,20,67,23],[66,13,66,18],[40,9,40,11],[40,13,40,18],[40,20,40,23],[42,3,42,7],[42,9,42,11],[42,13,42,18],[42,20,42,23],[36,3,36,7],[36,9,36,11],[36,13,36,18],[36,20,36,23],[38,3,38,7],[38,9,38,11],[38,13,38,18],[38,20,38,23],[40,3,40,7],[25,2,25,7],[25,9,25,11],[25,13,25,18],[25,20,25,23],[17,39,17,44],[31,20,31,23],[32,2,32,7],[32,9,32,11],[32,13,32,18],[32,20,32,23],[27,2,27,7],[27,9,27,11],[27,13,27,18],[27,20,27,23],[29,2,29,7],[29,9,29,11],[29,13,29,18],[29,20,29,23],[32,32,32,37],[25,39,25,44],[12,2,12,7],[12,9,12,11],[12,13,12,18],[12,20,12,23],[14,2,14,7],[14,9,14,11],[14,13,14,18],[14,20,14,23],[23,2,23,7],[23,9,23,11],[23,13,23,18],[23,20,23,23],[11,5,11,9],[20,20,20,23],[21,2,21,7],[21,9,21,11],[21,13,21,18],[21,20,21,23],[4,11,6,13],[4,15,4,16],[4,18,4,21],[6,4,6,8],[8,4,8,8],[8,10,8,13],[10,4,10,8],[10,11,10,12],[10,15,10,16],[10,18,10,21],[16,3,16,7],[16,9,16,11],[16,13,16,18],[16,20,16,23],[18,2,18,7],[18,9,18,11],[18,13,18,18],[18,20,18,23]]}
[]
[]
[null,null,"Exec Unit",null,{"$f":"Summary!D8","v":""},null,null,null,null,null,"Categories of PI",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J9","v":"Low"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J10","v":"Medium"}]
[null,null,"Unit",null,{"$f":"Summary!D10","v":""},null,null,null,null,null,null,{"$f":"Summary!K10","v":""},null,null,null,"Residual Risk Rating",null,null,{"$f":"Summary!R10","v":"Incomplete Assessment"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J11","v":"High"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J12","v":"Very high"}]
[null,null,"Sub Unit",null,{"$f":"Summary!D12","v":""}]
[]
[null,null,"Name, Title",null,{"$f":"Summary!D14","v":""},null,null,null,null,null,"Scope of Assessment",null,null,null,null,"Assessment    Start Date",null,null,{"$f":"Summary!R14","v":""}]
[]
[null,null,"Phone, Email",null,{"$f":"Summary!D16","v":""},null,null,null,null,null,null,{"$f":"Summary!K16","v":{"$error":"#VALUE!"}},null,null,null,"Assessment Completion Date",null,null,{"$f":"IF(Summary!R16=\"\",\"\",Summary!R16)","v":""}]
[]
[null,"#","Questions",null,null,null,null,null,null,"Responses",null,null,null,"User Comments",null,null,null,null,null,null,"Supplementary Information",null,null,null,null,"Action Plan",null,null,null,null,null,null,"Owner",null,null,null,null,null,null,"Target Completion",null,null,null,null,null,null,"Status",null,null,null,null,null,null,"RMS Comments",null,null,null,null,null,null,null,null,null,null,null,"complete?"]
[null,"GENERAL"]
[null,1,{"$f":"Assessment!C15","v":"Have roles and responsibilities been assigned within your unit for key Privacy and Security tasks? "},null,null,null,null,null,null,{"$f":"IF(Assessment!AQ15=\"\",\"\",Assessment!AQ15)","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N15=\"\",\"\",Assessment!N15)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F6=Assessment!C15, Database!J6, \" \")=0,\" \",Database!J6)","v":"Privacy and Information Security roles and responsibilities should be clearly defined and communicated (e.g. in Job Descriptions), on Unit websites). Roles and responsibilities should be aligned with <<Policy 104: Acceptable Use and Security of UBC Electronic Information and Systems>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN15=\"\",\"\",Assessment!AN15)","v":1},{"$f":"IF(Assessment!AQ15=\"\",\"\",Assessment!AQ15)","v":"Select an option"},{"$f":"C15 & D15","v":"Have roles and responsibilities been assigned within your unit for key Privacy and Security tasks? "},{"$f":"U15","v":"Privacy and Information Security roles and responsibilities should be clearly defined and communicated (e.g. in Job Descriptions), on Unit websites). Roles and responsibilities should be aligned with <<Policy 104: Acceptable Use and Security of UBC Electronic Information and Systems>>"},{"$f":"IF(Assessment!AR15=\"\",\"\",Assessment!AR15)","v":""},{"$f":"IF(AND(C15=\"\",B15<>\"\"),0,IF(OR(AND(BI15=\"\",BN14=0),AND(BI15<>\"\",OR(BM15>1,BM15=\"\"))),0,1))","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!N16=\"\",\"\",Assessment!N16)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN16=\"\",\"\",Assessment!AN16)","v":""},{"$f":"IF(Assessment!AQ16=\"\",\"\",Assessment!AQ16)","v":""},{"$f":"C16 & D16","v":""},{"$f":"U16","v":0},{"$f":"IF(Assessment!AR16=\"\",\"\",Assessment!AR16)","v":""},{"$f":"IF(AND(C16=\"\",B16<>\"\"),0,IF(OR(AND(BI16=\"\",BN15=0),AND(BI16<>\"\",OR(BM16>1,BM16=\"\"))),0,1))","v":0}]
[null,null,{"$f":"Assessment!C17","v":1.1000000000000001},{"$f":"Assessment!D17","v":"Do employees know who to contact within their unit for Privacy and Security matters?"},null,null,null,null,null,{"$f":"IF(Assessment!AQ17=\"\",\"\",Assessment!AQ17)","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N17=\"\",\"\",Assessment!N17)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F7=Assessment!D17, Database!J7, \" \")=0,\" \",Database!J7)","v":"Users must immediately report all suspected information security incidents as follows:\n●  to Information Security at security@ubc.ca or via phone to the IT Service Centre at 604-822-6141. Information Security will coordinate the incident as required in accordance with the UBC Incident Response Plan;\n●  to their supervisor and University IT Support Staff who are assigned to their unit; and\n●  where the incident involves physical security issues on a UBC campus, in addition to information security issues, to Campus Security.\n\nFor further information refer to <<ISS #4:  Reporting Information Security Incidents>>\n\nFor all other security matters, employees should contact the employee in their unit with responsibility for information security."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN17=\"\",\"\",Assessment!AN17)","v":2},{"$f":"IF(Assessment!AQ17=\"\",\"\",Assessment!AQ17)","v":"Select an option"},"1.1Do employees know who to contact within their unit for Privacy and Security matters?","Users must immediately report all suspected information security incidents as follows:\n●  to Information Security at security@ubc.ca or via phone to the IT Service Centre at 604-822-6141. Information Security will coordinate the incident as required in accordance with the UBC Incident Response Plan;\n●  to their supervisor and University IT Support Staff who are assigned to their unit; and\n●  where the incident involves physical security issues on a UBC campus, in addition to information security issues, to Campus Security.\n\nFor further information refer to <<ISS #4:  Reporting Information Security Incidents>>\n\nFor all other security matters, employees should contact the employee in their unit with responsibility for information security.",{"$f":"IF(Assessment!AR17=\"\",\"\",Assessment!AR17)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN18=\"\",\"\",Assessment!AN18)","v":""},{"$f":"IF(Assessment!AQ18=\"\",\"\",Assessment!AQ18)","v":""},"",0,{"$f":"IF(Assessment!AR18=\"\",\"\",Assessment!AR18)","v":""},0]
[null,{"$f":"B15+1","v":2},{"$f":"Assessment!C19","v":"Have all employees working with PI been made aware of the University's Information Security Standards, and fact sheets on privacy and paper-based security, which outline how PI must be collected, used and disclosed?"},null,null,null,null,null,null,{"$f":"IF(Assessment!AQ19=\"\",\"\",Assessment!AQ19)","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N19=\"\",\"\",Assessment!N19)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F8=Assessment!C19, Database!J8, \" \")=0,\" \",Database!J8)","v":"<<Information Security Standards>>\n\n<<Privacy Fact Sheets>>\n\n<<Information Security Fact Sheet: Security of Paper Records>>\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN19=\"\",\"\",Assessment!AN19)","v":3},{"$f":"IF(Assessment!AQ19=\"\",\"\",Assessment!AQ19)","v":"Select an option"},"Have all employees working with PI been made aware of the University's Information Security Standards, and fact sheets on privacy and paper-based security, which outline how PI must be collected, used and disclosed?","<<Information Security Standards>>\n\n<<Privacy Fact Sheets>>\n\n<<Information Security Fact Sheet: Security of Paper Records>>\n",{"$f":"IF(Assessment!AR19=\"\",\"\",Assessment!AR19)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN20=\"\",\"\",Assessment!AN20)","v":""},{"$f":"IF(Assessment!AQ20=\"\",\"\",Assessment!AQ20)","v":""},"",0,{"$f":"IF(Assessment!AR20=\"\",\"\",Assessment!AR20)","v":""},0]
[null,"PRIVACY",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN21=\"\",\"\",Assessment!AN21)","v":""},{"$f":"IF(Assessment!AQ21=\"\",\"\",Assessment!AQ21)","v":""},"",0,{"$f":"IF(Assessment!AR21=\"\",\"\",Assessment!AR21)","v":""},0]
[null,{"$f":"B19+1","v":3},{"$f":"Assessment!C22","v":"Is PI only collected when it is necessary for an operating program or activity of UBC?"},null,null,null,null,null,null,{"$f":"Assessment!AQ22","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N22=\"\",\"\",Assessment!N22)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F9=Assessment!C22, Database!J9, \" \")=0,\" \",Database!J9)","v":"<<Privacy Fact Sheet: Collecting PI>>\n\nThe collection is “necessary” if the information is essential for the effective operation of the program or activity, and there are no reasonable alternatives to the collection.\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN22=\"\",\"\",Assessment!AN22)","v":4},{"$f":"IF(Assessment!AQ22=\"\",\"\",Assessment!AQ22)","v":"Select an option"},"Is PI only collected when it is necessary for an operating program or activity of UBC?","<<Privacy Fact Sheet: Collecting PI>>\n\nThe collection is “necessary” if the information is essential for the effective operation of the program or activity, and there are no reasonable alternatives to the collection.\n",{"$f":"IF(Assessment!AR22=\"\",\"\",Assessment!AR22)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN23=\"\",\"\",Assessment!AN23)","v":""},{"$f":"IF(Assessment!AQ23=\"\",\"\",Assessment!AQ23)","v":""},"",0,{"$f":"IF(Assessment!AR23=\"\",\"\",Assessment!AR23)","v":""},0]
[null,{"$f":"B22+1","v":4},{"$f":"Assessment!C24","v":"Is a privacy notification provided whenever PI is collected from an individual?"},null,null,null,null,null,null,{"$f":"Assessment!AQ24","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N24=\"\",\"\",Assessment!N24)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F10=Assessment!C24, Database!J10, \" \")=0,\" \",Database!J10)","v":"<<Privacy Fact Sheet: Collecting PI>>\n\nSample Privacy Notification: “Your personal information is collected under the authority of section 26(c) of the Freedom of Information and Protection of Privacy Act (FIPPA). This information will be used for the purpose of evaluating your application for admission to UBC. Questions about the collection of this information may be directed to admissions@ubc.ca.”\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN24=\"\",\"\",Assessment!AN24)","v":5},{"$f":"IF(Assessment!AQ24=\"\",\"\",Assessment!AQ24)","v":"Select an option"},"Is a privacy notification provided whenever PI is collected from an individual?","<<Privacy Fact Sheet: Collecting PI>>\n\nSample Privacy Notification: “Your personal information is collected under the authority of section 26(c) of the Freedom of Information and Protection of Privacy Act (FIPPA). This information will be used for the purpose of evaluating your application for admission to UBC. Questions about the collection of this information may be directed to admissions@ubc.ca.”\n",{"$f":"IF(Assessment!AR24=\"\",\"\",Assessment!AR24)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN25=\"\",\"\",Assessment!AN25)","v":""},{"$f":"IF(Assessment!AQ25=\"\",\"\",Assessment!AQ25)","v":""},"",0,{"$f":"IF(Assessment!AR25=\"\",\"\",Assessment!AR25)","v":""},0]
[null,{"$f":"B24+1","v":5},{"$f":"Assessment!C26","v":"Is the consent of affected individuals secured before you store or make their PI accessible outside Canada?"},null,null,null,null,null,null,{"$f":"Assessment!AQ26","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N26=\"\",\"\",Assessment!N26)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F11=Assessment!C26, Database!J11, \" \")=0,\" \",Database!J11)","v":"<<Privacy Fact Sheet: Disclosing PI Outside Canada>>\n\nGenerally, UBC cannot allow personal information to be stored or accessed outside Canada without the written consent of the individual the personal information is about.\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN26=\"\",\"\",Assessment!AN26)","v":6},{"$f":"IF(Assessment!AQ26=\"\",\"\",Assessment!AQ26)","v":"Select an option"},"Is the consent of affected individuals secured before you store or make their PI accessible outside Canada?","<<Privacy Fact Sheet: Disclosing PI Outside Canada>>\n\nGenerally, UBC cannot allow personal information to be stored or accessed outside Canada without the written consent of the individual the personal information is about.\n",{"$f":"IF(Assessment!AR26=\"\",\"\",Assessment!AR26)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN27=\"\",\"\",Assessment!AN27)","v":""},{"$f":"IF(Assessment!AQ27=\"\",\"\",Assessment!AQ27)","v":""},"",0,{"$f":"IF(Assessment!AR27=\"\",\"\",Assessment!AR27)","v":""},0]
[null,{"$f":"B26+1","v":6},{"$f":"Assessment!C28","v":"Is PI only used for the purpose it was collected, or for a consistent purpose?"},null,null,null,null,null,null,{"$f":"Assessment!AQ28","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N28=\"\",\"\",Assessment!N28)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F12=Assessment!C28, Database!J12, \" \")=0,\" \",Database!J12)","v":"PI must be used either for the purpose it was collected, or a consistent purpose. A “consistent purpose” is one that (a) has a reasonable and direct connection to the purpose, and (b) is necessary for performing an operating program or activity of UBC."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN28=\"\",\"\",Assessment!AN28)","v":7},{"$f":"IF(Assessment!AQ28=\"\",\"\",Assessment!AQ28)","v":"Select an option"},"Is PI only used for the purpose it was collected, or for a consistent purpose?","PI must be used either for the purpose it was collected, or a consistent purpose. A “consistent purpose” is one that (a) has a reasonable and direct connection to the purpose, and (b) is necessary for performing an operating program or activity of UBC.",{"$f":"IF(Assessment!AR28=\"\",\"\",Assessment!AR28)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN29=\"\",\"\",Assessment!AN29)","v":""},{"$f":"IF(Assessment!AQ29=\"\",\"\",Assessment!AQ29)","v":""},"",0,{"$f":"IF(Assessment!AR29=\"\",\"\",Assessment!AR29)","v":""},0]
[null,{"$f":"B28+1","v":7},{"$f":"Assessment!C30","v":"Is paper-based and electronic PI only disclosed to UBC employees and contractors on a need-to-know basis? "},null,null,null,null,null,null,{"$f":"Assessment!AQ30","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N30=\"\",\"\",Assessment!N30)","v":""},null,null,null,null,null,null,{"$f":"IF(Database!F13=Assessment!C30, Database!J13, \" \")","v":"Employees and contractors are authorized to view PI when this is necessary for the performance of their duties (the 'need-to-know' principle).\n\nA 'need-to-know' basis in this context is when their role at UBC requires them to have access to perform their duties."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN30=\"\",\"\",Assessment!AN30)","v":8},{"$f":"IF(Assessment!AQ30=\"\",\"\",Assessment!AQ30)","v":"Select an option"},"Is paper-based and electronic PI only disclosed to UBC employees and contractors on a need-to-know basis? ","Employees and contractors are authorized to view PI when this is necessary for the performance of their duties (the 'need-to-know' principle).\n\nA 'need-to-know' basis in this context is when their role at UBC requires them to have access to perform their duties.",{"$f":"IF(Assessment!AR30=\"\",\"\",Assessment!AR30)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN31=\"\",\"\",Assessment!AN31)","v":""},{"$f":"IF(Assessment!AQ31=\"\",\"\",Assessment!AQ31)","v":""},"",0,{"$f":"IF(Assessment!AR31=\"\",\"\",Assessment!AR31)","v":""},0]
[null,"PAPER SECURITY",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN32=\"\",\"\",Assessment!AN32)","v":""},{"$f":"IF(Assessment!AQ32=\"\",\"\",Assessment!AQ32)","v":""},"",0,{"$f":"IF(Assessment!AR32=\"\",\"\",Assessment!AR32)","v":""},0]
[null,{"$f":"B30+1","v":8},{"$f":"Assessment!C33","v":"Which of the following types of paper-based PI is handled in your unit?\n"},null,null,null,null,null,null,{"$f":"INDEX(PIOptions_shadow,Assessment!AP33)","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N33=\"\",\"\",Assessment!N33)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F14=Assessment!C33, Database!J14, \" \")=0,\" \",Database!J14)","v":"High-Risk PI includes: Social Insurance Number, Date of Birth, Bank Account Details, Passport ID, Personal Health Information, Biometric Data)  Note: Biometric data, e.g. fingerprint and retina scanning, is used to uniquely identify people. \n\nOther PI includes PI that is not identified in the above paragraph such as student names, class lists, donor names, employee home address."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN33=\"\",\"\",Assessment!AN33)","v":9},{"$f":"IF(Assessment!AQ33=\"\",\"\",Assessment!AQ33)","v":"Select an option"},"Which of the following types of paper-based PI is handled in your unit?\n","High-Risk PI includes: Social Insurance Number, Date of Birth, Bank Account Details, Passport ID, Personal Health Information, Biometric Data)  Note: Biometric data, e.g. fingerprint and retina scanning, is used to uniquely identify people. \n\nOther PI includes PI that is not identified in the above paragraph such as student names, class lists, donor names, employee home address.",{"$f":"IF(Assessment!AR33=\"\",\"\",Assessment!AR33)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN34=\"\",\"\",Assessment!AN34)","v":""},{"$f":"IF(Assessment!AQ34=\"\",\"\",Assessment!AQ34)","v":""},"",0,{"$f":"IF(Assessment!AR34=\"\",\"\",Assessment!AR34)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN35=\"\",\"\",Assessment!AN35)","v":""},{"$f":"IF(Assessment!AQ35=\"\",\"\",Assessment!AQ35)","v":""},"",0,{"$f":"IF(Assessment!AR35=\"\",\"\",Assessment!AR35)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN36=\"\",\"\",Assessment!AN36)","v":""},{"$f":"IF(Assessment!AQ36=\"\",\"\",Assessment!AQ36)","v":""},"",0,{"$f":"IF(Assessment!AR36=\"\",\"\",Assessment!AR36)","v":""},0]
[null,null,{"$f":"Assessment!C37","v":8.1},{"$f":"Assessment!D37","v":"Is paper-based PI  secured as per the Security of Paper Records Fact Sheet?"},null,null,null,null,null,{"$f":"Assessment!AQ37","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N37=\"\",\"\",Assessment!N37)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F15 = Assessment!D37, Database!J15, \" \")=0,\" \",Database!J15)","v":"<<Information Security Fact Sheet: Security of Paper Records>>\n\nSecurity measure needs to be applied across the complete lifecycle of a record which includes collection, storage, transmission, and disposition / destruction."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN37=\"\",\"\",Assessment!AN37)","v":10},{"$f":"IF(Assessment!AQ37=\"\",\"\",Assessment!AQ37)","v":"Select an option"},"8.1Is paper-based PI  secured as per the Security of Paper Records Fact Sheet?","<<Information Security Fact Sheet: Security of Paper Records>>\n\nSecurity measure needs to be applied across the complete lifecycle of a record which includes collection, storage, transmission, and disposition / destruction.",{"$f":"IF(Assessment!AR37=\"\",\"\",Assessment!AR37)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN38=\"\",\"\",Assessment!AN38)","v":""},{"$f":"IF(Assessment!AQ38=\"\",\"\",Assessment!AQ38)","v":""},"",0,{"$f":"IF(Assessment!AR38=\"\",\"\",Assessment!AR38)","v":""},0]
[null,null,{"$f":"Assessment!C39","v":8.1999999999999993},{"$f":"Assessment!D39","v":"Are reasonable measures in place to secure High-Risk paper-based PI?\nRefer to Supplementary Information for guidance on 'reasonable measures'.\n\n"},null,null,null,null,null,{"$f":"Assessment!AQ39","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N39=\"\",\"\",Assessment!N39)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F16 = Assessment!D39, Database!J16, \" \")=0,\" \",Database!J16)","v":"<<Information Security Fact Sheet: Security of Paper Records>>\n\nOwing to the significant volume of paper-based records that are handled by the University, it is not possible, nor required, to protect all records to the same extent. The University follows a risk-based approach, where the overall aim is to implement a reasonable level of control, taking into account the probability and impact of a security breach. More extensive safeguards are required for High-Risk PI, particularly in larger volumes.  \n\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN39=\"\",\"\",Assessment!AN39)","v":11},{"$f":"IF(Assessment!AQ39=\"\",\"\",Assessment!AQ39)","v":"Select an option"},"8.2Are reasonable measures in place to secure High-Risk paper-based PI?\nRefer to Supplementary Information for guidance on 'reasonable measures'.\n\n","<<Information Security Fact Sheet: Security of Paper Records>>\n\nOwing to the significant volume of paper-based records that are handled by the University, it is not possible, nor required, to protect all records to the same extent. The University follows a risk-based approach, where the overall aim is to implement a reasonable level of control, taking into account the probability and impact of a security breach. More extensive safeguards are required for High-Risk PI, particularly in larger volumes.  \n\n",{"$f":"IF(Assessment!AR39=\"\",\"\",Assessment!AR39)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN40=\"\",\"\",Assessment!AN40)","v":""},{"$f":"IF(Assessment!AQ40=\"\",\"\",Assessment!AQ40)","v":""},"",0,{"$f":"IF(Assessment!AR40=\"\",\"\",Assessment!AR40)","v":""},0]
[null,null,{"$f":"Assessment!C41","v":8.2999999999999989},{"$f":"Assessment!D41","v":"Are large volumes of High-Risk paper-based PI sent using the secure delivery service provided by Campus Mail or some other secure transmission method?"},null,null,null,null,null,{"$f":"Assessment!AQ41","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N41=\"\",\"\",Assessment!N41)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F17 = Assessment!D41, Database!J17, \" \")=0,\" \",Database!J17)","v":"Examples include T4s, transcripts, medical records, appointment and benefit enrolment forms. "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN41=\"\",\"\",Assessment!AN41)","v":12},{"$f":"IF(Assessment!AQ41=\"\",\"\",Assessment!AQ41)","v":"Select an option"},"8.3Are large volumes of High-Risk paper-based PI sent using the secure delivery service provided by Campus Mail or some other secure transmission method?","Examples include T4s, transcripts, medical records, appointment and benefit enrolment forms. ",{"$f":"IF(Assessment!AR41=\"\",\"\",Assessment!AR41)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN42=\"\",\"\",Assessment!AN42)","v":""},{"$f":"IF(Assessment!AQ42=\"\",\"\",Assessment!AQ42)","v":""},"",0,{"$f":"IF(Assessment!AR42=\"\",\"\",Assessment!AR42)","v":""},0]
