Search
Policy Areas

Recently updated

Filter and Sort

Recently updated

The policy was changed in order to implement industry best practices in cybersecurity for the protection of personally identifiable information. These changes are compliant with ISO 27701 and help implement the requirements of tithe UNDP privacy policy for the protection of personal data.- The new version of the UNDP Information Security Policy takes into account the provisions of the new UNDP Data Protection and Privacy policy as well as the recommended industry best practices for managing personally identifiable information (PII) as defined in ISO 27701.- The new version designates the UNDP ...

The policy was changed in order to implement industry best practices in cybersecurity for the protection of personally identifiable information. These changes are compliant with ISO 27701 and help implement the requirements of tithe UNDP privacy policy for the protection of personal data.
- The new version of the UNDP Information Security Policy takes into account the provisions of the new UNDP Data Protection and Privacy policy as well as the recommended industry best practices for managing personally identifiable information (PII) as defined in ISO 27701.
- The new version designates the UNDP Chief Information Security Officer role as the party responsible for governance and monitoring of privacy safeguards within the BMS/ITM. It also explicitly designates BMS/ITM as a custodian (aka PII Processor) and not the owner of the PII data.
- The new policy section on PII also contains policy statements compliant with the ISO 27701 privacy standard for industry best practices.


A straightforward change in paragraph 98 has been made to maintain coherence. The Director, OIMT will make a statement of compliance. Streamlined content with ISO standards. Procedures have been created under 3.0 for step-by-step guidance for user access management.

​TheCO and RO ICT Security Guidelines have been launched in first quarter of 2009. They provide security guidelines for UNDP Country and Regional Offices. ICT managers, in cooperation with administrative officers, RIOs or RRs and other appropriate personnel, must conduct an annual review of user and system operation practices to evaluate compliance against existing BOM OIST security protocols and procedures. These security best practices and protocols may also assist regionally-based personnel (for example, RIM, Regional Director, etc.) and OAI/LSO personnel when visiting Country Offices.