Information security

SLU has a responsibility to adopt technical and organisational security measures for sensitive information based on risk assessments and in accordance with applicable legislation. SLU’s research and environmental monitoring and assessment data must therefore be managed to protect against unauthorised access (confidentiality), undesirable distortions (accuracy) and be accessible and usable based on the needs of the activity (accessibility).

The information-security management of research and environmental monitoring and assessment data must follow a systematic and risk-based process. The first step in the process is to classify the information using the SLU method of information classification. The primary purpose of the information classification is to determine the need for protection of information vis-a-vis confidentiality, accuracy and accessibility. The main principle is that data producers, such as researchers, are responsible for implementing the information classification. The head of department or equivalent manager of operations is responsible for the information classification of research and environmental monitoring and assessment data.

The information-security regulations of the Swedish Civil Contingencies Agency state that a public authority shall carry out risk assessments for its cognisance. The risk assessment identifies, analyses and evaluates undesirable events and consequences that may affect information security. Risk assessments can be carried out at different levels, for example for a research project or for a specific set of information. In addition, the General Data Protection Regulation (GDPR) requires an impact assessment to be carried out when a personal data processing operation’s risk to its data subjects is considered high. To support risk assessment work, SLU provides templates and instructions for risk management. The head of department or equivalent is responsible for integrating risk management as part of the information security of research and environmental monitoring and assessment data.

The results of the information classification and risk assessment are the basis for the selection and design of security measures.

Guidelines for the selection of security measures can be found in SLU's catalogue for information and IT security requirements (xlsm).

The security measures implemented must be appropriate and continuously evaluated throughout the life cycle of the information.

More information and support on information security

• For questions regarding information security, please contact sakerhet@slu.se.
• The entire process of information classification, risk assessment and selection of security measures is covered in SLU's digital training in information security for information owners. Links to the course can be found on the page Information security training.