[null,null,{"$f":"Assessment!C43","v":8.3999999999999986},{"$f":"Assessment!D43","v":"Is a formal record retention schedule in operation to ensure High-Risk paper-based PI records are archived / destroyed when no longer required?"},null,null,null,null,null,{"$f":"Assessment!AQ43","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N43=\"\",\"\",Assessment!N43)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F18 = Assessment!D43, Database!J18, \" \")=0,\" \",Database!J18)","v":"Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>\n\nThe FIPPA requires that PI must be retained for at least one year after it is used to make a decision that affects the individual.  In addition, other relevant UBC and external retention requirements need to be considered."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN43=\"\",\"\",Assessment!AN43)","v":13},{"$f":"IF(Assessment!AQ43=\"\",\"\",Assessment!AQ43)","v":"Select an option"},"8.4Is a formal record retention schedule in operation to ensure High-Risk paper-based PI records are archived / destroyed when no longer required?","Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>\n\nThe FIPPA requires that PI must be retained for at least one year after it is used to make a decision that affects the individual.  In addition, other relevant UBC and external retention requirements need to be considered.",{"$f":"IF(Assessment!AR43=\"\",\"\",Assessment!AR43)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN44=\"\",\"\",Assessment!AN44)","v":""},{"$f":"IF(Assessment!AQ44=\"\",\"\",Assessment!AQ44)","v":""},"",0,{"$f":"IF(Assessment!AR44=\"\",\"\",Assessment!AR44)","v":""},0]
[null,null,{"$f":"Assessment!C45","v":8.4999999999999982},{"$f":"Assessment!D45","v":"Is High-Risk paper-based PI securely destroyed (e.g. by cross-shredding or incineration)?\n\n"},null,null,null,null,null,{"$f":"Assessment!AQ45","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N45=\"\",\"\",Assessment!N45)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F19 = Assessment!D45, Database!J19, \" \")=0,\" \",Database!J19)","v":"Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN45=\"\",\"\",Assessment!AN45)","v":14},{"$f":"IF(Assessment!AQ45=\"\",\"\",Assessment!AQ45)","v":"Select an option"},"8.5Is High-Risk paper-based PI securely destroyed (e.g. by cross-shredding or incineration)?\n\n","Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>",{"$f":"IF(Assessment!AR45=\"\",\"\",Assessment!AR45)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN46=\"\",\"\",Assessment!AN46)","v":""},{"$f":"IF(Assessment!AQ46=\"\",\"\",Assessment!AQ46)","v":""},"",0,{"$f":"IF(Assessment!AR46=\"\",\"\",Assessment!AR46)","v":""},0]
[null,"ELECTRONIC INFORMATION SECURITY",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN47=\"\",\"\",Assessment!AN47)","v":""},{"$f":"IF(Assessment!AQ47=\"\",\"\",Assessment!AQ47)","v":""},"",0,{"$f":"IF(Assessment!AR47=\"\",\"\",Assessment!AR47)","v":""},0]
[null,"1. Security Classification of UBC Electronic Information",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN48=\"\",\"\",Assessment!AN48)","v":""},{"$f":"IF(Assessment!AQ48=\"\",\"\",Assessment!AQ48)","v":""},"",0,{"$f":"IF(Assessment!AR48=\"\",\"\",Assessment!AR48)","v":""},0]
[null,{"$f":"B33+1","v":9},{"$f":"Assessment!C49","v":"Have all electronic repositories containing PI been identified and captured on an inventory for your unit? "},null,null,null,null,null,null,{"$f":"Assessment!AQ49","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N49=\"\",\"\",Assessment!N49)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F20=Assessment!C49,Database!J20,\" \")=0,\" \",Database!J20)","v":"The Administrative Head of Unit is responsible for creating an inventory of all UBC Electronic Information under his/her control and detmining its information security classification.  For a sample PI Inventory Template please contact Risk Management Services."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN49=\"\",\"\",Assessment!AN49)","v":15},{"$f":"IF(Assessment!AQ49=\"\",\"\",Assessment!AQ49)","v":"Select an option"},"Have all electronic repositories containing PI been identified and captured on an inventory for your unit? ","The Administrative Head of Unit is responsible for creating an inventory of all UBC Electronic Information under his/her control and detmining its information security classification.  For a sample PI Inventory Template please contact Risk Management Services.",{"$f":"IF(Assessment!AR49=\"\",\"\",Assessment!AR49)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN50=\"\",\"\",Assessment!AN50)","v":""},{"$f":"IF(Assessment!AQ50=\"\",\"\",Assessment!AQ50)","v":""},"",0,{"$f":"IF(Assessment!AR50=\"\",\"\",Assessment!AR50)","v":""},0]
[null,"2. Password and Passphrase Protection",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN51=\"\",\"\",Assessment!AN51)","v":""},{"$f":"IF(Assessment!AQ51=\"\",\"\",Assessment!AQ51)","v":""},"",0,{"$f":"IF(Assessment!AR51=\"\",\"\",Assessment!AR51)","v":""},0]
[null,{"$f":"B49+1","v":10},{"$f":"Assessment!C52","v":"Do employees use strong passwords/passphrases to access electronic PI? Note: Passwords must contain a minimum of 8 characters including upper and lower case letters, numbers and symbols. Alternatively, use a passphrase with a minimum of 16 characters.\n"},null,null,null,null,null,null,{"$f":"Assessment!AQ52","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N52=\"\",\"\",Assessment!N52)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F21=Assessment!C52,Database!J21,\" \")=0,\" \",Database!J21)","v":"This may include:\n●  mobile computing devices such as laptop computers, smartphones, and tablet computers (including encryption passwords to these devices)\n●  electronic storage media such as CDs, USB memory sticks, and portable hard drives\n●  email systems\n●  software applications\n\nNote:  Strong CWL passwords are automatically enforced however due consideration should be given to all other passwords that are used to access PI.\n\nDetails of passwords/passphrases requirements can be found in <<ISS #2: Password and Passphrase Protection>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN52=\"\",\"\",Assessment!AN52)","v":16},{"$f":"IF(Assessment!AQ52=\"\",\"\",Assessment!AQ52)","v":"Select an option"},"Do employees use strong passwords/passphrases to access electronic PI? Note: Passwords must contain a minimum of 8 characters including upper and lower case letters, numbers and symbols. Alternatively, use a passphrase with a minimum of 16 characters.\n","This may include:\n●  mobile computing devices such as laptop computers, smartphones, and tablet computers (including encryption passwords to these devices)\n●  electronic storage media such as CDs, USB memory sticks, and portable hard drives\n●  email systems\n●  software applications\n\nNote:  Strong CWL passwords are automatically enforced however due consideration should be given to all other passwords that are used to access PI.\n\nDetails of passwords/passphrases requirements can be found in <<ISS #2: Password and Passphrase Protection>>",{"$f":"IF(Assessment!AR52=\"\",\"\",Assessment!AR52)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN53=\"\",\"\",Assessment!AN53)","v":""},{"$f":"IF(Assessment!AQ53=\"\",\"\",Assessment!AQ53)","v":""},"",0,{"$f":"IF(Assessment!AR53=\"\",\"\",Assessment!AR53)","v":""},0]
[null,{"$f":"B52+1","v":11},{"$f":"Assessment!C54","v":"Do employees change their passwords/passphrases annually? Note: Passwords/passphrases must be immediately changed if there are suspicions that they could have been compromised and the incident must be reported to UBC Information Security\n\n "},null,null,null,null,null,null,{"$f":"Assessment!AQ54","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N54=\"\",\"\",Assessment!N54)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F22=Assessment!C54,Database!J22,\" \")=0,\" \",Database!J22)","v":"This requirement must be met regardless of whether it is enforced by the system or not.  However, wherever possible, systems should be configured to enforce annual changes to passwords/passphrases."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN54=\"\",\"\",Assessment!AN54)","v":17},{"$f":"IF(Assessment!AQ54=\"\",\"\",Assessment!AQ54)","v":"Select an option"},"Do employees change their passwords/passphrases annually? Note: Passwords/passphrases must be immediately changed if there are suspicions that they could have been compromised and the incident must be reported to UBC Information Security\n\n ","This requirement must be met regardless of whether it is enforced by the system or not.  However, wherever possible, systems should be configured to enforce annual changes to passwords/passphrases.",{"$f":"IF(Assessment!AR54=\"\",\"\",Assessment!AR54)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN55=\"\",\"\",Assessment!AN55)","v":""},{"$f":"IF(Assessment!AQ55=\"\",\"\",Assessment!AQ55)","v":""},"",0,{"$f":"IF(Assessment!AR55=\"\",\"\",Assessment!AR55)","v":""},0]
[null,{"$f":"B54+1","v":12},{"$f":"Assessment!C56","v":"Are employees prohibited from reusing any of the previous 10 passwords/ passphrases? \n"},null,null,null,null,null,null,{"$f":"Assessment!AQ56","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N56=\"\",\"\",Assessment!N56)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F23=Assessment!C56,Database!J23,\" \")=0,\" \",Database!J23)","v":"This requirement must be met regardless of whether it is enforced by the system or not. However, wherever possible, systems should be configured to prevent the reuse of any of the previous 10 passwords/ passphrases. \n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN56=\"\",\"\",Assessment!AN56)","v":18},{"$f":"IF(Assessment!AQ56=\"\",\"\",Assessment!AQ56)","v":"Select an option"},"Are employees prohibited from reusing any of the previous 10 passwords/ passphrases? \n","This requirement must be met regardless of whether it is enforced by the system or not. However, wherever possible, systems should be configured to prevent the reuse of any of the previous 10 passwords/ passphrases. \n",{"$f":"IF(Assessment!AR56=\"\",\"\",Assessment!AR56)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN57=\"\",\"\",Assessment!AN57)","v":""},{"$f":"IF(Assessment!AQ57=\"\",\"\",Assessment!AQ57)","v":""},"",0,{"$f":"IF(Assessment!AR57=\"\",\"\",Assessment!AR57)","v":""},0]
[null,{"$f":"B56+1","v":13},{"$f":"Assessment!C58","v":"Do employees keep their passwords/passphrases secure once they have been created?\n"},null,null,null,null,null,null,{"$f":"Assessment!AQ58","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N58=\"\",\"\",Assessment!N58)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F24=Assessment!C58,Database!J24,\" \")=0,\" \",Database!J24)","v":"It is preferred that passwords are not written down; however, if it is necessary to do so, the password must be locked away in a secure, inaccessible location such as a safe. If a password safe (an application for securely storing multiple passwords) is to be used, refer to the <<IS Guideline: Password Safes>>\n\nEmployees should be given clear instructions never to provide passwords/passphrases in response to emails or phone call requests for this information. Even if these requests appear to be from a trusted source, they may actually be attempts to steal a user's credentials."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN58=\"\",\"\",Assessment!AN58)","v":19},{"$f":"IF(Assessment!AQ58=\"\",\"\",Assessment!AQ58)","v":"Select an option"},"Do employees keep their passwords/passphrases secure once they have been created?\n","It is preferred that passwords are not written down; however, if it is necessary to do so, the password must be locked away in a secure, inaccessible location such as a safe. If a password safe (an application for securely storing multiple passwords) is to be used, refer to the <<IS Guideline: Password Safes>>\n\nEmployees should be given clear instructions never to provide passwords/passphrases in response to emails or phone call requests for this information. Even if these requests appear to be from a trusted source, they may actually be attempts to steal a user's credentials.",{"$f":"IF(Assessment!AR58=\"\",\"\",Assessment!AR58)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN59=\"\",\"\",Assessment!AN59)","v":""},{"$f":"IF(Assessment!AQ59=\"\",\"\",Assessment!AQ59)","v":""},"",0,{"$f":"IF(Assessment!AR59=\"\",\"\",Assessment!AR59)","v":""},0]
[null,"3. Transmission and Sharing of UBC Electronic Information",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN60=\"\",\"\",Assessment!AN60)","v":""},{"$f":"IF(Assessment!AQ60=\"\",\"\",Assessment!AQ60)","v":""},"",0,{"$f":"IF(Assessment!AR60=\"\",\"\",Assessment!AR60)","v":""},0]
[null,{"$f":"B58+1","v":14},{"$f":"Assessment!C61","v":"Do employees only extract, store, and/or transmit the minimum amount of PI necessary to complete a task? "},null,null,null,null,null,null,{"$f":"Assessment!AQ61","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N61=\"\",\"\",Assessment!N61)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F25=Assessment!C61,Database!J25,\" \")=0,\" \",Database!J25)","v":"Wherever possible, PI should not be extracted from protected systems as the risk of unauthorized access becomes greater. However, it is recognized that, in many instances, tasks cannot be performed without removing PI from the system.  In these instances, do not transmit any information that is not required, to minimize the potential impact if a privacy breach occurs. \n\nFor further information refer to <<ISS #3:  Transmission and Sharing of UBC Electronic Information>>\n\nIn addition, always ensure PI is stored in a secure location and / or transmitted in a secure manner.  Details of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN61=\"\",\"\",Assessment!AN61)","v":20},{"$f":"IF(Assessment!AQ61=\"\",\"\",Assessment!AQ61)","v":"Select an option"},"Do employees only extract, store, and/or transmit the minimum amount of PI necessary to complete a task? ","Wherever possible, PI should not be extracted from protected systems as the risk of unauthorized access becomes greater. However, it is recognized that, in many instances, tasks cannot be performed without removing PI from the system.  In these instances, do not transmit any information that is not required, to minimize the potential impact if a privacy breach occurs. \n\nFor further information refer to <<ISS #3:  Transmission and Sharing of UBC Electronic Information>>\n\nIn addition, always ensure PI is stored in a secure location and / or transmitted in a secure manner.  Details of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>",{"$f":"IF(Assessment!AR61=\"\",\"\",Assessment!AR61)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN62=\"\",\"\",Assessment!AN62)","v":""},{"$f":"IF(Assessment!AQ62=\"\",\"\",Assessment!AQ62)","v":""},"",0,{"$f":"IF(Assessment!AR62=\"\",\"\",Assessment!AR62)","v":""},0]
[null,{"$f":"B61+1","v":15},{"$f":"Assessment!C63","v":"Does your unit only use computing services within Canada to store, transmit, or access PI?\n\n\n"},null,null,null,null,null,null,{"$f":"Assessment!AQ63","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N63=\"\",\"\",Assessment!N63)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F26=Assessment!C63,Database!J26,\" \")=0,\" \",Database!J26)","v":"Computing services based outside of Canada (such as Gmail, Dropbox, Hotmail, and Yahoo) are not suitable for transmission or sharing of PI because the British Columbia Freedom of Information and Protection of Privacy Act prohibits UBC from transmitting, storing, or allowing access to PI outside of Canada (this includes backups and temporary storage). Also, these services are generally less secure than UBC-based systems.\n\nDetails of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN63=\"\",\"\",Assessment!AN63)","v":21},{"$f":"IF(Assessment!AQ63=\"\",\"\",Assessment!AQ63)","v":"Select an option"},"Does your unit only use computing services within Canada to store, transmit, or access PI?\n\n\n","Computing services based outside of Canada (such as Gmail, Dropbox, Hotmail, and Yahoo) are not suitable for transmission or sharing of PI because the British Columbia Freedom of Information and Protection of Privacy Act prohibits UBC from transmitting, storing, or allowing access to PI outside of Canada (this includes backups and temporary storage). Also, these services are generally less secure than UBC-based systems.\n\nDetails of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>",{"$f":"IF(Assessment!AR63=\"\",\"\",Assessment!AR63)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN64=\"\",\"\",Assessment!AN64)","v":""},{"$f":"IF(Assessment!AQ64=\"\",\"\",Assessment!AQ64)","v":""},"",0,{"$f":"IF(Assessment!AR64=\"\",\"\",Assessment!AR64)","v":""},0]
[null,{"$f":"B63+1","v":16},{"$f":"Assessment!C65","v":"Is High-Risk PI encrypted, as required in the UBC Encryption Requirements Standard, when employees are sharing the information via email?  "},null,null,null,null,null,null,{"$f":"Assessment!AQ65","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N65=\"\",\"\",Assessment!N65)","v":""},null,null,null,null,null,null,{"$f":"IF(Database!F27=Assessment!C65,Database!J27,\" \")","v":"Wherever possible, more-secure communication / sharing methods should be used for sharing High-Risk PI. Examples include:\n●   placing a document on a shared network drive and sharing the link by email. \n●   using the University's Workspace application, which is a simple, secure, and easy to use file sharing service, hosted within UBC that enables employees to share documents with internal and external parties.\n\nPassword protecting files and / or devices does not provide the same security that encryption provides. The differences are explained here <<ISS #5: Encryption Requirements>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN65=\"\",\"\",Assessment!AN65)","v":22},{"$f":"IF(Assessment!AQ65=\"\",\"\",Assessment!AQ65)","v":"Select an option"},"Is High-Risk PI encrypted, as required in the UBC Encryption Requirements Standard, when employees are sharing the information via email?  ","Wherever possible, more-secure communication / sharing methods should be used for sharing High-Risk PI. Examples include:\n●   placing a document on a shared network drive and sharing the link by email. \n●   using the University's Workspace application, which is a simple, secure, and easy to use file sharing service, hosted within UBC that enables employees to share documents with internal and external parties.\n\nPassword protecting files and / or devices does not provide the same security that encryption provides. The differences are explained here <<ISS #5: Encryption Requirements>>",{"$f":"IF(Assessment!AR65=\"\",\"\",Assessment!AR65)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN66=\"\",\"\",Assessment!AN66)","v":""},{"$f":"IF(Assessment!AQ66=\"\",\"\",Assessment!AQ66)","v":""},"",0,{"$f":"IF(Assessment!AR66=\"\",\"\",Assessment!AR66)","v":""},0]
[null,"5. Encryption Requirements",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN67=\"\",\"\",Assessment!AN67)","v":""},{"$f":"IF(Assessment!AQ67=\"\",\"\",Assessment!AQ67)","v":""},"",0,{"$f":"IF(Assessment!AR67=\"\",\"\",Assessment!AR67)","v":""},0]
[null,{"$f":"B65+1","v":17},{"$f":"Assessment!C68","v":"Do employees store PI on mobile devices? Refer to Supplementary Information for examples of mobile devices.\n\n"},null,null,null,null,null,null,{"$f":"Assessment!AQ68","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N68=\"\",\"\",Assessment!N68)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F28=Assessment!C68,Database!J28,\" \")=0,\" \",Database!J28)","v":"Mobile Devices are any portable computing or data storage devices. These include:\n●  Laptops (a mobile computer small enough to fit on a user's lap);\n●  Mobile computing devices (computing devices smaller than laptops, such as smartphones, tablet computers and PDAs); and \n●  Mobile storage devices / media (portable devices used to store electronic information, such as USB sticks, portable drives, memory cards, CDs, DVDs)\n\nPI should only be stored on mobile devices if more secure alternatives are not feasible, e.g. network drives, file share applications including SharePoint and Workspace."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN68=\"\",\"\",Assessment!AN68)","v":23},{"$f":"IF(Assessment!AQ68=\"\",\"\",Assessment!AQ68)","v":"Select an option"},"Do employees store PI on mobile devices? Refer to Supplementary Information for examples of mobile devices.\n\n","Mobile Devices are any portable computing or data storage devices. These include:\n●  Laptops (a mobile computer small enough to fit on a user's lap);\n●  Mobile computing devices (computing devices smaller than laptops, such as smartphones, tablet computers and PDAs); and \n●  Mobile storage devices / media (portable devices used to store electronic information, such as USB sticks, portable drives, memory cards, CDs, DVDs)\n\nPI should only be stored on mobile devices if more secure alternatives are not feasible, e.g. network drives, file share applications including SharePoint and Workspace.",{"$f":"IF(Assessment!AR68=\"\",\"\",Assessment!AR68)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN69=\"\",\"\",Assessment!AN69)","v":""},{"$f":"IF(Assessment!AQ69=\"\",\"\",Assessment!AQ69)","v":""},"",0,{"$f":"IF(Assessment!AR69=\"\",\"\",Assessment!AR69)","v":""},0]
