Common use of END USER DEVICES Clause in Contracts

END USER DEVICES. 5.1 The Supplier shall manage, and shall ensure that all Sub-contractors manage, all end- user devices used by the Supplier on which Authority Data is Processed in accordance with the following requirements: (a) the operating system and any applications that Process or have access to Authority Data must be in current support by the vendor, or the relevant community in the case of Open Source operating systems or applications; (b) users must authenticate before gaining access; (c) all Authority Data must be encrypted using an encryption tool agreed to by the Authority; (d) the end-user device must lock and require any user to re-authenticate after a period of time that is proportionate to the risk environment, during which the end-user device is inactive; (e) the end-user device must be managed in a way that allows for the application of technical policies and controls over applications that have access to Authority Data; (f) the Suppler or Sub-contractor, as applicable, can, without physical access to the end-user device, remove or make inaccessible all Authority Data on the device and prevent any user or group of users from accessing the device; (g) all end-user devices are within in the scope of any current Cyber Essentials Plus certificate held by the Supplier, or any ISO/IEC 27001 or later (at least ISO/IEC 27001:2013) certification issued by a UKAS-approved certification body, where the scope of that certification includes the Services. 5.2 The Supplier shall comply, and ensure that all Sub-contractors comply, with the recommendations in NCSC Device Guidance and Authority Technical Security Guidance, as updated, amended or replaced from time to time, as if those recommendations were incorporated as specific obligations under this Agreement. 5.3 Where there any conflict between the requirements of this Error! Reference source not found. and the requirements of the NCSC Device Guidance, the requirements of this Schedule 6 takes precedence.

END USER DEVICES. 5.1 The Supplier shall manage, and shall ensure that all Sub-contractors manage, all end- user devices used by the Supplier on which Authority Data is Processed in accordance with the following requirements: (a) the operating system and any applications that Process or have access to Authority Data must be in current support by the vendor, or the relevant community in the case of Open Source operating systems or applications; (b) users must authenticate before gaining access; (c) all Authority Data must be encrypted using an encryption tool agreed to by the Authority; (d) the end-user device must lock and require any user to re-authenticate after a period of time that is proportionate to the risk environment, during which the end-user device is inactive; (e) the end-user device must be managed in a way that allows for the application of technical policies and controls over applications that have access to Authority Data; (f) the Suppler or Sub-contractor, as applicable, can, without physical access to the end-user device, remove or make inaccessible all Authority Data on the device and prevent any user or group of users from accessing the device; (g) all end-user devices are within in the scope of any current Cyber Essentials Plus certificate held by the Supplier, or any ISO/IEC 27001 or later (at least ISO/IEC 27001:2013) certification issued by a UKAS-approved certification body, where the scope of that certification includes the Services. 5.2 The Supplier shall comply, and ensure that all Sub-contractors comply, with the recommendations in NCSC Device Guidance and Authority Technical Security Guidance, as updated, amended or replaced from time to time, as if those recommendations were incorporated as specific obligations under this Agreement. 5.3 Where there any conflict between the requirements of this Error! Reference source not found. Schedule 6 and the requirements of the NCSC Device Guidance, the requirements of this Schedule 6 takes precedence.