CPF Data Security Guidelines

Upon creating a document in your PC/notebook, how do you classify it?

You may select more than 1 answer:

• Select the security classification based on the Restricted, Confidential, Secret, Top Secret (RCST) Framework

• Select the sensitivity classification based on Information Sensitivity (ISF) Framework (Non-Sensitive, Sensitive-Normal, Sensitive High)

• Apply the system default classification

• All of the above

What are the factors should you consider when classifying a document?

You may select more than 1 answer:

• Consider the impact of unauthorised disclosure of information to an agency interest and/or national security & interest

• Consider the impact of unauthorised disclosure of information to individual or business (excluding CPFB)

• Consider the impact of unauthorised disclosure of information to an agency's reputation

• All of the above

You have generated a report of members’ records. The report consists of members' personal information (e.g. names, NRIC, work email addresses, marital status, CPF balances and salary records, details of spouse and children etc.) What is the correct security and sensitivity classification of the report?

• Restricted, Sensitive Normal

• Official Open, Sensitive High

• Confidential, Non-Sensitive

• Official Closed, Sensitive High

For hardcopy files with restricted information (e.g. employer/ enforcement records), how do you keep them?

• Store them in an unlocked cabinet

• Leave them on the desk as the office is secured

• Store them in the cabinet using lock and key

• All of the above

Classified information refers to official information that is categorized under the following security classification:

• Official (Open)

• Confidential only

• Restricted and above

• Official (Closed) only

What do you do to the hardcopy classified information (i.e. when they are no longer needed?)

• Tear into pieces and trash it into the central waste bin

• Shred using cross-cut shredding machine which meets ISD requirements

• Tear and trash it into your personal waste bin

• Recycle the paper

What do you do to make sure that CPFB's information is protected?

• Proactively identify and escalate data security incidents or non-compliance to data security policies

• Locking away documents and electronic media containing classified information

• Shred classified documents that are no longer required

• All of the above

How do you send hardcopy documents that are classified “restricted or confidential” to external parties within Singapore?

• Seal the documents in the envelope. Inform the despatch officer to deliver it and obtain an acknowledgement receipt from the receiving party

• Seal the documents in double envelopes. Send it via commercial courier or Registered Post

• Seal the documents in the envelope and deliver by hand to the authorised officer without deviating from the authorised travel schedule and route

• All of the above

What do you do if you discover a suspected personal data breach in CPFB?

• Report the data breach to my supervisor and alert CPF-SIRT immediately

• Report the data breach to my supervisor, lodge a police report and alert CPF-SIRT

• Lodge a police report, alert my supervisor and CPF-SIRT after service recovery

• Do your own investigation and lodge a police report

In order to ensure that you email the correct information to the right party, what should you do?

• Check the recipient's name, email addresses/organisation (including those in the .cc list)

• Check your contents (including all attachments)

• Do not ignore email policy tips

• Delete those auto-email address that you will no longer need on a regular basis

• All of the above