[null,{"$f":"B68+1","v":18},{"$f":"Assessment!C70","v":"Is encryption enabled on all laptop computers, mobile computing devices, mobile storage devices/media, and High-Risk desktop computers, that contain PI? Note: UBC's minimum encryption standard is AES-128 bit encryption or equivalent.\n\n"},null,null,null,null,null,null,{"$f":"Assessment!AQ70","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N70=\"\",\"\",Assessment!N70)","v":""},null,null,null,null,null,null,{"$f":"IF(Database!F29=Assessment!C70,Database!J29,\" \")","v":"High-Risk desktop computers are those that are at a higher risk of theft due to their location and lack of strong physical security measures, e.g. reception desks, ground floor buildings close to windows / doors. If possible, PI should not be stored locally on the desktop; this will increase the security of the PI and potentially remove the need to encrypt the computer.\n\nFurther details can be found at:  <<ISS #5: Encryption Requirements>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN70=\"\",\"\",Assessment!AN70)","v":24},{"$f":"IF(Assessment!AQ70=\"\",\"\",Assessment!AQ70)","v":"Select an option"},"Is encryption enabled on all laptop computers, mobile computing devices, mobile storage devices/media, and High-Risk desktop computers, that contain PI? Note: UBC's minimum encryption standard is AES-128 bit encryption or equivalent.\n\n","High-Risk desktop computers are those that are at a higher risk of theft due to their location and lack of strong physical security measures, e.g. reception desks, ground floor buildings close to windows / doors. If possible, PI should not be stored locally on the desktop; this will increase the security of the PI and potentially remove the need to encrypt the computer.\n\nFurther details can be found at:  <<ISS #5: Encryption Requirements>>",{"$f":"IF(Assessment!AR70=\"\",\"\",Assessment!AR70)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN71=\"\",\"\",Assessment!AN71)","v":""},{"$f":"IF(Assessment!AQ71=\"\",\"\",Assessment!AQ71)","v":""},"",0,{"$f":"IF(Assessment!AR71=\"\",\"\",Assessment!AR71)","v":""},0]
[null,{"$f":"B70+1","v":19},{"$f":"Assessment!C72","v":"If a device containing PI was lost or stolen, would it be possible to confirm the encryption status?\n"},null,null,null,null,null,null,{"$f":"Assessment!AQ72","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N72=\"\",\"\",Assessment!N72)","v":""},null,null,null,null,null,null,{"$f":"IF(Database!F30=Assessment!C72,Database!J30,\" \")","v":"To meet this requirement, employees must be able to:\n●   ensure that encrypted UBC-owned devices automatically report their encryption status (whenever connected to the UBC network) to validate that encryption was active at the time of loss or theft (UBC’s Encryption Service offers this functionality); or\n●   provide a written confirmation of the encryption status at the time of loss or theft."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN72=\"\",\"\",Assessment!AN72)","v":25},{"$f":"IF(Assessment!AQ72=\"\",\"\",Assessment!AQ72)","v":"Select an option"},"If a device containing PI was lost or stolen, would it be possible to confirm the encryption status?\n","To meet this requirement, employees must be able to:\n●   ensure that encrypted UBC-owned devices automatically report their encryption status (whenever connected to the UBC network) to validate that encryption was active at the time of loss or theft (UBC’s Encryption Service offers this functionality); or\n●   provide a written confirmation of the encryption status at the time of loss or theft.",{"$f":"IF(Assessment!AR72=\"\",\"\",Assessment!AR72)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN73=\"\",\"\",Assessment!AN73)","v":""},{"$f":"IF(Assessment!AQ73=\"\",\"\",Assessment!AQ73)","v":""},"",0,{"$f":"IF(Assessment!AR73=\"\",\"\",Assessment!AR73)","v":""},0]
[null,{"$f":"B72+1","v":20},{"$f":"Assessment!C74","v":"Can your unit recover device encryption passwords if they are forgotten?\n"},null,null,null,null,null,null,{"$f":"Assessment!AQ74","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N74=\"\",\"\",Assessment!N74)","v":""},null,null,null,null,null,null,{"$f":"IF(Database!F31=Assessment!C74,Database!J31,\" \")","v":"If the password (also called a “key”) is forgotten or lost, the data may be unrecoverable. Therefore, it is essential to have a key recovery strategy. Employees can use the University’s central encryption service that includes key escrow, or simply write down the password and store it in a secure location such as a safe."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN74=\"\",\"\",Assessment!AN74)","v":26},{"$f":"IF(Assessment!AQ74=\"\",\"\",Assessment!AQ74)","v":"Select an option"},"Can your unit recover device encryption passwords if they are forgotten?\n","If the password (also called a “key”) is forgotten or lost, the data may be unrecoverable. Therefore, it is essential to have a key recovery strategy. Employees can use the University’s central encryption service that includes key escrow, or simply write down the password and store it in a secure location such as a safe.",{"$f":"IF(Assessment!AR74=\"\",\"\",Assessment!AR74)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN75=\"\",\"\",Assessment!AN75)","v":""},{"$f":"IF(Assessment!AQ75=\"\",\"\",Assessment!AQ75)","v":""},"",0,{"$f":"IF(Assessment!AR75=\"\",\"\",Assessment!AR75)","v":""},0]
[null,"6. Working Remotely",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN76=\"\",\"\",Assessment!AN76)","v":""},{"$f":"IF(Assessment!AQ76=\"\",\"\",Assessment!AQ76)","v":""},"",0,{"$f":"IF(Assessment!AR76=\"\",\"\",Assessment!AR76)","v":""},0]
[null,{"$f":"B74+1","v":21},{"$f":"Assessment!C77","v":"Do employees take reasonable measures to prevent or reduce the possibility of loss or theft of devices used to access PI when working remotely?"},null,null,null,null,null,null,{"$f":"Assessment!AQ77","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N77=\"\",\"\",Assessment!N77)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F32=Assessment!C77,Database!J32,\" \")=0,\" \",Database!J32)","v":"Working remotely means accessing UBC Electronic Information from outside of a UBC campus.\nReasonable measures include:\n●   being aware of others looking over your shoulder at your screen when working in public locations such as coffee shops, aircraft and other public transport; \n●   not leaving mobile devices unattended in a public place, especially well-travelled areas such as airport lounges, and coffee shops; and\n●   keeping devices secured when working from home, e.g. storing them in a physically-secured area and ensuring UBC Electronic Information cannot be accessed by family members.\n\nFor further information refer to: <<ISS #6: Working Remotely>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN77=\"\",\"\",Assessment!AN77)","v":27},{"$f":"IF(Assessment!AQ77=\"\",\"\",Assessment!AQ77)","v":"Select an option"},"Do employees take reasonable measures to prevent or reduce the possibility of loss or theft of devices used to access PI when working remotely?","Working remotely means accessing UBC Electronic Information from outside of a UBC campus.\nReasonable measures include:\n●   being aware of others looking over your shoulder at your screen when working in public locations such as coffee shops, aircraft and other public transport; \n●   not leaving mobile devices unattended in a public place, especially well-travelled areas such as airport lounges, and coffee shops; and\n●   keeping devices secured when working from home, e.g. storing them in a physically-secured area and ensuring UBC Electronic Information cannot be accessed by family members.\n\nFor further information refer to: <<ISS #6: Working Remotely>>",{"$f":"IF(Assessment!AR77=\"\",\"\",Assessment!AR77)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN78=\"\",\"\",Assessment!AN78)","v":""},{"$f":"IF(Assessment!AQ78=\"\",\"\",Assessment!AQ78)","v":""},"",0,{"$f":"IF(Assessment!AR78=\"\",\"\",Assessment!AR78)","v":""},0]
[null,{"$f":"B77+1","v":22},{"$f":"Assessment!C79","v":"Do employees access PI securely when working remotely?"},null,null,null,null,null,null,{"$f":"Assessment!AQ79","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N79=\"\",\"\",Assessment!N79)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F33=Assessment!C79,Database!J33,\" \")=0,\" \",Database!J33)","v":"Secure access methods e.g. Virtual Desktop Interface (VDI) and Virtual Private Network (VPN), should be used wherever possible.  For further information refer to: <<ISS #6: Working Remotely>>\n\nAdditionally, third-party devices, such as kiosks in public libraries, hotels, airports, and cyber cafes, should not be used, and public Wi-Fi networks, such as those in airports, coffee shops, should be used with caution."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN79=\"\",\"\",Assessment!AN79)","v":28},{"$f":"IF(Assessment!AQ79=\"\",\"\",Assessment!AQ79)","v":"Select an option"},"Do employees access PI securely when working remotely?","Secure access methods e.g. Virtual Desktop Interface (VDI) and Virtual Private Network (VPN), should be used wherever possible.  For further information refer to: <<ISS #6: Working Remotely>>\n\nAdditionally, third-party devices, such as kiosks in public libraries, hotels, airports, and cyber cafes, should not be used, and public Wi-Fi networks, such as those in airports, coffee shops, should be used with caution.",{"$f":"IF(Assessment!AR79=\"\",\"\",Assessment!AR79)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN80=\"\",\"\",Assessment!AN80)","v":""},{"$f":"IF(Assessment!AQ80=\"\",\"\",Assessment!AQ80)","v":""},{"$f":"C80 & D80","v":""},{"$f":"U80","v":0},{"$f":"IF(Assessment!AR80=\"\",\"\",Assessment!AR80)","v":""},{"$f":"IF(AND(C80=\"\",B80<>\"\"),0,IF(OR(AND(BI80=\"\",BN79=0),AND(BI80<>\"\",OR(BM80>1,BM80=\"\"))),0,1))","v":0}]
[null,"7. Securing Computing and Mobile Storage Devices/Media",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN81=\"\",\"\",Assessment!AN81)","v":""},{"$f":"IF(Assessment!AQ81=\"\",\"\",Assessment!AQ81)","v":""},"",0,{"$f":"IF(Assessment!AR81=\"\",\"\",Assessment!AR81)","v":""},0]
[null,{"$f":"B79+1","v":23},{"$f":"Assessment!C82","v":"Are reasonable electronic security measures in place to protect PI on all computing devices, e.g. servers, desktop and laptop computers, tablets and smartphones?"},null,null,null,null,null,null,{"$f":"Assessment!AQ82","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N82=\"\",\"\",Assessment!N82)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F34=Assessment!C82,Database!J34,\" \")=0,\" \",Database!J34)","v":"Reasonable measures include:\nAll computing devices:\nAutomatically activate screensaver locks after 30 minutes for all devices except servers, which should be set to 5 minutes.\n\nTablets & Smartphones:\nEnable any features that:\n● will allow the device to be remotely located in the event of loss or theft\n● automatically erases data if 10 consecutive incorrect passwords are entered\n● will allow data stored on the device to be erased in the event of loss or theft\n\nIn addition, antivirus software and firewalls should be in place, and operating systems should be kept updated.\n\n<<ISS #7: Securing Computing and Mobile Storage Devices/Media>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN82=\"\",\"\",Assessment!AN82)","v":29},{"$f":"IF(Assessment!AQ82=\"\",\"\",Assessment!AQ82)","v":"Select an option"},"Are reasonable electronic security measures in place to protect PI on all computing devices, e.g. servers, desktop and laptop computers, tablets and smartphones?","Reasonable measures include:\nAll computing devices:\nAutomatically activate screensaver locks after 30 minutes for all devices except servers, which should be set to 5 minutes.\n\nTablets & Smartphones:\nEnable any features that:\n● will allow the device to be remotely located in the event of loss or theft\n● automatically erases data if 10 consecutive incorrect passwords are entered\n● will allow data stored on the device to be erased in the event of loss or theft\n\nIn addition, antivirus software and firewalls should be in place, and operating systems should be kept updated.\n\n<<ISS #7: Securing Computing and Mobile Storage Devices/Media>>",{"$f":"IF(Assessment!AR82=\"\",\"\",Assessment!AR82)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN83=\"\",\"\",Assessment!AN83)","v":""},{"$f":"IF(Assessment!AQ83=\"\",\"\",Assessment!AQ83)","v":""},"",0,{"$f":"IF(Assessment!AR83=\"\",\"\",Assessment!AR83)","v":""},0]
[null,{"$f":"B82+1","v":24},{"$f":"Assessment!C84","v":"Are all devices that contain PI regularly backed up to a secure location (e.g. UBC network drive), and periodically restored to ensure the integrity and availability of the information are intact?\n\n"},null,null,null,null,null,null,{"$f":"Assessment!AQ84","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N84=\"\",\"\",Assessment!N84)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F35=Assessment!C84,Database!J35,\" \")=0,\" \",Database!J35)","v":"The nature and frequency of backups should be determined by considering the risk of losing the data, and the internal and external data retention requirements. If the impact of losing a few hours / days of work is significant, more frequent backups should be taken.\n\nAlso, backups should not be taken to unsecured devices such as unencrypted portable hard drives.\n\nFor further information refer to <<IS Guideline: Backup>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN84=\"\",\"\",Assessment!AN84)","v":30},{"$f":"IF(Assessment!AQ84=\"\",\"\",Assessment!AQ84)","v":"Select an option"},"Are all devices that contain PI regularly backed up to a secure location (e.g. UBC network drive), and periodically restored to ensure the integrity and availability of the information are intact?\n\n","The nature and frequency of backups should be determined by considering the risk of losing the data, and the internal and external data retention requirements. If the impact of losing a few hours / days of work is significant, more frequent backups should be taken.\n\nAlso, backups should not be taken to unsecured devices such as unencrypted portable hard drives.\n\nFor further information refer to <<IS Guideline: Backup>>",{"$f":"IF(Assessment!AR84=\"\",\"\",Assessment!AR84)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN85=\"\",\"\",Assessment!AN85)","v":""},{"$f":"IF(Assessment!AQ85=\"\",\"\",Assessment!AQ85)","v":""},"",0,{"$f":"IF(Assessment!AR85=\"\",\"\",Assessment!AR85)","v":""},0]
[null,{"$f":"B84+1","v":25},{"$f":"Assessment!C86","v":"Are reasonable physical security measures in place to protect all devices containing PI? Note: Personally owned devices used for UBC work purposes must be addressed."},null,null,null,null,null,null,{"$f":"Assessment!AQ86","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N86=\"\",\"\",Assessment!N86)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F36=Assessment!C86,Database!J36,\" \")=0,\" \",Database!J36)","v":"Reasonable physical security measures include:\n●  unattended devices (e.g. fax machines, photocopiers, laptops, tablets and smartphones) handling PI are stored in a physically-secured location that is access controlled or locked\n●  servers containing PI are hosted in UBC datacentres\n●  swipe cards are used to restrict access to devices storing PI to authorized individuals"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN86=\"\",\"\",Assessment!AN86)","v":31},{"$f":"IF(Assessment!AQ86=\"\",\"\",Assessment!AQ86)","v":"Select an option"},"Are reasonable physical security measures in place to protect all devices containing PI? Note: Personally owned devices used for UBC work purposes must be addressed.","Reasonable physical security measures include:\n●  unattended devices (e.g. fax machines, photocopiers, laptops, tablets and smartphones) handling PI are stored in a physically-secured location that is access controlled or locked\n●  servers containing PI are hosted in UBC datacentres\n●  swipe cards are used to restrict access to devices storing PI to authorized individuals",{"$f":"IF(Assessment!AR86=\"\",\"\",Assessment!AR86)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN87=\"\",\"\",Assessment!AN87)","v":""},{"$f":"IF(Assessment!AQ87=\"\",\"\",Assessment!AQ87)","v":""},"",0,{"$f":"IF(Assessment!AR87=\"\",\"\",Assessment!AR87)","v":""},0]
[null,"8. Destruction of UBC Electronic Information",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN88=\"\",\"\",Assessment!AN88)","v":""},{"$f":"IF(Assessment!AQ88=\"\",\"\",Assessment!AQ88)","v":""},"",0,{"$f":"IF(Assessment!AR88=\"\",\"\",Assessment!AR88)","v":""},0]
[null,{"$f":"B86+1","v":26},{"$f":"Assessment!C89","v":"Is PI on all devices destroyed prior to the device being discarded or reassigned?"},null,null,null,null,null,null,{"$f":"Assessment!AQ89","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N89=\"\",\"\",Assessment!N89)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F37=Assessment!C89,Database!J37,\" \")=0,\" \",Database!J37)","v":"All devices should be considered including desktop and laptop computers, tablets, smartphones, USB keys, and portable hard drives.\n\nNote: Personally owned devices used for UBC work purposes must be addressed.\n\nDetails on acceptable destruction methods can be found at:\n<<ISS #8: Destruction of UBC Electronic Information>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN89=\"\",\"\",Assessment!AN89)","v":32},{"$f":"IF(Assessment!AQ89=\"\",\"\",Assessment!AQ89)","v":"Select an option"},"Is PI on all devices destroyed prior to the device being discarded or reassigned?","All devices should be considered including desktop and laptop computers, tablets, smartphones, USB keys, and portable hard drives.\n\nNote: Personally owned devices used for UBC work purposes must be addressed.\n\nDetails on acceptable destruction methods can be found at:\n<<ISS #8: Destruction of UBC Electronic Information>>",{"$f":"IF(Assessment!AR89=\"\",\"\",Assessment!AR89)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN90=\"\",\"\",Assessment!AN90)","v":""},{"$f":"IF(Assessment!AQ90=\"\",\"\",Assessment!AQ90)","v":""},"",0,{"$f":"IF(Assessment!AR90=\"\",\"\",Assessment!AR90)","v":""},0]
[null,"9. Outsourcing and Service Provider Access",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN91=\"\",\"\",Assessment!AN91)","v":""},{"$f":"IF(Assessment!AQ91=\"\",\"\",Assessment!AQ91)","v":""},"",0,{"$f":"IF(Assessment!AR91=\"\",\"\",Assessment!AR91)","v":""},0]
[null,{"$f":"B89+1","v":27},{"$f":"Assessment!C92","v":"Does your unit perform a service provider security risk assessment before granting a service provider access to UBC information or systems containing PI?"},null,null,null,null,null,null,{"$f":"Assessment!AQ92","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N92=\"\",\"\",Assessment!N92)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F38=Assessment!C92,Database!J38,\" \")=0,\" \",Database!J38)","v":"Before service providers are granted access to UBC electronic information and systems, information security risks must be assessed and managed using the following checklist: \n<<Service Provider Security Risk Assessment Checklist>>\n\nThe checklist is used to manage key privacy and security risks relating to service providers having access to PI, such as ensuring:\n● service providers agree to comply with all relevant UBC privacy and security requirements;\n● confidentiality agreements are signed;\n● service providers store and transmit PI in a secure manner; and, \n● service providers agree to destroy any of the PI they store locally, at the end of their contract.\n\n<<ISS #9: Outsourcing and Service Provider Access>>\n\n"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN92=\"\",\"\",Assessment!AN92)","v":33},{"$f":"IF(Assessment!AQ92=\"\",\"\",Assessment!AQ92)","v":"Select an option"},"Does your unit perform a service provider security risk assessment before granting a service provider access to UBC information or systems containing PI?","Before service providers are granted access to UBC electronic information and systems, information security risks must be assessed and managed using the following checklist: \n<<Service Provider Security Risk Assessment Checklist>>\n\nThe checklist is used to manage key privacy and security risks relating to service providers having access to PI, such as ensuring:\n● service providers agree to comply with all relevant UBC privacy and security requirements;\n● confidentiality agreements are signed;\n● service providers store and transmit PI in a secure manner; and, \n● service providers agree to destroy any of the PI they store locally, at the end of their contract.\n\n<<ISS #9: Outsourcing and Service Provider Access>>\n\n",{"$f":"IF(Assessment!AR92=\"\",\"\",Assessment!AR92)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN93=\"\",\"\",Assessment!AN93)","v":""},{"$f":"IF(Assessment!AQ93=\"\",\"\",Assessment!AQ93)","v":""},"",0,{"$f":"IF(Assessment!AR93=\"\",\"\",Assessment!AR93)","v":""},0]
[null,"11. User Account Management",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN94=\"\",\"\",Assessment!AN94)","v":""},{"$f":"IF(Assessment!AQ94=\"\",\"\",Assessment!AQ94)","v":""},"",0,{"$f":"IF(Assessment!AR94=\"\",\"\",Assessment!AR94)","v":""},0]
[null,{"$f":"B92+1","v":28},{"$f":"Assessment!C95","v":"Does your unit have a formal user account provisioning process, based on the principle of 'least privilege', for systems storing PI? "},null,null,null,null,null,null,{"$f":"Assessment!AQ95","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N95=\"\",\"\",Assessment!N95)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F39=Assessment!C95,Database!J39,\" \")=0,\" \",Database!J39)","v":"The principle of “least privilege” is when users are granted the minimum level of access required for their defined job function.\n\nExamples of user accounts: FASmail; Student email; Student Information System (SIS); Financial Management System (FMS); Workspace; Home network drive; Login account (Active Directory or equivalent).\n\nRequests and approvals must be retained for at least one year.\n<<ISS #11:  User Account Management>>"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN95=\"\",\"\",Assessment!AN95)","v":34},{"$f":"IF(Assessment!AQ95=\"\",\"\",Assessment!AQ95)","v":"Select an option"},"Does your unit have a formal user account provisioning process, based on the principle of 'least privilege', for systems storing PI? ","The principle of “least privilege” is when users are granted the minimum level of access required for their defined job function.\n\nExamples of user accounts: FASmail; Student email; Student Information System (SIS); Financial Management System (FMS); Workspace; Home network drive; Login account (Active Directory or equivalent).\n\nRequests and approvals must be retained for at least one year.\n<<ISS #11:  User Account Management>>",{"$f":"IF(Assessment!AR95=\"\",\"\",Assessment!AR95)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN96=\"\",\"\",Assessment!AN96)","v":""},{"$f":"IF(Assessment!AQ96=\"\",\"\",Assessment!AQ96)","v":""},"",0,{"$f":"IF(Assessment!AR96=\"\",\"\",Assessment!AR96)","v":""},0]
