(1) The Authority may specify an information security policy setting out inter alia the technical and organisational measures to be adopted by the Authority and its personnel, and also security measures to be adopted by agencies, advisors, consultants and other service providers engaged by फिट Authority, Registrar, enrolling agency and requesting entities.
(2) Such information security policy may provide for,-
(a) identifying and maintaining an inventory of assets associated with the information and information processing facilities;
(b) implementing controls to prevent and detect any loss, damage, theft or compromise of the assets;
(c) allowing only controlled access to confidential information;
(व) implementing controls to detect and protect against virus/malwares;
(e) a change management process to ensure information security 15 maintained during changes;
(f) a patch management process to protect information systems from vulnerabilities and security risks;
(g) arobust monitoring process to identify unusual events and patterns that could impact security and performance of information systems and a proper reporting and mitigation process;
(h) partitioning of Jan-Aadhaar Resident Data Repository network into zones based on risk and trust;
(1) deploying necessary technical controls for protecting Jan-Aadhaar Resident Data Repository network;
() service continuity in case of a disaster;
(k) monitoring of equipment, systems and networks;
() measures for fraud prevention and effective remedies in case of fraud;
(m) requirement of entering into non-disclosure agreements with the personnel;
(n) provisions for audit of internal systems and networks;
(0) restrictions on personnel relating 10 processes, systems and networks;
(p) inclusion of security and confidentiality obligations in the agreements or arrangements with the agencies, consultants, advisors or other persons engaged by the Authority.
(3) The Authority shall monitor compliance with the information security policy and other security requirements through internal audits or through independent agencies.
(4) The Authority shall designate an officer as Chief Information Security Officer for disseminating and monitoring the information security policy and other security-related programs and initiatives of the Authority.