ICT Security | United Nations Development Programme

Skip to main content

Programme and Operations
Policies and Procedures

Policy Areas
What's new
Index
Glossary

Search

Français
Español

Login

Policy Areas
What's new
Index
Glossary

Policy Areas

Programme and Project Management
Crisis Response
- Standard Operating Procedure for Crisis Response and Recovery
  - Standard Operating Procedure for Crisis Response and Recovery
- Financial Resources for Response
  - Allocation of TRAC 3 Resources for Crisis Engagements
Financial Resources Management
Human Resources Management
Procurement
Partnerships
Administrative Services
Accountability
Information and Communications Technology
Security

Select Language

Programme and Project Management
Crisis Response
Financial Resources Management
Human Resources Management
Procurement
Partnerships
Administrative Services
Accountability
Information and Communications Technology
Security

Programme and Project Management

Programming Standards
Design
Implement
Close
- Close and Transition

Crisis Response

Standard Operating Procedure for Crisis Response and Recovery
- Standard Operating Procedure for Crisis Response and Recovery
Financial Resources for Response
- Allocation of TRAC 3 Resources for Crisis Engagements

Financial Resources Management

Inventory Management
- Inventory Management
Cash Banking and Investment
Financial Closure of Development Projects and Trust Funds
Financial Management and Implementation Modalities
Financial Operations Management
- Corporate Operations and Information Management
- Statutory Financial Reporting
Pipeline and Revenue Management
Expense Management
Resource Planning and Cost Recovery
Working with External Auditors
- Working with External Auditors

Human Resources Management

Duties, Obligations and Privileges
- Standards of Conduct
  - UNDP Legal Framework for Addressing Non-Compliance with UN Standards of Conduct
- Harassment, Sexual Harassment, Discrimination, and Abuse of Authority
  - Harassment, Sexual Harassment, Discrimination, and Abuse of Authority
Classification of Posts
- Job Evaluation
Salaries and Related Allowances
Appointment and Promotion
Annual and Special Leave
Social Security
Travel and Removal Expenses
- Entitlement Travel
- Relocation Shipment
  - Relocation Shipment
Separation from Services
- Entitlements upon Separation
- Types of Separation
Disciplinary Measures and Appeals
- UNDP Legal Framework for Addressing Non-Compliance with UN Standards of Conduct
Non-Staff
Workforce Management
- Organizational Unit Restructuring
  - Organizational Unit Restructuring
- Performance Management
  - Performance Management and Development
  - Probation upon Appointment

Procurement

Procurement Overview
Procurement Strategy and Planning
- Procurement Forecasting and Delivery
- Transactional Procurement Strategies and Procurement Planning
Requisition
- Requisition and Procurement of Goods, Civil Works and Services
Sourcing of Suppliers
- Sourcing and Market Research
- Vendor Sanctions
Procurement Methods
- Procurement Methods
Innovation, CSO engagement
Solicitation Process
Evaluation of Offers and Pre-award Negotiations
- Evaluation of Offers
- Pre-Award Negotiations
Procurement Review Committees
- Procurement Oversight and Procurement Review Committees
Award and Management of Contract
Construction Works
- Construction Works
Individual Contract
- Individual Contract
Long Term Agreements (LTAs) and Cooperation with UN Entities
- Long Term Agreements (LTAs) and Cooperation with UN Entities

Partnerships

Managing Partnerships
- Managing Partnerships
Private Sector
- Policy on Due Diligence and Partnerships with the Private Sector
- Private Sector Partnerships
Foundations
- Foundations

Administrative Services

Asset Management - Property, Plant and Equipment
Asset Management (Intangible Assets)
- Intangible Assets
Vehicle Management
- Vehicle Management
Lease Management (Premises and Equipment)
Management of Local Presences
- Establishing UNDP-supported presence outside a country office
- Closing a Local Presence
Duty Travel
Corporate Purchasing Card
- Corporate Purchasing Card

Accountability

Accountability System Policy
- Accountability System Policy
Information Disclosure
- Information Disclosure
Internal Control Framework (ICF)
- Internal Control Framework
- Anti-Fraud Policy
Risk Management
- Enterprise Risk Management
- Anti-Money Laundering and Countering the Financing of Terrorism Policy
Business Continuity Management
- Business Continuity Management
Delegation of Authorities
- Delegation of Authorities
- Participation and Role of UNDP Delegates at Major International Conferences and Events
Ethics
Evaluation
- Evaluation Policy
Managing Prescriptive Content
- Managing Prescriptive Content

Information and Communications Technology

ICT Security
ICT Oversight
- Change Control and Release Management Standards
Enterprise Solutions
Global Services
- UNDP ICT Standards

Security

Framework of Accountability for Security
- Framework of Accountability for Security
Security Policy
- Security Policy
Commercial Air Travel Safety
- Commercial Air Travel Safety Guidelines

Home
Information and Communications Technology
ICT Security

ICT Security

Main navigation

Menu

ICT Security
ICT Oversight
- Change Control and Release Management Standards
Enterprise Solutions
Global Services
- UNDP ICT Standards