[null,{"$f":"B95+1","v":29},{"$f":"Assessment!C97","v":"Do employees in your unit have uniquely identifiable user accounts?\n"},null,null,null,null,null,null,{"$f":"Assessment!AQ97","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N97=\"\",\"\",Assessment!N97)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F40=Assessment!C97,Database!J40,\" \")=0,\" \",Database!J40)","v":"Individual user accounts facilitate accountability as all activities can be traced back to a specific account. Therefore, wherever possible, unique user accounts should always be used and they should not be shared with other employees.\n\nPlease indicate in the User Comments field where shared accounts are used and why (except test accounts in the pre-production phase)."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN97=\"\",\"\",Assessment!AN97)","v":35},{"$f":"IF(Assessment!AQ97=\"\",\"\",Assessment!AQ97)","v":"Select an option"},"Do employees in your unit have uniquely identifiable user accounts?\n","Individual user accounts facilitate accountability as all activities can be traced back to a specific account. Therefore, wherever possible, unique user accounts should always be used and they should not be shared with other employees.\n\nPlease indicate in the User Comments field where shared accounts are used and why (except test accounts in the pre-production phase).",{"$f":"IF(Assessment!AR97=\"\",\"\",Assessment!AR97)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN98=\"\",\"\",Assessment!AN98)","v":""},{"$f":"IF(Assessment!AQ98=\"\",\"\",Assessment!AQ98)","v":""},"",0,{"$f":"IF(Assessment!AR98=\"\",\"\",Assessment!AR98)","v":""},0]
[null,{"$f":"B97+1","v":30},{"$f":"Assessment!C99","v":"Does your unit update user accounts in a timely manner when an employee leaves or changes roles or responsibilities?  "},null,null,null,null,null,null,{"$f":"Assessment!AQ99","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N99=\"\",\"\",Assessment!N99)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F41=Assessment!C99,Database!J41,\" \")=0,\" \",Database!J41)","v":"Timely deactivation of user accounts is particularly important when an employee is terminated and / or when the employee has had access to a significant amount of PI. \n\nWhen an employee leaves, all PI, physical access rights, UBC-owned devices, etc. must be returned / deactivated, in a timely manner; they must also delete any UBC Electronic Information stored on their personally-owned devices. "},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN99=\"\",\"\",Assessment!AN99)","v":36},{"$f":"IF(Assessment!AQ99=\"\",\"\",Assessment!AQ99)","v":"Select an option"},"Does your unit update user accounts in a timely manner when an employee leaves or changes roles or responsibilities?  ","Timely deactivation of user accounts is particularly important when an employee is terminated and / or when the employee has had access to a significant amount of PI. \n\nWhen an employee leaves, all PI, physical access rights, UBC-owned devices, etc. must be returned / deactivated, in a timely manner; they must also delete any UBC Electronic Information stored on their personally-owned devices. ",{"$f":"IF(Assessment!AR99=\"\",\"\",Assessment!AR99)","v":""},0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN100=\"\",\"\",Assessment!AN100)","v":""},{"$f":"IF(Assessment!AQ100=\"\",\"\",Assessment!AQ100)","v":""},"",0,{"$f":"IF(Assessment!AR100=\"\",\"\",Assessment!AR100)","v":""},0]
[null,{"$f":"B99+1","v":31},{"$f":"Assessment!C101","v":"Does your unit periodically review employee access rights to ensure they are aligned with current roles and responsibilities?"},null,null,null,null,null,null,{"$f":"Assessment!AQ101","v":"Select an option"},null,null,null,{"$f":"IF(Assessment!N101=\"\",\"\",Assessment!N101)","v":""},null,null,null,null,null,null,{"$f":"IF(IF(Database!F42=Assessment!C101,Database!J42,\" \")=0,\" \",Database!J42)","v":"The frequency of the review must be risk based (e.g. access rights to High-Risk PI such as bank account information and personal health information, should be reviewed more frequently than access rights to class lists containing student name and class details)."},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!AN101=\"\",\"\",Assessment!AN101)","v":37},{"$f":"IF(Assessment!AQ101=\"\",\"\",Assessment!AQ101)","v":"Select an option"},"Does your unit periodically review employee access rights to ensure they are aligned with current roles and responsibilities?","The frequency of the review must be risk based (e.g. access rights to High-Risk PI such as bank account information and personal health information, should be reviewed more frequently than access rights to class lists containing student name and class details).",{"$f":"IF(Assessment!AR101=\"\",\"\",Assessment!AR101)","v":""},0]

{"sheet":"Database","index":5,"n_rows":47,"n_cols":16,"rows_kept":47,"cut":false,"hidden":true,"merged":[]}
[]
[null,null,null,null,null,null,null,null,null,null,"Total Count",{"$f":"COUNTIF(L5:L42,1)","v":37},{"$f":"COUNTIF(M5:M42,1)","v":21},12]
[]
[]
[null,"Standard Number /  Name","Question Category","Requirement #","Database ID","RAT Questions","Response Requirements","Supplementary  Information ","COPY THESE AND...","...PASTE VALUES HERE","Design Requirements","High","Medium","Low","Q Type","Operating Environment"]
[null,null,"General",null,1,"Have roles and responsibilities been assigned within your unit for key Privacy and Security tasks? ","Yes / No / Not Sure\n","Privacy and Information Security roles and responsibilities should be clearly defined and communicated (e.g. in Job Descriptions), on Unit websites). Roles and responsibilities should be aligned with http://www.universitycounsel.ubc.ca/files/2013/06/policy104.pdf",{"$f":"replaceURLsWithCodes(H6,Data!K$23:K$330,Data!J$23:J$330)","v":"Privacy and Information Security roles and responsibilities should be clearly defined and communicated (e.g. in Job Descriptions), on Unit websites). Roles and responsibilities should be aligned with <<Policy 104: Acceptable Use and Security of UBC Electronic Information and Systems>>"},"Privacy and Information Security roles and responsibilities should be clearly defined and communicated (e.g. in Job Descriptions), on Unit websites). Roles and responsibilities should be aligned with <<Policy 104: Acceptable Use and Security of UBC Electronic Information and Systems>>","Chris, this is a decision question and also should be rated from a risk perspective.\n\n-If 'yes' is selected then the user should be directed to question 1.1 below.\n\n-If ''no' is select, skip the question below. \n",1,1,null,null,"Yes"]
[null,null,"General",null,1.1000000000000001,"Do employees know who to contact within their unit for Privacy and Security matters?","Yes / No / Not Sure\n","Users must immediately report all suspected information security incidents as follows:\n●  to Information Security at security@ubc.ca or via phone to the IT Service Centre at 604-822-6141. Information Security will coordinate the incident as required in accordance with the UBC Incident Response Plan;\n●  to their supervisor and University IT Support Staff who are assigned to their unit; and\n●  where the incident involves physical security issues on a UBC campus, in addition to information security issues, to Campus Security.\n\nFor further information refer to http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2004%20Reporting%20Information%20Security%20Incidents.pdf\n\nFor all other security matters, employees should contact the employee in their unit with responsibility for information security.",{"$f":"replaceURLsWithCodes(H7,Data!K$23:K$330,Data!J$23:J$330)","v":"Users must immediately report all suspected information security incidents as follows:\n●  to Information Security at security@ubc.ca or via phone to the IT Service Centre at 604-822-6141. Information Security will coordinate the incident as required in accordance with the UBC Incident Response Plan;\n●  to their supervisor and University IT Support Staff who are assigned to their unit; and\n●  where the incident involves physical security issues on a UBC campus, in addition to information security issues, to Campus Security.\n\nFor further information refer to <<ISS #4:  Reporting Information Security Incidents>>\n\nFor all other security matters, employees should contact the employee in their unit with responsibility for information security."},"Users must immediately report all suspected information security incidents as follows:\n●  to Information Security at security@ubc.ca or via phone to the IT Service Centre at 604-822-6141. Information Security will coordinate the incident as required in accordance with the UBC Incident Response Plan;\n●  to their supervisor and University IT Support Staff who are assigned to their unit; and\n●  where the incident involves physical security issues on a UBC campus, in addition to information security issues, to Campus Security.\n\nFor further information refer to <<ISS #4:  Reporting Information Security Incidents>>\n\nFor all other security matters, employees should contact the employee in their unit with responsibility for information security.",null,1,1,null,null,"Yes"]
[null,null,"General",null,2,"Have all employees working with PI been made aware of the University's Information Security Standards, and fact sheets on privacy and paper-based security, which outline how PI must be collected, used and disclosed?","Yes / No / Not Sure\n","http://cio.ubc.ca/security-standards-home/information-security-policy-standards-and-resources\n\nhttp://universitycounsel.ubc.ca/access-and-privacy/privacy/\n\nhttp://www.library.ubc.ca/archives/manuals/SECURITY.pdf\n",{"$f":"replaceURLsWithCodes(H8,Data!K$23:K$330,Data!J$23:J$330)","v":"<<Information Security Standards>>\n\n<<Privacy Fact Sheets>>\n\n<<Information Security Fact Sheet: Security of Paper Records>>\n"},"<<Information Security Standards>>\n\n<<Privacy Fact Sheets>>\n\n<<Information Security Fact Sheet: Security of Paper Records>>\n",null,1,1,1,null,"Yes"]
[null,null,"Privacy",null,3,"Is PI only collected when it is necessary for an operating program or activity of UBC?","Yes / No / Not Sure / N/A","http://universitycounsel.ubc.ca/files/2012/11/Fact-Sheet-Collecting-Personal-Information.pdf\n\nThe collection is “necessary” if the information is essential for the effective operation of the program or activity, and there are no reasonable alternatives to the collection.\n",{"$f":"replaceURLsWithCodes(H9,Data!K$23:K$330,Data!J$23:J$330)","v":"<<Privacy Fact Sheet: Collecting PI>>\n\nThe collection is “necessary” if the information is essential for the effective operation of the program or activity, and there are no reasonable alternatives to the collection.\n"},"<<Privacy Fact Sheet: Collecting PI>>\n\nThe collection is “necessary” if the information is essential for the effective operation of the program or activity, and there are no reasonable alternatives to the collection.\n",null,1,null,null,null,"Yes"]
[null,null,"Privacy",null,4,"Is a privacy notification provided whenever PI is collected from an individual?","Yes / No / Not Sure / N/A","http://universitycounsel.ubc.ca/files/2012/11/Fact-Sheet-Collecting-Personal-Information.pdf\n\nSample Privacy Notification: “Your personal information is collected under the authority of section 26(c) of the Freedom of Information and Protection of Privacy Act (FIPPA). This information will be used for the purpose of evaluating your application for admission to UBC. Questions about the collection of this information may be directed to admissions@ubc.ca.”\n",{"$f":"replaceURLsWithCodes(H10,Data!K$23:K$330,Data!J$23:J$330)","v":"<<Privacy Fact Sheet: Collecting PI>>\n\nSample Privacy Notification: “Your personal information is collected under the authority of section 26(c) of the Freedom of Information and Protection of Privacy Act (FIPPA). This information will be used for the purpose of evaluating your application for admission to UBC. Questions about the collection of this information may be directed to admissions@ubc.ca.”\n"},"<<Privacy Fact Sheet: Collecting PI>>\n\nSample Privacy Notification: “Your personal information is collected under the authority of section 26(c) of the Freedom of Information and Protection of Privacy Act (FIPPA). This information will be used for the purpose of evaluating your application for admission to UBC. Questions about the collection of this information may be directed to admissions@ubc.ca.”\n",null,1,1,null,null,"Yes"]
[null,null,"Privacy",null,5,"Is the consent of affected individuals secured before you store or make their PI accessible outside Canada?","Yes / No / Not Sure / N/A","http://universitycounsel.ubc.ca/files/2014/01/Fact-Sheet-Disclosure-Outside-Canada.pdf\n\nGenerally, UBC cannot allow personal information to be stored or accessed outside Canada without the written consent of the individual the personal information is about.\n",{"$f":"replaceURLsWithCodes(H11,Data!K$23:K$330,Data!J$23:J$330)","v":"<<Privacy Fact Sheet: Disclosing PI Outside Canada>>\n\nGenerally, UBC cannot allow personal information to be stored or accessed outside Canada without the written consent of the individual the personal information is about.\n"},"<<Privacy Fact Sheet: Disclosing PI Outside Canada>>\n\nGenerally, UBC cannot allow personal information to be stored or accessed outside Canada without the written consent of the individual the personal information is about.\n",null,1,1,null,null,"Yes"]
[null,null,"Privacy",null,6,"Is PI only used for the purpose it was collected, or for a consistent purpose?","Yes / No / Not Sure","PI must be used either for the purpose it was collected, or a consistent purpose. A “consistent purpose” is one that (a) has a reasonable and direct connection to the purpose, and (b) is necessary for performing an operating program or activity of UBC.",{"$f":"replaceURLsWithCodes(H12,Data!K$23:K$330,Data!J$23:J$330)","v":"PI must be used either for the purpose it was collected, or a consistent purpose. A “consistent purpose” is one that (a) has a reasonable and direct connection to the purpose, and (b) is necessary for performing an operating program or activity of UBC."},"PI must be used either for the purpose it was collected, or a consistent purpose. A “consistent purpose” is one that (a) has a reasonable and direct connection to the purpose, and (b) is necessary for performing an operating program or activity of UBC.",null,1,null,null,null,"Yes"]
[null,null,"Privacy",null,7,"Is paper-based and electronic PI only disclosed to UBC employees and contractors on a need-to-know basis? ","Yes / No / Not Sure","Employees and contractors are authorized to view PI when this is necessary for the performance of their duties (the 'need-to-know' principle).\n\nA 'need-to-know' basis in this context is when their role at UBC requires them to have access to perform their duties.",{"$f":"replaceURLsWithCodes(H13,Data!K$23:K$330,Data!J$23:J$330)","v":"Employees and contractors are authorized to view PI when this is necessary for the performance of their duties (the 'need-to-know' principle).\n\nA 'need-to-know' basis in this context is when their role at UBC requires them to have access to perform their duties."},"Employees and contractors are authorized to view PI when this is necessary for the performance of their duties (the 'need-to-know' principle).\n\nA 'need-to-know' basis in this context is when their role at UBC requires them to have access to perform their duties.",null,1,null,null,null,"Yes"]
[null,null,"Paper security",null,8,"Which of the following types of paper-based PI is handled in your unit?\n","Select one or more:\nA: None\nB: High-Risk PI (Social Insurance Number, Date of Birth, Bank Account Details, Passport ID, Personal Health Information, Biometric Data) \nC: PI not identified in B above such as student names, class lists, donor names, employee home address . Please provide details in the User Comments field\n\n","High-Risk PI includes: Social Insurance Number, Date of Birth, Bank Account Details, Passport ID, Personal Health Information, Biometric Data)  Note: Biometric data, e.g. fingerprint and retina scanning, is used to uniquely identify people. \n\nOther PI includes PI that is not identified in the above paragraph such as student names, class lists, donor names, employee home address.",{"$f":"replaceURLsWithCodes(H14,Data!K$23:K$330,Data!J$23:J$330)","v":"High-Risk PI includes: Social Insurance Number, Date of Birth, Bank Account Details, Passport ID, Personal Health Information, Biometric Data)  Note: Biometric data, e.g. fingerprint and retina scanning, is used to uniquely identify people. \n\nOther PI includes PI that is not identified in the above paragraph such as student names, class lists, donor names, employee home address."},"High-Risk PI includes: Social Insurance Number, Date of Birth, Bank Account Details, Passport ID, Personal Health Information, Biometric Data)  Note: Biometric data, e.g. fingerprint and retina scanning, is used to uniquely identify people. \n\nOther PI includes PI that is not identified in the above paragraph such as student names, class lists, donor names, employee home address.","Chris, this is a decision question and should not be rated from a risk perspective.\n\n-If 'none' is selected then they have finished with the Paper Security section and should be directed to the Electronic Security section.\n\n-If 'high-risk PI' is selected, send them to the detailed section  on Paper-Security PI (see yellow lines below).\n\n-If 'PI not identified above' is selected (which means lower-risk PI), send them to the general question below - see blue line.\n",1,null,null,null,"Yes"]
[null,null,"Paper security",null,8.1,"Is paper-based PI  secured as per the Security of Paper Records Fact Sheet?","Yes / No / Not Sure","http://www.library.ubc.ca/archives/manuals/SECURITY.pdf\n\nSecurity measure needs to be applied across the complete lifecycle of a record which includes collection, storage, transmission, and disposition / destruction.",{"$f":"replaceURLsWithCodes(H15,Data!K$23:K$330,Data!J$23:J$330)","v":"<<Information Security Fact Sheet: Security of Paper Records>>\n\nSecurity measure needs to be applied across the complete lifecycle of a record which includes collection, storage, transmission, and disposition / destruction."},"<<Information Security Fact Sheet: Security of Paper Records>>\n\nSecurity measure needs to be applied across the complete lifecycle of a record which includes collection, storage, transmission, and disposition / destruction.",null,1,1,1,null,"Yes"]
[null,null,"Paper security",null,8.1999999999999993,"Are reasonable measures in place to secure High-Risk paper-based PI?\nRefer to Supplementary Information for guidance on 'reasonable measures'.\n\n","Yes / No / Not Sure","http://www.library.ubc.ca/archives/manuals/SECURITY.pdf\n\nOwing to the significant volume of paper-based records that are handled by the University, it is not possible, nor required, to protect all records to the same extent. The University follows a risk-based approach, where the overall aim is to implement a reasonable level of control, taking into account the probability and impact of a security breach. More extensive safeguards are required for High-Risk PI, particularly in larger volumes.  \n\n",{"$f":"replaceURLsWithCodes(H16,Data!K$23:K$330,Data!J$23:J$330)","v":"<<Information Security Fact Sheet: Security of Paper Records>>\n\nOwing to the significant volume of paper-based records that are handled by the University, it is not possible, nor required, to protect all records to the same extent. The University follows a risk-based approach, where the overall aim is to implement a reasonable level of control, taking into account the probability and impact of a security breach. More extensive safeguards are required for High-Risk PI, particularly in larger volumes.  \n\n"},"<<Information Security Fact Sheet: Security of Paper Records>>\n\nOwing to the significant volume of paper-based records that are handled by the University, it is not possible, nor required, to protect all records to the same extent. The University follows a risk-based approach, where the overall aim is to implement a reasonable level of control, taking into account the probability and impact of a security breach. More extensive safeguards are required for High-Risk PI, particularly in larger volumes.  \n\n",null,1,null,null,null,"Yes"]
[null,null,"Paper security",null,8.3000000000000007,"Are large volumes of High-Risk paper-based PI sent using the secure delivery service provided by Campus Mail or some other secure transmission method?","Yes / No / Not Sure / N/A","Examples include T4s, transcripts, medical records, appointment and benefit enrolment forms. ",{"$f":"replaceURLsWithCodes(H17,Data!K$23:K$330,Data!J$23:J$330)","v":"Examples include T4s, transcripts, medical records, appointment and benefit enrolment forms. "},"Examples include T4s, transcripts, medical records, appointment and benefit enrolment forms. ",null,1,null,null,null,"Yes"]
[null,null,"Paper security",null,8.4,"Is a formal record retention schedule in operation to ensure High-Risk paper-based PI records are archived / destroyed when no longer required?","Yes / No / Not Sure","Security of Paper Records Fact Sheet: http://www.library.ubc.ca/archives/manuals/SECURITY.pdf\n\nThe FIPPA requires that PI must be retained for at least one year after it is used to make a decision that affects the individual.  In addition, other relevant UBC and external retention requirements need to be considered.",{"$f":"replaceURLsWithCodes(H18,Data!K$23:K$330,Data!J$23:J$330)","v":"Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>\n\nThe FIPPA requires that PI must be retained for at least one year after it is used to make a decision that affects the individual.  In addition, other relevant UBC and external retention requirements need to be considered."},"Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>\n\nThe FIPPA requires that PI must be retained for at least one year after it is used to make a decision that affects the individual.  In addition, other relevant UBC and external retention requirements need to be considered.",null,1,null,null,null,"Yes"]
[null,null,"Paper security",null,8.5,"Is High-Risk paper-based PI securely destroyed (e.g. by cross-shredding or incineration)?\n\n","Yes / No / Not Sure","Security of Paper Records Fact Sheet: http://www.library.ubc.ca/archives/manuals/SECURITY.pdf",{"$f":"replaceURLsWithCodes(H19,Data!K$23:K$330,Data!J$23:J$330)","v":"Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>"},"Security of Paper Records Fact Sheet: <<Information Security Fact Sheet: Security of Paper Records>>",null,1,null,null,null,"Yes"]
[null,"01. Security Classification of UBC Electronic Information","Security Classification of UBC Electronic Information",1.5,9,"Have all electronic repositories containing PI been identified and captured on an inventory for your unit? ","Yes / No / Not Sure / N/A","The Administrative Head of Unit is responsible for creating an inventory of all UBC Electronic Information under his/her control and detmining its information security classification.  For a sample PI Inventory Template please contact Risk Management Services.",{"$f":"replaceURLsWithCodes(H20,Data!K$23:K$330,Data!J$23:J$330)","v":"The Administrative Head of Unit is responsible for creating an inventory of all UBC Electronic Information under his/her control and detmining its information security classification.  For a sample PI Inventory Template please contact Risk Management Services."},"The Administrative Head of Unit is responsible for creating an inventory of all UBC Electronic Information under his/her control and detmining its information security classification.  For a sample PI Inventory Template please contact Risk Management Services.",null,1,1,1,"QR","Yes"]
[null,"02. Password and Passphrase Protection","Password and Passphrase Protection",2.5,10,"Do employees use strong passwords/passphrases to access electronic PI? Note: Passwords must contain a minimum of 8 characters including upper and lower case letters, numbers and symbols. Alternatively, use a passphrase with a minimum of 16 characters.\n","1-5","This may include:\n●  mobile computing devices such as laptop computers, smartphones, and tablet computers (including encryption passwords to these devices)\n●  electronic storage media such as CDs, USB memory sticks, and portable hard drives\n●  email systems\n●  software applications\n\nNote:  Strong CWL passwords are automatically enforced however due consideration should be given to all other passwords that are used to access PI.\n\nDetails of passwords/passphrases requirements can be found in http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2002%20Password%20and%20Passphrase%20Protection.pdf",{"$f":"replaceURLsWithCodes(H21,Data!K$23:K$330,Data!J$23:J$330)","v":"This may include:\n●  mobile computing devices such as laptop computers, smartphones, and tablet computers (including encryption passwords to these devices)\n●  electronic storage media such as CDs, USB memory sticks, and portable hard drives\n●  email systems\n●  software applications\n\nNote:  Strong CWL passwords are automatically enforced however due consideration should be given to all other passwords that are used to access PI.\n\nDetails of passwords/passphrases requirements can be found in <<ISS #2: Password and Passphrase Protection>>"},"This may include:\n●  mobile computing devices such as laptop computers, smartphones, and tablet computers (including encryption passwords to these devices)\n●  electronic storage media such as CDs, USB memory sticks, and portable hard drives\n●  email systems\n●  software applications\n\nNote:  Strong CWL passwords are automatically enforced however due consideration should be given to all other passwords that are used to access PI.\n\nDetails of passwords/passphrases requirements can be found in <<ISS #2: Password and Passphrase Protection>>",null,1,1,1,"QR","Yes"]
[null,"02. Password and Passphrase Protection","Password and Passphrase Protection",2.6,11,"Do employees change their passwords/passphrases annually? Note: Passwords/passphrases must be immediately changed if there are suspicions that they could have been compromised and the incident must be reported to UBC Information Security\n\n ","1-5","This requirement must be met regardless of whether it is enforced by the system or not.  However, wherever possible, systems should be configured to enforce annual changes to passwords/passphrases.",{"$f":"replaceURLsWithCodes(H22,Data!K$23:K$330,Data!J$23:J$330)","v":"This requirement must be met regardless of whether it is enforced by the system or not.  However, wherever possible, systems should be configured to enforce annual changes to passwords/passphrases."},"This requirement must be met regardless of whether it is enforced by the system or not.  However, wherever possible, systems should be configured to enforce annual changes to passwords/passphrases.",null,1,1,null,"QR","Yes"]
[null,"02. Password and Passphrase Protection","Password and Passphrase Protection","2.6a",12,"Are employees prohibited from reusing any of the previous 10 passwords/ passphrases? \n","1-5","This requirement must be met regardless of whether it is enforced by the system or not. However, wherever possible, systems should be configured to prevent the reuse of any of the previous 10 passwords/ passphrases. \n",{"$f":"replaceURLsWithCodes(H23,Data!K$23:K$330,Data!J$23:J$330)","v":"This requirement must be met regardless of whether it is enforced by the system or not. However, wherever possible, systems should be configured to prevent the reuse of any of the previous 10 passwords/ passphrases. \n"},"This requirement must be met regardless of whether it is enforced by the system or not. However, wherever possible, systems should be configured to prevent the reuse of any of the previous 10 passwords/ passphrases. \n",null,1,null,null,"QR","Yes"]
[null,"02. Password and Passphrase Protection","Password and Passphrase Protection",2.7,13,"Do employees keep their passwords/passphrases secure once they have been created?\n","1-5","It is preferred that passwords are not written down; however, if it is necessary to do so, the password must be locked away in a secure, inaccessible location such as a safe. If a password safe (an application for securely storing multiple passwords) is to be used, refer to the http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/resources/Password%20Safe%20Guideline.pdf\n\nEmployees should be given clear instructions never to provide passwords/passphrases in response to emails or phone call requests for this information. Even if these requests appear to be from a trusted source, they may actually be attempts to steal a user's credentials.",{"$f":"replaceURLsWithCodes(H24,Data!K$23:K$330,Data!J$23:J$330)","v":"It is preferred that passwords are not written down; however, if it is necessary to do so, the password must be locked away in a secure, inaccessible location such as a safe. If a password safe (an application for securely storing multiple passwords) is to be used, refer to the <<IS Guideline: Password Safes>>\n\nEmployees should be given clear instructions never to provide passwords/passphrases in response to emails or phone call requests for this information. Even if these requests appear to be from a trusted source, they may actually be attempts to steal a user's credentials."},"It is preferred that passwords are not written down; however, if it is necessary to do so, the password must be locked away in a secure, inaccessible location such as a safe. If a password safe (an application for securely storing multiple passwords) is to be used, refer to the <<IS Guideline: Password Safes>>\n\nEmployees should be given clear instructions never to provide passwords/passphrases in response to emails or phone call requests for this information. Even if these requests appear to be from a trusted source, they may actually be attempts to steal a user's credentials.",null,1,null,null,"QR","Yes"]
[null,"03. Transmission and Sharing of UBC Electronic Information","Transmission and Sharing of UBC Electronic Information","3.4a",14,"Do employees only extract, store, and/or transmit the minimum amount of PI necessary to complete a task? ","1-5","Wherever possible, PI should not be extracted from protected systems as the risk of unauthorized access becomes greater. However, it is recognized that, in many instances, tasks cannot be performed without removing PI from the system.  In these instances, do not transmit any information that is not required, to minimize the potential impact if a privacy breach occurs. \n\nFor further information refer to http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2003%20Transmission%20and%20Sharing%20of%20UBC%20Electronic%20Information.pdf\n\nIn addition, always ensure PI is stored in a secure location and / or transmitted in a secure manner.  Details of recommended secure services can be found at: http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/resources/Information%20Security%20Tools%20Guideline.pdf",{"$f":"replaceURLsWithCodes(H25,Data!K$23:K$330,Data!J$23:J$330)","v":"Wherever possible, PI should not be extracted from protected systems as the risk of unauthorized access becomes greater. However, it is recognized that, in many instances, tasks cannot be performed without removing PI from the system.  In these instances, do not transmit any information that is not required, to minimize the potential impact if a privacy breach occurs. \n\nFor further information refer to <<ISS #3:  Transmission and Sharing of UBC Electronic Information>>\n\nIn addition, always ensure PI is stored in a secure location and / or transmitted in a secure manner.  Details of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>"},"Wherever possible, PI should not be extracted from protected systems as the risk of unauthorized access becomes greater. However, it is recognized that, in many instances, tasks cannot be performed without removing PI from the system.  In these instances, do not transmit any information that is not required, to minimize the potential impact if a privacy breach occurs. \n\nFor further information refer to <<ISS #3:  Transmission and Sharing of UBC Electronic Information>>\n\nIn addition, always ensure PI is stored in a secure location and / or transmitted in a secure manner.  Details of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>",null,1,1,1,"QR","Yes"]
[null,"03. Transmission and Sharing of UBC Electronic Information","Transmission and Sharing of UBC Electronic Information",3.7,15,"Does your unit only use computing services within Canada to store, transmit, or access PI?\n\n\n","1-5","Computing services based outside of Canada (such as Gmail, Dropbox, Hotmail, and Yahoo) are not suitable for transmission or sharing of PI because the British Columbia Freedom of Information and Protection of Privacy Act prohibits UBC from transmitting, storing, or allowing access to PI outside of Canada (this includes backups and temporary storage). Also, these services are generally less secure than UBC-based systems.\n\nDetails of recommended secure services can be found at: http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/resources/Information%20Security%20Tools%20Guideline.pdf",{"$f":"replaceURLsWithCodes(H26,Data!K$23:K$330,Data!J$23:J$330)","v":"Computing services based outside of Canada (such as Gmail, Dropbox, Hotmail, and Yahoo) are not suitable for transmission or sharing of PI because the British Columbia Freedom of Information and Protection of Privacy Act prohibits UBC from transmitting, storing, or allowing access to PI outside of Canada (this includes backups and temporary storage). Also, these services are generally less secure than UBC-based systems.\n\nDetails of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>"},"Computing services based outside of Canada (such as Gmail, Dropbox, Hotmail, and Yahoo) are not suitable for transmission or sharing of PI because the British Columbia Freedom of Information and Protection of Privacy Act prohibits UBC from transmitting, storing, or allowing access to PI outside of Canada (this includes backups and temporary storage). Also, these services are generally less secure than UBC-based systems.\n\nDetails of recommended secure services can be found at: <<IS Guideline: Information Security Tools>>",null,1,1,null,"QR","Yes"]
[null,"03. Transmission and Sharing of UBC Electronic Information","Transmission and Sharing of UBC Electronic Information","3.9a",16,"Is High-Risk PI encrypted, as required in the UBC Encryption Requirements Standard, when employees are sharing the information via email?  ","1-5","Wherever possible, more-secure communication / sharing methods should be used for sharing High-Risk PI. Examples include:\n●   placing a document on a shared network drive and sharing the link by email. \n●   using the University's Workspace application, which is a simple, secure, and easy to use file sharing service, hosted within UBC that enables employees to share documents with internal and external parties.\n\nPassword protecting files and / or devices does not provide the same security that encryption provides. The differences are explained here http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2005%20Encryption%20Requirements.pdf",{"$f":"replaceURLsWithCodes(H27,Data!K$23:K$330,Data!J$23:J$330)","v":"Wherever possible, more-secure communication / sharing methods should be used for sharing High-Risk PI. Examples include:\n●   placing a document on a shared network drive and sharing the link by email. \n●   using the University's Workspace application, which is a simple, secure, and easy to use file sharing service, hosted within UBC that enables employees to share documents with internal and external parties.\n\nPassword protecting files and / or devices does not provide the same security that encryption provides. The differences are explained here <<ISS #5: Encryption Requirements>>"},"Wherever possible, more-secure communication / sharing methods should be used for sharing High-Risk PI. Examples include:\n●   placing a document on a shared network drive and sharing the link by email. \n●   using the University's Workspace application, which is a simple, secure, and easy to use file sharing service, hosted within UBC that enables employees to share documents with internal and external parties.\n\nPassword protecting files and / or devices does not provide the same security that encryption provides. The differences are explained here <<ISS #5: Encryption Requirements>>",null,1,1,null,"QR","Yes"]
[null,"05. Encryption Requirements","Encryption Requirements",5,17,"Do employees store PI on mobile devices? Refer to Supplementary Information for examples of mobile devices.\n\n","Yes / No / Not Sure\n","Mobile Devices are any portable computing or data storage devices. These include:\n●  Laptops (a mobile computer small enough to fit on a user's lap);\n●  Mobile computing devices (computing devices smaller than laptops, such as smartphones, tablet computers and PDAs); and \n●  Mobile storage devices / media (portable devices used to store electronic information, such as USB sticks, portable drives, memory cards, CDs, DVDs)\n\nPI should only be stored on mobile devices if more secure alternatives are not feasible, e.g. network drives, file share applications including SharePoint and Workspace.",{"$f":"replaceURLsWithCodes(H28,Data!K$23:K$330,Data!J$23:J$330)","v":"Mobile Devices are any portable computing or data storage devices. These include:\n●  Laptops (a mobile computer small enough to fit on a user's lap);\n●  Mobile computing devices (computing devices smaller than laptops, such as smartphones, tablet computers and PDAs); and \n●  Mobile storage devices / media (portable devices used to store electronic information, such as USB sticks, portable drives, memory cards, CDs, DVDs)\n\nPI should only be stored on mobile devices if more secure alternatives are not feasible, e.g. network drives, file share applications including SharePoint and Workspace."},"Mobile Devices are any portable computing or data storage devices. These include:\n●  Laptops (a mobile computer small enough to fit on a user's lap);\n●  Mobile computing devices (computing devices smaller than laptops, such as smartphones, tablet computers and PDAs); and \n●  Mobile storage devices / media (portable devices used to store electronic information, such as USB sticks, portable drives, memory cards, CDs, DVDs)\n\nPI should only be stored on mobile devices if more secure alternatives are not feasible, e.g. network drives, file share applications including SharePoint and Workspace.","If the answer is 'no' they should not see any questions relating to PI on mobile devices.\n",1,1,1,"QR","Yes"]
[null,"05. Encryption Requirements","Encryption Requirements","5.6c",18,"Is encryption enabled on all laptop computers, mobile computing devices, mobile storage devices/media, and High-Risk desktop computers, that contain PI? Note: UBC's minimum encryption standard is AES-128 bit encryption or equivalent.\n\n","1-5","High-Risk desktop computers are those that are at a higher risk of theft due to their location and lack of strong physical security measures, e.g. reception desks, ground floor buildings close to windows / doors. If possible, PI should not be stored locally on the desktop; this will increase the security of the PI and potentially remove the need to encrypt the computer.\n\nFurther details can be found at:  http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2005%20Encryption%20Requirements.pdf",{"$f":"replaceURLsWithCodes(H29,Data!K$23:K$330,Data!J$23:J$330)","v":"High-Risk desktop computers are those that are at a higher risk of theft due to their location and lack of strong physical security measures, e.g. reception desks, ground floor buildings close to windows / doors. If possible, PI should not be stored locally on the desktop; this will increase the security of the PI and potentially remove the need to encrypt the computer.\n\nFurther details can be found at:  <<ISS #5: Encryption Requirements>>"},"High-Risk desktop computers are those that are at a higher risk of theft due to their location and lack of strong physical security measures, e.g. reception desks, ground floor buildings close to windows / doors. If possible, PI should not be stored locally on the desktop; this will increase the security of the PI and potentially remove the need to encrypt the computer.\n\nFurther details can be found at:  <<ISS #5: Encryption Requirements>>",null,1,1,1,"QR","Yes"]
[null,"05. Encryption Requirements","Encryption Requirements",null,19,"If a device containing PI was lost or stolen, would it be possible to confirm the encryption status?\n","1-5","To meet this requirement, employees must be able to:\n●   ensure that encrypted UBC-owned devices automatically report their encryption status (whenever connected to the UBC network) to validate that encryption was active at the time of loss or theft (UBC’s Encryption Service offers this functionality); or\n●   provide a written confirmation of the encryption status at the time of loss or theft.",{"$f":"replaceURLsWithCodes(H30,Data!K$23:K$330,Data!J$23:J$330)","v":"To meet this requirement, employees must be able to:\n●   ensure that encrypted UBC-owned devices automatically report their encryption status (whenever connected to the UBC network) to validate that encryption was active at the time of loss or theft (UBC’s Encryption Service offers this functionality); or\n●   provide a written confirmation of the encryption status at the time of loss or theft."},"To meet this requirement, employees must be able to:\n●   ensure that encrypted UBC-owned devices automatically report their encryption status (whenever connected to the UBC network) to validate that encryption was active at the time of loss or theft (UBC’s Encryption Service offers this functionality); or\n●   provide a written confirmation of the encryption status at the time of loss or theft.",null,1,null,null,"QR","Yes"]
[null,"05. Encryption Requirements","Encryption Requirements",null,20,"Can your unit recover device encryption passwords if they are forgotten?\n","Yes / No / Not Sure","If the password (also called a “key”) is forgotten or lost, the data may be unrecoverable. Therefore, it is essential to have a key recovery strategy. Employees can use the University’s central encryption service that includes key escrow, or simply write down the password and store it in a secure location such as a safe.",{"$f":"replaceURLsWithCodes(H31,Data!K$23:K$330,Data!J$23:J$330)","v":"If the password (also called a “key”) is forgotten or lost, the data may be unrecoverable. Therefore, it is essential to have a key recovery strategy. Employees can use the University’s central encryption service that includes key escrow, or simply write down the password and store it in a secure location such as a safe."},"If the password (also called a “key”) is forgotten or lost, the data may be unrecoverable. Therefore, it is essential to have a key recovery strategy. Employees can use the University’s central encryption service that includes key escrow, or simply write down the password and store it in a secure location such as a safe.",null,1,null,null,"QR","Yes"]
[null,"06. Working Remotely","Working Remotely",6.5,21,"Do employees take reasonable measures to prevent or reduce the possibility of loss or theft of devices used to access PI when working remotely?","Yes / No / Not Sure / N/A","Working remotely means accessing UBC Electronic Information from outside of a UBC campus.\nReasonable measures include:\n●   being aware of others looking over your shoulder at your screen when working in public locations such as coffee shops, aircraft and other public transport; \n●   not leaving mobile devices unattended in a public place, especially well-travelled areas such as airport lounges, and coffee shops; and\n●   keeping devices secured when working from home, e.g. storing them in a physically-secured area and ensuring UBC Electronic Information cannot be accessed by family members.\n\nFor further information refer to: http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2006%20Working%20Remotely.pdf",{"$f":"replaceURLsWithCodes(H32,Data!K$23:K$330,Data!J$23:J$330)","v":"Working remotely means accessing UBC Electronic Information from outside of a UBC campus.\nReasonable measures include:\n●   being aware of others looking over your shoulder at your screen when working in public locations such as coffee shops, aircraft and other public transport; \n●   not leaving mobile devices unattended in a public place, especially well-travelled areas such as airport lounges, and coffee shops; and\n●   keeping devices secured when working from home, e.g. storing them in a physically-secured area and ensuring UBC Electronic Information cannot be accessed by family members.\n\nFor further information refer to: <<ISS #6: Working Remotely>>"},"Working remotely means accessing UBC Electronic Information from outside of a UBC campus.\nReasonable measures include:\n●   being aware of others looking over your shoulder at your screen when working in public locations such as coffee shops, aircraft and other public transport; \n●   not leaving mobile devices unattended in a public place, especially well-travelled areas such as airport lounges, and coffee shops; and\n●   keeping devices secured when working from home, e.g. storing them in a physically-secured area and ensuring UBC Electronic Information cannot be accessed by family members.\n\nFor further information refer to: <<ISS #6: Working Remotely>>",null,1,1,1,"QR","Yes"]