Policies

POLICY

Information Classification and Handling

POLICY

Information Security Policy

POLICY

Personal Data Protection and Privacy Policy

POLICY

Electronic Signatures Policy

POLICY

System Acquisition, Development and Maintenance Standards

POLICY

ICT Disaster Recovery Standards for UNDP Offices

POLICY

System Logon Banner Standards

POLICY

Bring Your Own Device and Acceptable Usage of ICT Resources

Policy updates

System Acquisition, Development and Maintenance Standards 15 November 2024 ICT Security	The Cybersecurity Standard on Cloud Acquisition, Maintenance, and Termination of Cloud Services offers guidelines, security controls and other considerations to securing UNDP data stored on cloud services platforms throughout their lifecycle, from acquisition to maintenance to termination. The objectives of the new standard are to:Protect sensitive data and systems from unauthorized access, use, disclosure, disruption, modification, or destruction.Remain cognizant of data privacy regulations and industry standards.Reduce UNDP’s risk exposure to cloud-related security incidents.Ensure cloud ser ... The Cybersecurity Standard on Cloud Acquisition, Maintenance, and Termination of Cloud Services offers guidelines, security controls and other considerations to securing UNDP data stored on cloud services platforms throughout their lifecycle, from acquisition to maintenance to termination. The objectives of the new standard are to: Protect sensitive data and systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Remain cognizant of data privacy regulations and industry standards. Reduce UNDP’s risk exposure to cloud-related security incidents. Ensure cloud services are appropriately secured and managed throughout their lifecycle. EXPAND
ICT Disaster Recovery Standards for UNDP Offices 7 March 2024 ICT Security	The Disaster Recovery Plan Template is now available in French and in Spanish.
ICT Disaster Recovery Standards for UNDP Offices \| Electronic Funds Transfer Standards \| Electronic Signatures Policy \| Quantum User Access Standards ICT Disaster Recovery Standards for UNDP Offices \| Electronic Funds Transfer Standards \| Electronic Signatures Policy \| Quantum User Access Standards EXPAND 9 January 2023 ICT Security \| Enterprise Solutions	The following policies have been updated to reflect UNDP’s transition to its new cloud-based management platform Quantum in January 2023, replacing its previous ATLAS system. ICT Disaster Recovery Standards for UNDP Offices and the related ICT Disaster Recovery Plan templateElectronic Funds Transfer StandardsElectronic Signatures and the related List of systems and tools for electronic systems and approvalsQuantum User Access Standards
Information Security Policy 17 December 2022 ICT Security	The policy was changed in order to implement industry best practices in cybersecurity for the protection of personally identifiable information. These changes are compliant with ISO 27701 and help implement the requirements of tithe UNDP privacy policy for the protection of personal data.- The new version of the UNDP Information Security Policy takes into account the provisions of the new UNDP Data Protection and Privacy policy as well as the recommended industry best practices for managing personally identifiable information (PII) as defined in ISO 27701.- The new version designates the UNDP ... The policy was changed in order to implement industry best practices in cybersecurity for the protection of personally identifiable information. These changes are compliant with ISO 27701 and help implement the requirements of tithe UNDP privacy policy for the protection of personal data. - The new version of the UNDP Information Security Policy takes into account the provisions of the new UNDP Data Protection and Privacy policy as well as the recommended industry best practices for managing personally identifiable information (PII) as defined in ISO 27701. - The new version designates the UNDP Chief Information Security Officer role as the party responsible for governance and monitoring of privacy safeguards within the BMS/ITM. It also explicitly designates BMS/ITM as a custodian (aka PII Processor) and not the owner of the PII data. - The new policy section on PII also contains policy statements compliant with the ISO 27701 privacy standard for industry best practices. EXPAND
Information Classification and Handling 26 July 2022 ICT Security	The purpose of the Information Classification and Handling policy is to guide project/programme implementation when handling data, to be embedded throughout the data lifecycle to ensure UNDP implements the highest ethical standards for data protection and privacy. Protection of personal data is essential to upholding fundamental rights to privacy and the UN system-wide personal data protection and privacy principles. Strong policies on information handling and classification and on personal data protection and privacy are critical for operating efficiently, considering opportunities and risks ... The purpose of the Information Classification and Handling policy is to guide project/programme implementation when handling data, to be embedded throughout the data lifecycle to ensure UNDP implements the highest ethical standards for data protection and privacy. Protection of personal data is essential to upholding fundamental rights to privacy and the UN system-wide personal data protection and privacy principles. Strong policies on information handling and classification and on personal data protection and privacy are critical for operating efficiently, considering opportunities and risks in the use of personal data, including in combination with evolving technologies. EXPAND

VIEW MORE

United Nations
Development Programme

Twitter
LinkedIn
Facebook
Instagram
Youtube

© 2024 United Nations Development Programme

About the Portal
Contact Us
Terms of Use