[null,"06. Working Remotely","Working Remotely",null,22,"Do employees access PI securely when working remotely?","1-5","Secure access methods e.g. Virtual Desktop Interface (VDI) and Virtual Private Network (VPN), should be used wherever possible.  For further information refer to: http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2006%20Working%20Remotely.pdf\n\nAdditionally, third-party devices, such as kiosks in public libraries, hotels, airports, and cyber cafes, should not be used, and public Wi-Fi networks, such as those in airports, coffee shops, should be used with caution.",{"$f":"replaceURLsWithCodes(H33,Data!K$23:K$330,Data!J$23:J$330)","v":"Secure access methods e.g. Virtual Desktop Interface (VDI) and Virtual Private Network (VPN), should be used wherever possible.  For further information refer to: <<ISS #6: Working Remotely>>\n\nAdditionally, third-party devices, such as kiosks in public libraries, hotels, airports, and cyber cafes, should not be used, and public Wi-Fi networks, such as those in airports, coffee shops, should be used with caution."},"Secure access methods e.g. Virtual Desktop Interface (VDI) and Virtual Private Network (VPN), should be used wherever possible.  For further information refer to: <<ISS #6: Working Remotely>>\n\nAdditionally, third-party devices, such as kiosks in public libraries, hotels, airports, and cyber cafes, should not be used, and public Wi-Fi networks, such as those in airports, coffee shops, should be used with caution.",null,1,null,null,"QR","Yes"]
[null,"07. Securing Computing and Mobile Storage Devices/Media","Securing Computing and Mobile Storage Devices/ Media",null,23,"Are reasonable electronic security measures in place to protect PI on all computing devices, e.g. servers, desktop and laptop computers, tablets and smartphones?","1-5","Reasonable measures include:\nAll computing devices:\nAutomatically activate screensaver locks after 30 minutes for all devices except servers, which should be set to 5 minutes.\n\nTablets & Smartphones:\nEnable any features that:\n● will allow the device to be remotely located in the event of loss or theft\n● automatically erases data if 10 consecutive incorrect passwords are entered\n● will allow data stored on the device to be erased in the event of loss or theft\n\nIn addition, antivirus software and firewalls should be in place, and operating systems should be kept updated.\n\nhttp://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2007%20Securing%20Computing%20and%20Mobile%20Storage%20Devices%20or%20Media.pdf",{"$f":"replaceURLsWithCodes(H34,Data!K$23:K$330,Data!J$23:J$330)","v":"Reasonable measures include:\nAll computing devices:\nAutomatically activate screensaver locks after 30 minutes for all devices except servers, which should be set to 5 minutes.\n\nTablets & Smartphones:\nEnable any features that:\n● will allow the device to be remotely located in the event of loss or theft\n● automatically erases data if 10 consecutive incorrect passwords are entered\n● will allow data stored on the device to be erased in the event of loss or theft\n\nIn addition, antivirus software and firewalls should be in place, and operating systems should be kept updated.\n\n<<ISS #7: Securing Computing and Mobile Storage Devices/Media>>"},"Reasonable measures include:\nAll computing devices:\nAutomatically activate screensaver locks after 30 minutes for all devices except servers, which should be set to 5 minutes.\n\nTablets & Smartphones:\nEnable any features that:\n● will allow the device to be remotely located in the event of loss or theft\n● automatically erases data if 10 consecutive incorrect passwords are entered\n● will allow data stored on the device to be erased in the event of loss or theft\n\nIn addition, antivirus software and firewalls should be in place, and operating systems should be kept updated.\n\n<<ISS #7: Securing Computing and Mobile Storage Devices/Media>>",null,1,1,1,"QR","Yes"]
[null,"07. Securing Computing and Mobile Storage Devices/Media","Securing Computing and Mobile Storage Devices/ Media","7.4j",24,"Are all devices that contain PI regularly backed up to a secure location (e.g. UBC network drive), and periodically restored to ensure the integrity and availability of the information are intact?\n\n","1-5","The nature and frequency of backups should be determined by considering the risk of losing the data, and the internal and external data retention requirements. If the impact of losing a few hours / days of work is significant, more frequent backups should be taken.\n\nAlso, backups should not be taken to unsecured devices such as unencrypted portable hard drives.\n\nFor further information refer to http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/resources/Backup%20Guideline.pdf",{"$f":"replaceURLsWithCodes(H35,Data!K$23:K$330,Data!J$23:J$330)","v":"The nature and frequency of backups should be determined by considering the risk of losing the data, and the internal and external data retention requirements. If the impact of losing a few hours / days of work is significant, more frequent backups should be taken.\n\nAlso, backups should not be taken to unsecured devices such as unencrypted portable hard drives.\n\nFor further information refer to <<IS Guideline: Backup>>"},"The nature and frequency of backups should be determined by considering the risk of losing the data, and the internal and external data retention requirements. If the impact of losing a few hours / days of work is significant, more frequent backups should be taken.\n\nAlso, backups should not be taken to unsecured devices such as unencrypted portable hard drives.\n\nFor further information refer to <<IS Guideline: Backup>>",null,1,null,null,"QR","Yes"]
[null,"07. Securing Computing and Mobile Storage Devices/Media","Securing Computing and Mobile Storage Devices/ Media",7.6,25,"Are reasonable physical security measures in place to protect all devices containing PI? Note: Personally owned devices used for UBC work purposes must be addressed.","1-5","Reasonable physical security measures include:\n●  unattended devices (e.g. fax machines, photocopiers, laptops, tablets and smartphones) handling PI are stored in a physically-secured location that is access controlled or locked\n●  servers containing PI are hosted in UBC datacentres\n●  swipe cards are used to restrict access to devices storing PI to authorized individuals",{"$f":"replaceURLsWithCodes(H36,Data!K$23:K$330,Data!J$23:J$330)","v":"Reasonable physical security measures include:\n●  unattended devices (e.g. fax machines, photocopiers, laptops, tablets and smartphones) handling PI are stored in a physically-secured location that is access controlled or locked\n●  servers containing PI are hosted in UBC datacentres\n●  swipe cards are used to restrict access to devices storing PI to authorized individuals"},"Reasonable physical security measures include:\n●  unattended devices (e.g. fax machines, photocopiers, laptops, tablets and smartphones) handling PI are stored in a physically-secured location that is access controlled or locked\n●  servers containing PI are hosted in UBC datacentres\n●  swipe cards are used to restrict access to devices storing PI to authorized individuals",null,1,1,null,"QR","Yes"]
[null,"08. Destruction of UBC Electronic Information","Destruction of UBC Electronic Information",8.5,26,"Is PI on all devices destroyed prior to the device being discarded or reassigned?","1-5","All devices should be considered including desktop and laptop computers, tablets, smartphones, USB keys, and portable hard drives.\n\nNote: Personally owned devices used for UBC work purposes must be addressed.\n\nDetails on acceptable destruction methods can be found at:\nhttp://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2008%20Destruction%20of%20UBC%20Information.pdf",{"$f":"replaceURLsWithCodes(H37,Data!K$23:K$330,Data!J$23:J$330)","v":"All devices should be considered including desktop and laptop computers, tablets, smartphones, USB keys, and portable hard drives.\n\nNote: Personally owned devices used for UBC work purposes must be addressed.\n\nDetails on acceptable destruction methods can be found at:\n<<ISS #8: Destruction of UBC Electronic Information>>"},"All devices should be considered including desktop and laptop computers, tablets, smartphones, USB keys, and portable hard drives.\n\nNote: Personally owned devices used for UBC work purposes must be addressed.\n\nDetails on acceptable destruction methods can be found at:\n<<ISS #8: Destruction of UBC Electronic Information>>",null,1,1,1,"QR","Yes"]
[null,"09. Outsourcing and Service Provider Access","Outsourcing and Service Provider Access",9.4,27,"Does your unit perform a service provider security risk assessment before granting a service provider access to UBC information or systems containing PI?","Yes / No / Not Sure/ N/A","Before service providers are granted access to UBC electronic information and systems, information security risks must be assessed and managed using the following checklist: \nhttp://cio.ubc.ca/sites/cio.ubc.ca/files/documents/resources/Service%20Providers%20Security%20Risk%20Assessment%20Checklist.pdf\n\nThe checklist is used to manage key privacy and security risks relating to service providers having access to PI, such as ensuring:\n● service providers agree to comply with all relevant UBC privacy and security requirements;\n● confidentiality agreements are signed;\n● service providers store and transmit PI in a secure manner; and, \n● service providers agree to destroy any of the PI they store locally, at the end of their contract.\n\nhttp://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2009%20Outsourcing%20and%20Service%20Provider%20Access.pdf\n\n",{"$f":"replaceURLsWithCodes(H38,Data!K$23:K$330,Data!J$23:J$330)","v":"Before service providers are granted access to UBC electronic information and systems, information security risks must be assessed and managed using the following checklist: \n<<Service Provider Security Risk Assessment Checklist>>\n\nThe checklist is used to manage key privacy and security risks relating to service providers having access to PI, such as ensuring:\n● service providers agree to comply with all relevant UBC privacy and security requirements;\n● confidentiality agreements are signed;\n● service providers store and transmit PI in a secure manner; and, \n● service providers agree to destroy any of the PI they store locally, at the end of their contract.\n\n<<ISS #9: Outsourcing and Service Provider Access>>\n\n"},"Before service providers are granted access to UBC electronic information and systems, information security risks must be assessed and managed using the following checklist: \n<<Service Provider Security Risk Assessment Checklist>>\n\nThe checklist is used to manage key privacy and security risks relating to service providers having access to PI, such as ensuring:\n● service providers agree to comply with all relevant UBC privacy and security requirements;\n● confidentiality agreements are signed;\n● service providers store and transmit PI in a secure manner; and, \n● service providers agree to destroy any of the PI they store locally, at the end of their contract.\n\n<<ISS #9: Outsourcing and Service Provider Access>>\n\n",null,1,1,1,"QR","Yes"]
[null,"11. User Account Management","User Account Management",11.3,28,"Does your unit have a formal user account provisioning process, based on the principle of 'least privilege', for systems storing PI? ","1-5","The principle of “least privilege” is when users are granted the minimum level of access required for their defined job function.\n\nExamples of user accounts: FASmail; Student email; Student Information System (SIS); Financial Management System (FMS); Workspace; Home network drive; Login account (Active Directory or equivalent).\n\nRequests and approvals must be retained for at least one year.\nhttp://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2011%20User%20Account%20Management.pdf",{"$f":"replaceURLsWithCodes(H39,Data!K$23:K$330,Data!J$23:J$330)","v":"The principle of “least privilege” is when users are granted the minimum level of access required for their defined job function.\n\nExamples of user accounts: FASmail; Student email; Student Information System (SIS); Financial Management System (FMS); Workspace; Home network drive; Login account (Active Directory or equivalent).\n\nRequests and approvals must be retained for at least one year.\n<<ISS #11:  User Account Management>>"},"The principle of “least privilege” is when users are granted the minimum level of access required for their defined job function.\n\nExamples of user accounts: FASmail; Student email; Student Information System (SIS); Financial Management System (FMS); Workspace; Home network drive; Login account (Active Directory or equivalent).\n\nRequests and approvals must be retained for at least one year.\n<<ISS #11:  User Account Management>>",null,1,1,1,"QR","Yes"]
[null,"11. User Account Management","User Account Management",null,29,"Do employees in your unit have uniquely identifiable user accounts?\n","1-5","Individual user accounts facilitate accountability as all activities can be traced back to a specific account. Therefore, wherever possible, unique user accounts should always be used and they should not be shared with other employees.\n\nPlease indicate in the User Comments field where shared accounts are used and why (except test accounts in the pre-production phase).",{"$f":"replaceURLsWithCodes(H40,Data!K$23:K$330,Data!J$23:J$330)","v":"Individual user accounts facilitate accountability as all activities can be traced back to a specific account. Therefore, wherever possible, unique user accounts should always be used and they should not be shared with other employees.\n\nPlease indicate in the User Comments field where shared accounts are used and why (except test accounts in the pre-production phase)."},"Individual user accounts facilitate accountability as all activities can be traced back to a specific account. Therefore, wherever possible, unique user accounts should always be used and they should not be shared with other employees.\n\nPlease indicate in the User Comments field where shared accounts are used and why (except test accounts in the pre-production phase).",null,1,null,null,"QR","Yes"]
[null,"11. User Account Management","User Account Management",null,30,"Does your unit update user accounts in a timely manner when an employee leaves or changes roles or responsibilities?  ","1-5","Timely deactivation of user accounts is particularly important when an employee is terminated and / or when the employee has had access to a significant amount of PI. \n\nWhen an employee leaves, all PI, physical access rights, UBC-owned devices, etc. must be returned / deactivated, in a timely manner; they must also delete any UBC Electronic Information stored on their personally-owned devices. ",{"$f":"replaceURLsWithCodes(H41,Data!K$23:K$330,Data!J$23:J$330)","v":"Timely deactivation of user accounts is particularly important when an employee is terminated and / or when the employee has had access to a significant amount of PI. \n\nWhen an employee leaves, all PI, physical access rights, UBC-owned devices, etc. must be returned / deactivated, in a timely manner; they must also delete any UBC Electronic Information stored on their personally-owned devices. "},"Timely deactivation of user accounts is particularly important when an employee is terminated and / or when the employee has had access to a significant amount of PI. \n\nWhen an employee leaves, all PI, physical access rights, UBC-owned devices, etc. must be returned / deactivated, in a timely manner; they must also delete any UBC Electronic Information stored on their personally-owned devices. ",null,1,1,null,"QR","Yes"]
[null,"11. User Account Management","User Account Management",11.17,31,"Does your unit periodically review employee access rights to ensure they are aligned with current roles and responsibilities?","1-5","The frequency of the review must be risk based (e.g. access rights to High-Risk PI such as bank account information and personal health information, should be reviewed more frequently than access rights to class lists containing student name and class details).",{"$f":"replaceURLsWithCodes(H42,Data!K$23:K$330,Data!J$23:J$330)","v":"The frequency of the review must be risk based (e.g. access rights to High-Risk PI such as bank account information and personal health information, should be reviewed more frequently than access rights to class lists containing student name and class details)."},"The frequency of the review must be risk based (e.g. access rights to High-Risk PI such as bank account information and personal health information, should be reviewed more frequently than access rights to class lists containing student name and class details).",null,1,null,null,"QR","Yes"]
[null,"Additional","Additional","A1",32,"INSERT QUESTION","1-5",null,{"$f":"replaceURLsWithCodes(H43,Data!K$23:K$330,Data!J$23:J$330)","v":""},"",null,null,null,null,null,"Yes"]
[null,"Additional","Additional","A2",33,"INSERT QUESTION","Yes / No / Not Sure",null,{"$f":"replaceURLsWithCodes(H44,Data!K$23:K$330,Data!J$23:J$330)","v":""},"",null,null,null,null,null,"Yes"]
[null,"Additional","Additional","A3",34,"INSERT QUESTION","1-5",null,{"$f":"replaceURLsWithCodes(H45,Data!K$23:K$330,Data!J$23:J$330)","v":""},"",null,null,null,null,null,"Yes"]
[null,"Additional","Additional","A4",35,"INSERT QUESTION","1-5",null,{"$f":"replaceURLsWithCodes(H46,Data!K$23:K$330,Data!J$23:J$330)","v":""},"",null,null,null,null,null,"Yes"]
[null,"Additional","Additional","A5",36,"INSERT QUESTION","Yes / No / Not Sure",null,{"$f":"replaceURLsWithCodes(H47,Data!K$23:K$330,Data!J$23:J$330)","v":""},"",null,null,null,null,null,"Yes"]

{"sheet":"Data","index":6,"n_rows":77,"n_cols":17,"rows_kept":77,"cut":false,"hidden":true,"merged":[[21,4,21,5]]}
[null,"Responses","Risk Ratings",null,"Range","Risk Ratings",null,null,"Options","Risk Ratings","PIOptions","PIOptions_shadow","PICategories",null,"Scope",null,"RiskRating"]
[null,"Yes",{"$f":"J2","v":1},null,"0-20% of cases",5,null,null,{"$f":"B2","v":"Yes"},{"$f":"F6","v":1},"None",{"$f":"K2","v":"None"},"EMP",null,"High-Risk PI Only",null,"High"]
[null,"No",{"$f":"J3","v":5},null,"21 - 40% of cases",4,null,null,{"$f":"B3","v":"No"},{"$f":"F2","v":5},"High-Risk PI",{"$f":"K3","v":"High-Risk PI"},"STU",null,"All PI",null,"Medium"]
[null,"Not Sure",5,null,"41 - 60% of cases",3,null,null,"Not Sure",{"$f":"F2","v":5},"Other PI","PI (Not High-Risk)","PHI",null,null,null,"Low"]
[null,{"$f":"E7","v":"Select an option"},null,null,"61 - 80% of cases",2,null,null,"N/A",{"$f":"F6","v":1},{"$f":"E7","v":"Select an option"},{"$f":"K5","v":"Select an option"},"DA"]
[null,null,null,null,"81 - 100% of cases",1,null,null,{"$f":"E7","v":"Select an option"},null,null,"see the comment on assessment!AP33","TP"]
[null,null,null,null,"Select an option",null,null,null,null,null,null,null,"PCI"]
[null,"for admins",null,null,null,null,null,"Inclusive lower","exclusive upper","Risk Rating",null,null,"Other"]
[null,"VBA immediate shortcuts",null,null,"Responses","Risk Ratings",null,0,0.20000000000001,"Low"]
[null,"randomizeValues",null,null,{"$f":"I2","v":"Yes"},{"$f":"J2","v":1},null,{"$f":"I9","v":0.20000000000001},{"$f":"7/15","v":0.46666666666666667},"Medium"]
[null,"yesValues",null,null,{"$f":"I3","v":"No"},{"$f":"J3","v":5},null,{"$f":"I10","v":0.46666666666666667},{"$f":"11/15","v":0.73333333333333328},"High"]
[null,"devMode",null,null,"Not Sure",5,null,{"$f":"I11","v":0.73333333333333328},1.01,"Very high"]
[null,"init",null,null,"N/A",1,null,null,null,"//[nasa] Conditional formatting updates list: Action plan!s5, summary!O22"]
[null,"sResetValues",null,null,{"$f":"E2","v":"0-20% of cases"},{"$f":"F2","v":5},null,null,"Implementation status (these values below are probably not used any more; couldn't find any ref)"]
[null,"anchorifyActionPlan",null,null,{"$f":"E3","v":"21 - 40% of cases"},{"$f":"F3","v":4},null,null,"Not started","Legend"]
[null,"protectAll",null,null,"41 - 60% of cases",3,null,null,"In progress","Cells you can change:"]
[null,"unprotectAll",null,null,"61 - 80% of cases",2,null,null,"Completed","Calls calculated automatically:"]
[null,"print thatword",null,null,"81 - 100% of cases",1,null,null,"On hold","DO NOT CHANGE because we don't know if it has any hard-coded reference"]
[null,"resetForm","NEW!",null,null,null,null,null,null,"DO NOT change","everything else"]
[]
[]
[null,null,null,null,"Note: have the titles listed in the same order as Unit Profile (G18 to G 28), including the empty rows in between",null,null,null,"URL CODE (unused)","TEXT THEY SEE instead of the URLs. The << ... >> format is IMPORTANT","Actual URL"]
[null,null,null,null,"Employees",null,null,null,"<<PIFactSheet>>","<<Privacy Fact Sheet: Collecting PI>>","http://universitycounsel.ubc.ca/files/2012/11/Fact-Sheet-Collecting-Personal-Information.pdf"]
[null,null,null,null,null,null,null,null,null,"<<Information Security Standards>>","http://cio.ubc.ca/security-standards-home/information-security-policy-standards-and-resources"]
[null,null,null,null,"Students",null,null,null,null,"<<Privacy Fact Sheets>>","http://universitycounsel.ubc.ca/access-and-privacy/privacy/"]
[null,null,null,null,null,null,null,null,null,"<<Information Security Fact Sheet: Security of Paper Records>>","http://www.library.ubc.ca/archives/manuals/SECURITY.pdf"]
[null,null,null,null,"Personal Health Information",null,null,null,null,"<<Email UBC Information Security>>","mailto:security@ubc.ca"]
[null,null,null,null,null,null,null,null,null,"<<Privacy Fact Sheet: Disclosing PI Outside Canada>>","http://universitycounsel.ubc.ca/files/2014/01/Fact-Sheet-Disclosure-Outside-Canada.pdf"]
[null,null,null,null,"Donors and Alumni",null,null,null,null,"<<IS Guideline: Password Safes>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/resources/Password%20Safe%20Guideline.pdf"]
[null,null,null,null,null,null,null,null,null,"<<ISS #2: Password and Passphrase Protection>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2002%20Password%20and%20Passphrase%20Protection.pdf"]
[null,null,null,null,"Third Party",null,null,null,null,"<<IS Guideline: Information Security Tools>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/resources/Information%20Security%20Tools%20Guideline.pdf"]
[null,null,null,null,null,null,null,null,null,"<<ISS #5: Encryption Requirements>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2005%20Encryption%20Requirements.pdf"]
[null,null,null,null,"Payment Card Industry",null,null,null,null,"<<ISS #6: Working Remotely>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2006%20Working%20Remotely.pdf"]
[null,null,null,null,null,null,null,null,null,"<<ISS #7: Securing Computing and Mobile Storage Devices/Media>>","\nhttp://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2007%20Securing%20Computing%20and%20Mobile%20Storage%20Devices%20or%20Media.pdf"]
[null,null,null,null,null,null,null,null,null,"<<ISS #8: Destruction of UBC Electronic Information>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2008%20Destruction%20of%20UBC%20Information.pdf"]
[null,null,null,null,null,null,null,null,null,"<<ISS #9: Outsourcing and Service Provider Access>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2009%20Outsourcing%20and%20Service%20Provider%20Access.pdf"]
[null,null,null,null,null,null,null,null,null,"<<ISS #11:  User Account Management>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2011%20User%20Account%20Management.pdf"]
[null,null,null,null,null,null,null,null,null,"<<Service Provider Security Risk Assessment Checklist>>","\nhttp://cio.ubc.ca/sites/cio.ubc.ca/files/documents/resources/Service%20Providers%20Security%20Risk%20Assessment%20Checklist.pdf"]
[null,null,null,null,null,null,null,null,null,"<<Policy 104: Acceptable Use and Security of UBC Electronic Information and Systems>>","http://www.universitycounsel.ubc.ca/files/2013/06/policy104.pdf"]
[null,null,null,null,null,null,null,null,null,"<<ISS #4:  Reporting Information Security Incidents>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2004%20Reporting%20Information%20Security%20Incidents.pdf"]
[null,null,null,null,null,null,null,null,null,"<<ISS #3:  Transmission and Sharing of UBC Electronic Information>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/standards/Std%2003%20Transmission%20and%20Sharing%20of%20UBC%20Electronic%20Information.pdf"]
[null,null,null,null,null,null,null,null,null,"<<IS Guideline: Backup>>","http://cio.ubc.ca/sites/cio.ubc.ca/files/documents/resources/Backup%20Guideline.pdf"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,"<<lasturl>>"]

{"sheet":"newcalc","index":7,"n_rows":102,"n_cols":64,"rows_kept":102,"cut":false,"hidden":true,"merged":[[4,0,4,6],[4,8,4,20]]}
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J9","v":"Low"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J10","v":"Medium"}]
["Progress calculation",null,null,null,null,null,null,null,"%RR calculation",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J11","v":"High"}]
[null,null,"Not_selected_text:",null,{"$f":"Data!E7","v":"Select an option"},null,null,null,null,null,null,null,null,"\"Incomplete\"=",null,null,null,"Incomplete Assessment",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Data!J12","v":"Very high"}]
[]
[null,null,"% progress",null,{"$f":"E11/C11","v":0}]
[]
[null,null,"visible",null,"answered among visible"]
["TOTAL",null,{"$f":"SUM(B15:C146)","v":29},null,{"$f":"SUM(E15:E146)","v":0}]
[]
[null,null,null,null,null,null,null,null,"Group id"]
["is a question","Is a visible question",null,null,"visible and answered",null,null,null,null,"Q id","Risk value",null,"Groups","sum #entries including this one","incomplete?","sum?","sum tag (bitmask)","tot rating","actual rating","% rating","risk level"]
[{"$f":"IF(Assessment!$AN15>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN15>0,SUBTOTAL(103,Assessment!B$12:C15)-SUBTOTAL(103,Assessment!B$12:C14)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B15:C15)>0,Assessment!AQ15<>E$6),1,0)","v":0},null,null,null,{"$f":"IF(J15>0,INDEX(QuestionCategories,J15),I14)","v":"General"},{"$f":"Assessment!AN15","v":1},{"$f":"A15*(IF(B15>0,IF(ISNUMBER(Assessment!AR15),Assessment!AR15,0),1))","v":0},null,"Total",null,{"$f":"SUM(calc_hasbeenanswered)<SUM(calc_isavisiblequestion)","v":true},"HILEVEL",null,{"$f":"IF($P15>0,SUMIF($Q16:$Q45,$P15,R16:R45),SUMIF(calc_Gid,$M15,calc_isaquestion))","v":36},{"$f":"IF($P15>0,SUMIF($Q16:$Q45,$P15,S16:S45),SUMIF(calc_Gid,$M15,calc_value))","v":8},{"$f":"IFERROR(MIN(1,S15/(5*R15)),0)","v":4.4444444444444446E-2},{"$f":"IF(O15,calc_strincomplete,VLOOKUP(T15,data_riskratingtable,3,TRUE))","v":"Incomplete Assessment"}]
[{"$f":"IF(Assessment!$AN16>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN16>0,SUBTOTAL(103,Assessment!B$12:C16)-SUBTOTAL(103,Assessment!B$12:C15)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B16:C16)>0,Assessment!AQ16<>E$6),1,0)","v":0},null,null,null,"General",{"$f":"Assessment!AN16","v":0},{"$f":"A16*(IF(B16>0,IF(ISNUMBER(Assessment!AR16),Assessment!AR16,0),1))","v":0},null,"empty--",null,true,null,null,null,null,{"$f":"IFERROR(MIN(1,S16/(5*R16)),0)","v":0},{"$f":"IF(O16,calc_strincomplete,VLOOKUP(T16,data_riskratingtable,3,TRUE))","v":"Incomplete Assessment"}]
[{"$f":"IF(Assessment!$AN17>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN17>0,SUBTOTAL(103,Assessment!B$12:C17)-SUBTOTAL(103,Assessment!B$12:C16)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B17:C17)>0,Assessment!AQ17<>E$6),1,0)","v":0},null,null,null,"General",{"$f":"Assessment!AN17","v":2},{"$f":"A17*(IF(B17>0,IF(ISNUMBER(Assessment!AR17),Assessment!AR17,0),1))","v":0},null,null,null,null,null,null,null,null,0]
[{"$f":"IF(Assessment!$AN18>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN18>0,SUBTOTAL(103,Assessment!B$12:C18)-SUBTOTAL(103,Assessment!B$12:C17)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B18:C18)>0,Assessment!AQ18<>E$6),1,0)","v":0},null,null,null,"General",{"$f":"Assessment!AN18","v":0},{"$f":"A18*(IF(B18>0,IF(ISNUMBER(Assessment!AR18),Assessment!AR18,0),1))","v":0},null,"Electronic Information Security",null,{"$f":"OR(O24:O32)","v":true},"EIS",{"$f":"P$15","v":"HILEVEL"},{"$f":"IF($P18>0,SUMIF($Q19:$Q48,$P18,R19:R48),SUMIF(calc_Gid,$M18,calc_isaquestion))","v":23},{"$f":"IF($P18>0,SUMIF($Q19:$Q48,$P18,S19:S48),SUMIF(calc_Gid,$M18,calc_value))","v":3},2.6086956521739129E-2,{"$f":"IF(O18,calc_strincomplete,VLOOKUP(T18,data_riskratingtable,3,TRUE))","v":"Incomplete Assessment"}]
[{"$f":"IF(Assessment!$AN19>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN19>0,SUBTOTAL(103,Assessment!B$12:C19)-SUBTOTAL(103,Assessment!B$12:C18)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B19:C19)>0,Assessment!AQ19<>E$6),1,0)","v":0},null,null,null,"General",{"$f":"Assessment!AN19","v":3},{"$f":"A19*(IF(B19>0,IF(ISNUMBER(Assessment!AR19),Assessment!AR19,0),1))","v":0},null,"Reporting Information Security Incidents",null,{"$f":"E17<B17","v":true},null,{"$f":"P$18","v":"EIS"},{"$f":"A17","v":1},{"$f":"K17","v":0},{"$f":"IFERROR(MIN(1,S19/(5*R19)),0)","v":0},"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN20>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN20>0,SUBTOTAL(103,Assessment!B$12:C20)-SUBTOTAL(103,Assessment!B$12:C19)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B20:C20)>0,Assessment!AQ20<>E$6),1,0)","v":0},null,null,null,"General",{"$f":"Assessment!AN20","v":0},{"$f":"A20*(IF(B20>0,IF(ISNUMBER(Assessment!AR20),Assessment!AR20,0),1))","v":0},null,"leave this row unused. \"gather\" formula below",0,true,null,null,{"$f":"IF($P20>0,SUMIF($Q21:$Q50,$P20,R21:R50),SUMIF(calc_Gid,$M20,calc_isaquestion))","v":0},{"$f":"IF($P20>0,SUMIF($Q21:$Q50,$P20,S21:S50),SUMIF(calc_Gid,$M20,calc_value))","v":0},0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN21>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN21>0,SUBTOTAL(103,Assessment!B$12:C21)-SUBTOTAL(103,Assessment!B$12:C20)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B21:C21)>0,Assessment!AQ21<>E$6),1,0)","v":0},null,null,null,"General",{"$f":"Assessment!AN21","v":0},{"$f":"A21*(IF(B21>0,IF(ISNUMBER(Assessment!AR21),Assessment!AR21,0),1))","v":0},null,{"$f":"IFERROR(INDEX(calc_Gid,N20+1),\"\")","v":"General"},{"$f":"N20+COUNTIF(calc_Gid,M21)","v":7},{"$f":"SUMIF(calc_Gid,M21,calc_hasbeenanswered)<SUMIF(calc_Gid,M21,calc_isavisiblequestion)","v":true},null,{"$f":"P$15","v":"HILEVEL"},3,0,0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN22>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN22>0,SUBTOTAL(103,Assessment!B$12:C22)-SUBTOTAL(103,Assessment!B$12:C21)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B22:C22)>0,Assessment!AQ22<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN22","v":4},{"$f":"A22*(IF(B22>0,IF(ISNUMBER(Assessment!AR22),Assessment!AR22,0),1))","v":0},null,"Privacy",18,true,null,"HILEVEL",5,0,0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN23>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN23>0,SUBTOTAL(103,Assessment!B$12:C23)-SUBTOTAL(103,Assessment!B$12:C22)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B23:C23)>0,Assessment!AQ23<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN23","v":0},{"$f":"A23*(IF(B23>0,IF(ISNUMBER(Assessment!AR23),Assessment!AR23,0),1))","v":0},null,"Paper security",34,true,null,"HILEVEL",5,5,0.2,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN24>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN24>0,SUBTOTAL(103,Assessment!B$12:C24)-SUBTOTAL(103,Assessment!B$12:C23)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B24:C24)>0,Assessment!AQ24<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN24","v":5},{"$f":"A24*(IF(B24>0,IF(ISNUMBER(Assessment!AR24),Assessment!AR24,0),1))","v":0},null,"Security Classification of UBC Electronic Information",37,true,null,{"$f":"P$18","v":"EIS"},1,0,0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN25>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN25>0,SUBTOTAL(103,Assessment!B$12:C25)-SUBTOTAL(103,Assessment!B$12:C24)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B25:C25)>0,Assessment!AQ25<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN25","v":0},{"$f":"A25*(IF(B25>0,IF(ISNUMBER(Assessment!AR25),Assessment!AR25,0),1))","v":0},null,"Password and Passphrase Protection",46,true,null,"EIS",4,0,0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN26>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN26>0,SUBTOTAL(103,Assessment!B$12:C26)-SUBTOTAL(103,Assessment!B$12:C25)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B26:C26)>0,Assessment!AQ26<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN26","v":6},{"$f":"A26*(IF(B26>0,IF(ISNUMBER(Assessment!AR26),Assessment!AR26,0),1))","v":0},null,"Transmission and Sharing of UBC Electronic Information",53,true,null,"EIS",3,0,0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN27>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN27>0,SUBTOTAL(103,Assessment!B$12:C27)-SUBTOTAL(103,Assessment!B$12:C26)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B27:C27)>0,Assessment!AQ27<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN27","v":0},{"$f":"A27*(IF(B27>0,IF(ISNUMBER(Assessment!AR27),Assessment!AR27,0),1))","v":0},null,"Encryption Requirements",62,true,null,"EIS",3,3,0.2,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN28>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN28>0,SUBTOTAL(103,Assessment!B$12:C28)-SUBTOTAL(103,Assessment!B$12:C27)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B28:C28)>0,Assessment!AQ28<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN28","v":7},{"$f":"A28*(IF(B28>0,IF(ISNUMBER(Assessment!AR28),Assessment!AR28,0),1))","v":0},null,"Working Remotely",67,true,null,"EIS",2,0,0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN29>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN29>0,SUBTOTAL(103,Assessment!B$12:C29)-SUBTOTAL(103,Assessment!B$12:C28)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B29:C29)>0,Assessment!AQ29<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN29","v":0},{"$f":"A29*(IF(B29>0,IF(ISNUMBER(Assessment!AR29),Assessment!AR29,0),1))","v":0},null,"Securing Computing and Mobile Storage Devices/ Media",74,true,null,"EIS",3,0,0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN30>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN30>0,SUBTOTAL(103,Assessment!B$12:C30)-SUBTOTAL(103,Assessment!B$12:C29)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B30:C30)>0,Assessment!AQ30<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN30","v":8},{"$f":"A30*(IF(B30>0,IF(ISNUMBER(Assessment!AR30),Assessment!AR30,0),1))","v":0},null,"Destruction of UBC Electronic Information",77,true,null,"EIS",1,0,0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN31>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN31>0,SUBTOTAL(103,Assessment!B$12:C31)-SUBTOTAL(103,Assessment!B$12:C30)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B31:C31)>0,Assessment!AQ31<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN31","v":0},{"$f":"A31*(IF(B31>0,IF(ISNUMBER(Assessment!AR31),Assessment!AR31,0),1))","v":0},null,"Outsourcing and Service Provider Access",80,true,null,"EIS",1,0,0,"Incomplete Assessment"]
[{"$f":"IF(Assessment!$AN32>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN32>0,SUBTOTAL(103,Assessment!B$12:C32)-SUBTOTAL(103,Assessment!B$12:C31)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B32:C32)>0,Assessment!AQ32<>E$6),1,0)","v":0},null,null,null,"Privacy",{"$f":"Assessment!AN32","v":0},{"$f":"A32*(IF(B32>0,IF(ISNUMBER(Assessment!AR32),Assessment!AR32,0),1))","v":0},null,"User Account Management",88,true,null,"EIS",4,0,0,"Incomplete Assessment"]
[0,{"$f":"IF(AND(Assessment!$AN33>0,SUBTOTAL(103,Assessment!B$12:C33)-SUBTOTAL(103,Assessment!B$12:C32)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B33:C33)>0,Assessment!AQ33<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN33","v":9},{"$f":"A33*(IF(B33>0,IF(ISNUMBER(Assessment!AR33),Assessment!AR33,0),1))","v":0},null,"",88,false,null,null,0,0,0,"Low"]
[{"$f":"IF(Assessment!$AN34>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN34>0,SUBTOTAL(103,Assessment!B$12:C34)-SUBTOTAL(103,Assessment!B$12:C33)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B34:C34)>0,Assessment!AQ34<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN34","v":0},{"$f":"A34*(IF(B34>0,IF(ISNUMBER(Assessment!AR34),Assessment!AR34,0),1))","v":0},null,"",88,false,null,null,0,0,0,"Low"]
[{"$f":"IF(Assessment!$AN35>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN35>0,SUBTOTAL(103,Assessment!B$12:C35)-SUBTOTAL(103,Assessment!B$12:C34)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B35:C35)>0,Assessment!AQ35<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN35","v":0},{"$f":"A35*(IF(B35>0,IF(ISNUMBER(Assessment!AR35),Assessment!AR35,0),1))","v":0},null,"",88,false,null,null,0,0,0,"Low"]
[{"$f":"IF(Assessment!$AN36>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN36>0,SUBTOTAL(103,Assessment!B$12:C36)-SUBTOTAL(103,Assessment!B$12:C35)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B36:C36)>0,Assessment!AQ36<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN36","v":0},{"$f":"A36*(IF(B36>0,IF(ISNUMBER(Assessment!AR36),Assessment!AR36,0),1))","v":0},null,"",88,false,null,null,0,0,0,"Low"]
[{"$f":"IF(Assessment!$AN37>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN37>0,SUBTOTAL(103,Assessment!B$12:C37)-SUBTOTAL(103,Assessment!B$12:C36)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B37:C37)>0,Assessment!AQ37<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN37","v":10},{"$f":"A37*(IF(B37>0,IF(ISNUMBER(Assessment!AR37),Assessment!AR37,0),1))","v":1},null,"TEST ROW……………….",88,false,null,null,0,0,null,"Low"]
[{"$f":"IF(Assessment!$AN38>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN38>0,SUBTOTAL(103,Assessment!B$12:C38)-SUBTOTAL(103,Assessment!B$12:C37)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B38:C38)>0,Assessment!AQ38<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN38","v":0},{"$f":"A38*(IF(B38>0,IF(ISNUMBER(Assessment!AR38),Assessment!AR38,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN39>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN39>0,SUBTOTAL(103,Assessment!B$12:C39)-SUBTOTAL(103,Assessment!B$12:C38)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B39:C39)>0,Assessment!AQ39<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN39","v":11},{"$f":"A39*(IF(B39>0,IF(ISNUMBER(Assessment!AR39),Assessment!AR39,0),1))","v":1}]
[{"$f":"IF(Assessment!$AN40>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN40>0,SUBTOTAL(103,Assessment!B$12:C40)-SUBTOTAL(103,Assessment!B$12:C39)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B40:C40)>0,Assessment!AQ40<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN40","v":0},{"$f":"A40*(IF(B40>0,IF(ISNUMBER(Assessment!AR40),Assessment!AR40,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN41>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN41>0,SUBTOTAL(103,Assessment!B$12:C41)-SUBTOTAL(103,Assessment!B$12:C40)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B41:C41)>0,Assessment!AQ41<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN41","v":12},{"$f":"A41*(IF(B41>0,IF(ISNUMBER(Assessment!AR41),Assessment!AR41,0),1))","v":1}]
[{"$f":"IF(Assessment!$AN42>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN42>0,SUBTOTAL(103,Assessment!B$12:C42)-SUBTOTAL(103,Assessment!B$12:C41)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B42:C42)>0,Assessment!AQ42<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN42","v":0},{"$f":"A42*(IF(B42>0,IF(ISNUMBER(Assessment!AR42),Assessment!AR42,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN43>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN43>0,SUBTOTAL(103,Assessment!B$12:C43)-SUBTOTAL(103,Assessment!B$12:C42)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B43:C43)>0,Assessment!AQ43<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN43","v":13},{"$f":"A43*(IF(B43>0,IF(ISNUMBER(Assessment!AR43),Assessment!AR43,0),1))","v":1}]
[{"$f":"IF(Assessment!$AN44>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN44>0,SUBTOTAL(103,Assessment!B$12:C44)-SUBTOTAL(103,Assessment!B$12:C43)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B44:C44)>0,Assessment!AQ44<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN44","v":0},{"$f":"A44*(IF(B44>0,IF(ISNUMBER(Assessment!AR44),Assessment!AR44,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN45>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN45>0,SUBTOTAL(103,Assessment!B$12:C45)-SUBTOTAL(103,Assessment!B$12:C44)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B45:C45)>0,Assessment!AQ45<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN45","v":14},{"$f":"A45*(IF(B45>0,IF(ISNUMBER(Assessment!AR45),Assessment!AR45,0),1))","v":1}]
[{"$f":"IF(Assessment!$AN46>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN46>0,SUBTOTAL(103,Assessment!B$12:C46)-SUBTOTAL(103,Assessment!B$12:C45)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B46:C46)>0,Assessment!AQ46<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN46","v":0},{"$f":"A46*(IF(B46>0,IF(ISNUMBER(Assessment!AR46),Assessment!AR46,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN47>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN47>0,SUBTOTAL(103,Assessment!B$12:C47)-SUBTOTAL(103,Assessment!B$12:C46)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B47:C47)>0,Assessment!AQ47<>E$6),1,0)","v":0},null,null,null,{"$f":"IF(J47>0,INDEX(QuestionCategories,J47),I46)","v":"Paper security"},{"$f":"Assessment!AN47","v":0},{"$f":"A47*(IF(B47>0,IF(ISNUMBER(Assessment!AR47),Assessment!AR47,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN48>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN48>0,SUBTOTAL(103,Assessment!B$12:C48)-SUBTOTAL(103,Assessment!B$12:C47)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B48:C48)>0,Assessment!AQ48<>E$6),1,0)","v":0},null,null,null,"Paper security",{"$f":"Assessment!AN48","v":0},{"$f":"A48*(IF(B48>0,IF(ISNUMBER(Assessment!AR48),Assessment!AR48,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN49>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN49>0,SUBTOTAL(103,Assessment!B$12:C49)-SUBTOTAL(103,Assessment!B$12:C48)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B49:C49)>0,Assessment!AQ49<>E$6),1,0)","v":0},null,null,null,"Security Classification of UBC Electronic Information",{"$f":"Assessment!AN49","v":15},{"$f":"A49*(IF(B49>0,IF(ISNUMBER(Assessment!AR49),Assessment!AR49,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN50>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN50>0,SUBTOTAL(103,Assessment!B$12:C50)-SUBTOTAL(103,Assessment!B$12:C49)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B50:C50)>0,Assessment!AQ50<>E$6),1,0)","v":0},null,null,null,"Security Classification of UBC Electronic Information",{"$f":"Assessment!AN50","v":0},{"$f":"A50*(IF(B50>0,IF(ISNUMBER(Assessment!AR50),Assessment!AR50,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN51>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN51>0,SUBTOTAL(103,Assessment!B$12:C51)-SUBTOTAL(103,Assessment!B$12:C50)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B51:C51)>0,Assessment!AQ51<>E$6),1,0)","v":0},null,null,null,"Security Classification of UBC Electronic Information",{"$f":"Assessment!AN51","v":0},{"$f":"A51*(IF(B51>0,IF(ISNUMBER(Assessment!AR51),Assessment!AR51,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN52>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN52>0,SUBTOTAL(103,Assessment!B$12:C52)-SUBTOTAL(103,Assessment!B$12:C51)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B52:C52)>0,Assessment!AQ52<>E$6),1,0)","v":0},null,null,null,"Password and Passphrase Protection",{"$f":"Assessment!AN52","v":16},{"$f":"A52*(IF(B52>0,IF(ISNUMBER(Assessment!AR52),Assessment!AR52,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN53>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN53>0,SUBTOTAL(103,Assessment!B$12:C53)-SUBTOTAL(103,Assessment!B$12:C52)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B53:C53)>0,Assessment!AQ53<>E$6),1,0)","v":0},null,null,null,"Password and Passphrase Protection",{"$f":"Assessment!AN53","v":0},{"$f":"A53*(IF(B53>0,IF(ISNUMBER(Assessment!AR53),Assessment!AR53,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN54>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN54>0,SUBTOTAL(103,Assessment!B$12:C54)-SUBTOTAL(103,Assessment!B$12:C53)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B54:C54)>0,Assessment!AQ54<>E$6),1,0)","v":0},null,null,null,"Password and Passphrase Protection",{"$f":"Assessment!AN54","v":17},{"$f":"A54*(IF(B54>0,IF(ISNUMBER(Assessment!AR54),Assessment!AR54,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN55>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN55>0,SUBTOTAL(103,Assessment!B$12:C55)-SUBTOTAL(103,Assessment!B$12:C54)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B55:C55)>0,Assessment!AQ55<>E$6),1,0)","v":0},null,null,null,"Password and Passphrase Protection",{"$f":"Assessment!AN55","v":0},{"$f":"A55*(IF(B55>0,IF(ISNUMBER(Assessment!AR55),Assessment!AR55,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN56>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN56>0,SUBTOTAL(103,Assessment!B$12:C56)-SUBTOTAL(103,Assessment!B$12:C55)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B56:C56)>0,Assessment!AQ56<>E$6),1,0)","v":0},null,null,null,"Password and Passphrase Protection",{"$f":"Assessment!AN56","v":18},{"$f":"A56*(IF(B56>0,IF(ISNUMBER(Assessment!AR56),Assessment!AR56,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN57>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN57>0,SUBTOTAL(103,Assessment!B$12:C57)-SUBTOTAL(103,Assessment!B$12:C56)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B57:C57)>0,Assessment!AQ57<>E$6),1,0)","v":0},null,null,null,"Password and Passphrase Protection",{"$f":"Assessment!AN57","v":0},{"$f":"A57*(IF(B57>0,IF(ISNUMBER(Assessment!AR57),Assessment!AR57,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN58>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN58>0,SUBTOTAL(103,Assessment!B$12:C58)-SUBTOTAL(103,Assessment!B$12:C57)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B58:C58)>0,Assessment!AQ58<>E$6),1,0)","v":0},null,null,null,"Password and Passphrase Protection",{"$f":"Assessment!AN58","v":19},{"$f":"A58*(IF(B58>0,IF(ISNUMBER(Assessment!AR58),Assessment!AR58,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN59>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN59>0,SUBTOTAL(103,Assessment!B$12:C59)-SUBTOTAL(103,Assessment!B$12:C58)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B59:C59)>0,Assessment!AQ59<>E$6),1,0)","v":0},null,null,null,"Password and Passphrase Protection",{"$f":"Assessment!AN59","v":0},{"$f":"A59*(IF(B59>0,IF(ISNUMBER(Assessment!AR59),Assessment!AR59,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN60>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN60>0,SUBTOTAL(103,Assessment!B$12:C60)-SUBTOTAL(103,Assessment!B$12:C59)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B60:C60)>0,Assessment!AQ60<>E$6),1,0)","v":0},null,null,null,"Password and Passphrase Protection",{"$f":"Assessment!AN60","v":0},{"$f":"A60*(IF(B60>0,IF(ISNUMBER(Assessment!AR60),Assessment!AR60,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN61>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN61>0,SUBTOTAL(103,Assessment!B$12:C61)-SUBTOTAL(103,Assessment!B$12:C60)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B61:C61)>0,Assessment!AQ61<>E$6),1,0)","v":0},null,null,null,"Transmission and Sharing of UBC Electronic Information",{"$f":"Assessment!AN61","v":20},{"$f":"A61*(IF(B61>0,IF(ISNUMBER(Assessment!AR61),Assessment!AR61,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN62>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN62>0,SUBTOTAL(103,Assessment!B$12:C62)-SUBTOTAL(103,Assessment!B$12:C61)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B62:C62)>0,Assessment!AQ62<>E$6),1,0)","v":0},null,null,null,"Transmission and Sharing of UBC Electronic Information",{"$f":"Assessment!AN62","v":0},{"$f":"A62*(IF(B62>0,IF(ISNUMBER(Assessment!AR62),Assessment!AR62,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN63>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN63>0,SUBTOTAL(103,Assessment!B$12:C63)-SUBTOTAL(103,Assessment!B$12:C62)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B63:C63)>0,Assessment!AQ63<>E$6),1,0)","v":0},null,null,null,"Transmission and Sharing of UBC Electronic Information",{"$f":"Assessment!AN63","v":21},{"$f":"A63*(IF(B63>0,IF(ISNUMBER(Assessment!AR63),Assessment!AR63,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN64>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN64>0,SUBTOTAL(103,Assessment!B$12:C64)-SUBTOTAL(103,Assessment!B$12:C63)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B64:C64)>0,Assessment!AQ64<>E$6),1,0)","v":0},null,null,null,"Transmission and Sharing of UBC Electronic Information",{"$f":"Assessment!AN64","v":0},{"$f":"A64*(IF(B64>0,IF(ISNUMBER(Assessment!AR64),Assessment!AR64,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN65>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN65>0,SUBTOTAL(103,Assessment!B$12:C65)-SUBTOTAL(103,Assessment!B$12:C64)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B65:C65)>0,Assessment!AQ65<>E$6),1,0)","v":0},null,null,null,"Transmission and Sharing of UBC Electronic Information",{"$f":"Assessment!AN65","v":22},{"$f":"A65*(IF(B65>0,IF(ISNUMBER(Assessment!AR65),Assessment!AR65,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN66>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN66>0,SUBTOTAL(103,Assessment!B$12:C66)-SUBTOTAL(103,Assessment!B$12:C65)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B66:C66)>0,Assessment!AQ66<>E$6),1,0)","v":0},null,null,null,"Transmission and Sharing of UBC Electronic Information",{"$f":"Assessment!AN66","v":0},{"$f":"A66*(IF(B66>0,IF(ISNUMBER(Assessment!AR66),Assessment!AR66,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN67>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN67>0,SUBTOTAL(103,Assessment!B$12:C67)-SUBTOTAL(103,Assessment!B$12:C66)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B67:C67)>0,Assessment!AQ67<>E$6),1,0)","v":0},null,null,null,"Transmission and Sharing of UBC Electronic Information",{"$f":"Assessment!AN67","v":0},{"$f":"A67*(IF(B67>0,IF(ISNUMBER(Assessment!AR67),Assessment!AR67,0),1))","v":0}]
[0,{"$f":"IF(AND(Assessment!$AN68>0,SUBTOTAL(103,Assessment!B$12:C68)-SUBTOTAL(103,Assessment!B$12:C67)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B68:C68)>0,Assessment!AQ68<>E$6),1,0)","v":0},null,null,null,"Encryption Requirements",{"$f":"Assessment!AN68","v":23},{"$f":"A68*(IF(B68>0,IF(ISNUMBER(Assessment!AR68),Assessment!AR68,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN69>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN69>0,SUBTOTAL(103,Assessment!B$12:C69)-SUBTOTAL(103,Assessment!B$12:C68)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B69:C69)>0,Assessment!AQ69<>E$6),1,0)","v":0},null,null,null,"Encryption Requirements",{"$f":"Assessment!AN69","v":0},{"$f":"A69*(IF(B69>0,IF(ISNUMBER(Assessment!AR69),Assessment!AR69,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN70>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN70>0,SUBTOTAL(103,Assessment!B$12:C70)-SUBTOTAL(103,Assessment!B$12:C69)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B70:C70)>0,Assessment!AQ70<>E$6),1,0)","v":0},null,null,null,"Encryption Requirements",{"$f":"Assessment!AN70","v":24},{"$f":"A70*(IF(B70>0,IF(ISNUMBER(Assessment!AR70),Assessment!AR70,0),1))","v":1}]
[{"$f":"IF(Assessment!$AN71>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN71>0,SUBTOTAL(103,Assessment!B$12:C71)-SUBTOTAL(103,Assessment!B$12:C70)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B71:C71)>0,Assessment!AQ71<>E$6),1,0)","v":0},null,null,null,"Encryption Requirements",{"$f":"Assessment!AN71","v":0},{"$f":"A71*(IF(B71>0,IF(ISNUMBER(Assessment!AR71),Assessment!AR71,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN72>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN72>0,SUBTOTAL(103,Assessment!B$12:C72)-SUBTOTAL(103,Assessment!B$12:C71)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B72:C72)>0,Assessment!AQ72<>E$6),1,0)","v":0},null,null,null,"Encryption Requirements",{"$f":"Assessment!AN72","v":25},{"$f":"A72*(IF(B72>0,IF(ISNUMBER(Assessment!AR72),Assessment!AR72,0),1))","v":1}]
[{"$f":"IF(Assessment!$AN73>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN73>0,SUBTOTAL(103,Assessment!B$12:C73)-SUBTOTAL(103,Assessment!B$12:C72)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B73:C73)>0,Assessment!AQ73<>E$6),1,0)","v":0},null,null,null,"Encryption Requirements",{"$f":"Assessment!AN73","v":0},{"$f":"A73*(IF(B73>0,IF(ISNUMBER(Assessment!AR73),Assessment!AR73,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN74>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN74>0,SUBTOTAL(103,Assessment!B$12:C74)-SUBTOTAL(103,Assessment!B$12:C73)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B74:C74)>0,Assessment!AQ74<>E$6),1,0)","v":0},null,null,null,"Encryption Requirements",{"$f":"Assessment!AN74","v":26},{"$f":"A74*(IF(B74>0,IF(ISNUMBER(Assessment!AR74),Assessment!AR74,0),1))","v":1}]
[{"$f":"IF(Assessment!$AN75>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN75>0,SUBTOTAL(103,Assessment!B$12:C75)-SUBTOTAL(103,Assessment!B$12:C74)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B75:C75)>0,Assessment!AQ75<>E$6),1,0)","v":0},null,null,null,"Encryption Requirements",{"$f":"Assessment!AN75","v":0},{"$f":"A75*(IF(B75>0,IF(ISNUMBER(Assessment!AR75),Assessment!AR75,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN76>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN76>0,SUBTOTAL(103,Assessment!B$12:C76)-SUBTOTAL(103,Assessment!B$12:C75)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B76:C76)>0,Assessment!AQ76<>E$6),1,0)","v":0},null,null,null,"Encryption Requirements",{"$f":"Assessment!AN76","v":0},{"$f":"A76*(IF(B76>0,IF(ISNUMBER(Assessment!AR76),Assessment!AR76,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN77>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN77>0,SUBTOTAL(103,Assessment!B$12:C77)-SUBTOTAL(103,Assessment!B$12:C76)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B77:C77)>0,Assessment!AQ77<>E$6),1,0)","v":0},null,null,null,"Working Remotely",{"$f":"Assessment!AN77","v":27},{"$f":"A77*(IF(B77>0,IF(ISNUMBER(Assessment!AR77),Assessment!AR77,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN78>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN78>0,SUBTOTAL(103,Assessment!B$12:C78)-SUBTOTAL(103,Assessment!B$12:C77)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B78:C78)>0,Assessment!AQ78<>E$6),1,0)","v":0},null,null,null,"Working Remotely",{"$f":"Assessment!AN78","v":0},{"$f":"A78*(IF(B78>0,IF(ISNUMBER(Assessment!AR78),Assessment!AR78,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN79>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN79>0,SUBTOTAL(103,Assessment!B$12:C79)-SUBTOTAL(103,Assessment!B$12:C78)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B79:C79)>0,Assessment!AQ79<>E$6),1,0)","v":0},null,null,null,{"$f":"IF(J79>0,INDEX(QuestionCategories,J79),I78)","v":"Working Remotely"},{"$f":"Assessment!AN79","v":28},{"$f":"A79*(IF(B79>0,IF(ISNUMBER(Assessment!AR79),Assessment!AR79,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN80>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN80>0,SUBTOTAL(103,Assessment!B$12:C80)-SUBTOTAL(103,Assessment!B$12:C79)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B80:C80)>0,Assessment!AQ80<>E$6),1,0)","v":0},null,null,null,"Working Remotely",{"$f":"Assessment!AN80","v":0},{"$f":"A80*(IF(B80>0,IF(ISNUMBER(Assessment!AR80),Assessment!AR80,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN81>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN81>0,SUBTOTAL(103,Assessment!B$12:C81)-SUBTOTAL(103,Assessment!B$12:C80)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B81:C81)>0,Assessment!AQ81<>E$6),1,0)","v":0},null,null,null,"Working Remotely",{"$f":"Assessment!AN81","v":0},{"$f":"A81*(IF(B81>0,IF(ISNUMBER(Assessment!AR81),Assessment!AR81,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN82>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN82>0,SUBTOTAL(103,Assessment!B$12:C82)-SUBTOTAL(103,Assessment!B$12:C81)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B82:C82)>0,Assessment!AQ82<>E$6),1,0)","v":0},null,null,null,"Securing Computing and Mobile Storage Devices/ Media",{"$f":"Assessment!AN82","v":29},{"$f":"A82*(IF(B82>0,IF(ISNUMBER(Assessment!AR82),Assessment!AR82,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN83>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN83>0,SUBTOTAL(103,Assessment!B$12:C83)-SUBTOTAL(103,Assessment!B$12:C82)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B83:C83)>0,Assessment!AQ83<>E$6),1,0)","v":0},null,null,null,"Securing Computing and Mobile Storage Devices/ Media",{"$f":"Assessment!AN83","v":0},{"$f":"A83*(IF(B83>0,IF(ISNUMBER(Assessment!AR83),Assessment!AR83,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN84>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN84>0,SUBTOTAL(103,Assessment!B$12:C84)-SUBTOTAL(103,Assessment!B$12:C83)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B84:C84)>0,Assessment!AQ84<>E$6),1,0)","v":0},null,null,null,"Securing Computing and Mobile Storage Devices/ Media",{"$f":"Assessment!AN84","v":30},{"$f":"A84*(IF(B84>0,IF(ISNUMBER(Assessment!AR84),Assessment!AR84,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN85>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN85>0,SUBTOTAL(103,Assessment!B$12:C85)-SUBTOTAL(103,Assessment!B$12:C84)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B85:C85)>0,Assessment!AQ85<>E$6),1,0)","v":0},null,null,null,"Securing Computing and Mobile Storage Devices/ Media",{"$f":"Assessment!AN85","v":0},{"$f":"A85*(IF(B85>0,IF(ISNUMBER(Assessment!AR85),Assessment!AR85,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN86>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN86>0,SUBTOTAL(103,Assessment!B$12:C86)-SUBTOTAL(103,Assessment!B$12:C85)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B86:C86)>0,Assessment!AQ86<>E$6),1,0)","v":0},null,null,null,"Securing Computing and Mobile Storage Devices/ Media",{"$f":"Assessment!AN86","v":31},{"$f":"A86*(IF(B86>0,IF(ISNUMBER(Assessment!AR86),Assessment!AR86,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN87>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN87>0,SUBTOTAL(103,Assessment!B$12:C87)-SUBTOTAL(103,Assessment!B$12:C86)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B87:C87)>0,Assessment!AQ87<>E$6),1,0)","v":0},null,null,null,"Securing Computing and Mobile Storage Devices/ Media",{"$f":"Assessment!AN87","v":0},{"$f":"A87*(IF(B87>0,IF(ISNUMBER(Assessment!AR87),Assessment!AR87,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN88>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN88>0,SUBTOTAL(103,Assessment!B$12:C88)-SUBTOTAL(103,Assessment!B$12:C87)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B88:C88)>0,Assessment!AQ88<>E$6),1,0)","v":0},null,null,null,"Securing Computing and Mobile Storage Devices/ Media",{"$f":"Assessment!AN88","v":0},{"$f":"A88*(IF(B88>0,IF(ISNUMBER(Assessment!AR88),Assessment!AR88,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN89>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN89>0,SUBTOTAL(103,Assessment!B$12:C89)-SUBTOTAL(103,Assessment!B$12:C88)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B89:C89)>0,Assessment!AQ89<>E$6),1,0)","v":0},null,null,null,"Destruction of UBC Electronic Information",{"$f":"Assessment!AN89","v":32},{"$f":"A89*(IF(B89>0,IF(ISNUMBER(Assessment!AR89),Assessment!AR89,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN90>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN90>0,SUBTOTAL(103,Assessment!B$12:C90)-SUBTOTAL(103,Assessment!B$12:C89)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B90:C90)>0,Assessment!AQ90<>E$6),1,0)","v":0},null,null,null,"Destruction of UBC Electronic Information",{"$f":"Assessment!AN90","v":0},{"$f":"A90*(IF(B90>0,IF(ISNUMBER(Assessment!AR90),Assessment!AR90,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN91>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN91>0,SUBTOTAL(103,Assessment!B$12:C91)-SUBTOTAL(103,Assessment!B$12:C90)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B91:C91)>0,Assessment!AQ91<>E$6),1,0)","v":0},null,null,null,"Destruction of UBC Electronic Information",{"$f":"Assessment!AN91","v":0},{"$f":"A91*(IF(B91>0,IF(ISNUMBER(Assessment!AR91),Assessment!AR91,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN92>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN92>0,SUBTOTAL(103,Assessment!B$12:C92)-SUBTOTAL(103,Assessment!B$12:C91)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B92:C92)>0,Assessment!AQ92<>E$6),1,0)","v":0},null,null,null,"Outsourcing and Service Provider Access",{"$f":"Assessment!AN92","v":33},{"$f":"A92*(IF(B92>0,IF(ISNUMBER(Assessment!AR92),Assessment!AR92,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN93>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN93>0,SUBTOTAL(103,Assessment!B$12:C93)-SUBTOTAL(103,Assessment!B$12:C92)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B93:C93)>0,Assessment!AQ93<>E$6),1,0)","v":0},null,null,null,"Outsourcing and Service Provider Access",{"$f":"Assessment!AN93","v":0},{"$f":"A93*(IF(B93>0,IF(ISNUMBER(Assessment!AR93),Assessment!AR93,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN94>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN94>0,SUBTOTAL(103,Assessment!B$12:C94)-SUBTOTAL(103,Assessment!B$12:C93)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B94:C94)>0,Assessment!AQ94<>E$6),1,0)","v":0},null,null,null,"Outsourcing and Service Provider Access",{"$f":"Assessment!AN94","v":0},{"$f":"A94*(IF(B94>0,IF(ISNUMBER(Assessment!AR94),Assessment!AR94,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN95>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN95>0,SUBTOTAL(103,Assessment!B$12:C95)-SUBTOTAL(103,Assessment!B$12:C94)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B95:C95)>0,Assessment!AQ95<>E$6),1,0)","v":0},null,null,null,"User Account Management",{"$f":"Assessment!AN95","v":34},{"$f":"A95*(IF(B95>0,IF(ISNUMBER(Assessment!AR95),Assessment!AR95,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN96>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN96>0,SUBTOTAL(103,Assessment!B$12:C96)-SUBTOTAL(103,Assessment!B$12:C95)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B96:C96)>0,Assessment!AQ96<>E$6),1,0)","v":0},null,null,null,"User Account Management",{"$f":"Assessment!AN96","v":0},{"$f":"A96*(IF(B96>0,IF(ISNUMBER(Assessment!AR96),Assessment!AR96,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN97>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN97>0,SUBTOTAL(103,Assessment!B$12:C97)-SUBTOTAL(103,Assessment!B$12:C96)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B97:C97)>0,Assessment!AQ97<>E$6),1,0)","v":0},null,null,null,"User Account Management",{"$f":"Assessment!AN97","v":35},{"$f":"A97*(IF(B97>0,IF(ISNUMBER(Assessment!AR97),Assessment!AR97,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN98>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN98>0,SUBTOTAL(103,Assessment!B$12:C98)-SUBTOTAL(103,Assessment!B$12:C97)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B98:C98)>0,Assessment!AQ98<>E$6),1,0)","v":0},null,null,null,"User Account Management",{"$f":"Assessment!AN98","v":0},{"$f":"A98*(IF(B98>0,IF(ISNUMBER(Assessment!AR98),Assessment!AR98,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN99>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN99>0,SUBTOTAL(103,Assessment!B$12:C99)-SUBTOTAL(103,Assessment!B$12:C98)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B99:C99)>0,Assessment!AQ99<>E$6),1,0)","v":0},null,null,null,"User Account Management",{"$f":"Assessment!AN99","v":36},{"$f":"A99*(IF(B99>0,IF(ISNUMBER(Assessment!AR99),Assessment!AR99,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN100>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN100>0,SUBTOTAL(103,Assessment!B$12:C100)-SUBTOTAL(103,Assessment!B$12:C99)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B100:C100)>0,Assessment!AQ100<>E$6),1,0)","v":0},null,null,null,"User Account Management",{"$f":"Assessment!AN100","v":0},{"$f":"A100*(IF(B100>0,IF(ISNUMBER(Assessment!AR100),Assessment!AR100,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN101>0,1,0)","v":1},{"$f":"IF(AND(Assessment!$AN101>0,SUBTOTAL(103,Assessment!B$12:C101)-SUBTOTAL(103,Assessment!B$12:C100)>0),1,0)","v":1},null,null,{"$f":"IF(AND(SUM(B101:C101)>0,Assessment!AQ101<>E$6),1,0)","v":0},null,null,null,"User Account Management",{"$f":"Assessment!AN101","v":37},{"$f":"A101*(IF(B101>0,IF(ISNUMBER(Assessment!AR101),Assessment!AR101,0),1))","v":0}]
[{"$f":"IF(Assessment!$AN102>0,1,0)","v":0},{"$f":"IF(AND(Assessment!$AN102>0,SUBTOTAL(103,Assessment!B$12:C102)-SUBTOTAL(103,Assessment!B$12:C101)>0),1,0)","v":0},null,null,{"$f":"IF(AND(SUM(B102:C102)>0,Assessment!AQ102<>E$6),1,0)","v":0},null,null,null,"User Account Management",{"$f":"Assessment!AN102","v":0},{"$f":"A102*(IF(B102>0,IF(ISNUMBER(Assessment!AR102),Assessment!AR102,0),1))","v":0}]

{"sheet":"conversion","index":8,"n_rows":24,"n_cols":18,"rows_kept":24,"cut":false,"hidden":true,"merged":[]}
[null,"file extension ->","*.xlsm","."]
[null,"Source path->","C:\\Users\\Mushfiqur\\Desktop\\tmp\\testin","."]
[null,"Target path->","C:\\Users\\Mushfiqur\\Desktop\\tmp\\testout","."]
[]
[]
[]
[null,null,"Files",null,null,null,null,null,null,"conv stat","Description","clear on new","hold","Special","v2sheet","v2range","v3sheet","v3range"]
[null,"really? -->","--EMPTY--",null,null,null,null,null,null,null,"front page stuff",true,true,null,{"$f":"Q8","v":"Unit Profile"},"C10","Unit Profile","K10"]
[null,null,null,null,null,null,null,null,null,null,"(some reshuffling happening here)",true,null,null,{"$f":"Q9","v":"Unit Profile"},"K10",{"$f":"Q8","v":"Unit Profile"},"K10"]
[null,null,null,null,null,null,null,null,null,null,null,true,true,null,"Unit Profile","C14",{"$f":"Q9","v":"Unit Profile"},"K12"]
[null,null,null,null,null,null,null,null,null,null,null,true,null,null,"Unit Profile","K12","Unit Profile","K12"]
[null,null,null,null,null,null,null,null,null,null,null,true,null,null,"Unit Profile","C12","Unit Profile","C14"]
[null,null,null,null,null,null,null,null,null,null,null,true,null,null,"Unit Profile","K14","Unit Profile","K14"]
[null,null,null,null,null,null,null,null,null,null,null,true,null,null,"Unit Profile","A10","Unit Profile","C10"]
[null,null,null,null,null,null,null,null,null,null,null,true,null,null,"Unit Profile","A12","Unit Profile","C12"]
[null,null,null,null,null,null,null,null,null,null,null,true,null,null,"Unit Profile",{"$f":"R16","v":"AA18:AA31"},"Unit Profile","AA18:AA31"]
[null,null,null,null,null,null,null,null,null,null,null,true,null,null,"Unit Profile","J18:J31","Unit Profile","J18:J31"]
[null,null,null,null,null,null,null,null,null,null,"user comments on the assessment sheet",true,null,null,{"$f":"Q18","v":"Assessment"},{"$f":"R18","v":"N15:S101"},"Assessment","N15:S101"]
[null,null,null,null,null,null,null,null,null,null,"completion date",true,null,null,"Summary",{"$f":"R19","v":"R16"},"Summary","R16"]
[null,null,null,null,null,null,null,null,null,null,"action plan stuff",true,null,null,"Action Plan","Z15:BB101","Action Plan","Z15:BB101"]
[null,null,null,null,null,null,null,null,null,null,"user assessments",null,null,null,"Assessment","AA15:AA101","Assessment","AP15:AP101"]
[null,null,null,null,null,null,null,null,null,null,"visibilities of assessment rows",null,null,"Vis","Assessment",{"$f":"P21","v":"AA15:AA101"},"Assessment",{"$f":"R21","v":"AP15:AP101"}]
[null,null,null,null,null,null,null,null,null,null,"visibility of the action plan sheet rows",null,null,"Vis","Action Plan",{"$f":"R23","v":"Z15:Z101"},"Action Plan","Z15:Z101"]
[null,null,null,null,null,null,null,null,null,null,"visibility of the comboboxes",null,null,"Combo","Assessment",1,"Assessment",42]

{"sheet":"Change Log","index":9,"n_rows":4,"n_cols":8,"rows_kept":4,"cut":false,"hidden":true,"merged":[[1,1,1,7]]}
["Change Management Log"]
[null,"The purpose of this sheet is to track any changes made to the PI Operating Environment tool v2.0 post go-live. [The approved baseline version was the go-live version that was distributed to the pilot groups on June 29, 2015 and is called PI Operating Environment Tool (v2.0) (development version1.95).]"]
[]
[null,"#","Version #","Worksheet (tab)","Description of the change made","Reason for change","Change Made By","Date of Change"]