Chapter 2 — Information at a leisure trust
Lesson map
Lesson 02 published. Map, example, EX004.
flowchart TD
N0["Learning outcomes"]
N1["2.1 What Riverbend holds"]
N2["2.2 Sensitivity"]
N3["2.3 Where it lives"]
N4["2.4 Paper and people"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX004"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 What Riverbend holds"]
N2["2.2 Sensitivity"]
N3["2.3 Where it lives"]
N4["2.4 Paper and people"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX004"]
[Learning outcomes]
|
v
[2.1 What Riverbend holds]
|
v
[2.2 Sensitivity]
|
v
[2.3 Where it lives]
|
v
[2.4 Paper and people]
|
v
[Worked example] --> [Exercise EX004]
Learning outcomes
You will (1) identify information a leisure trust holds; (2) rate its sensitivity; (3) trace where it is stored and who uses it.
2.1 What Riverbend holds
Jamal lists Riverbend's information: member names, addresses and contact details; payment card data processed at tills and online; direct debit bank details; gym health questionnaires; staff records and rotas; children's swimming lesson registers; and camera footage. Ms. Grant asks him to note who uses each type. Receptionists use member details, instructors use health questionnaires and finance staff use bank details. He learns that knowing who needs information is the starting point for deciding who should access it. He records each type in a table with its users.
2.2 Sensitivity
Jamal rates sensitivity using three questions from the security objectives: what harm if disclosed, altered or unavailable? Health questionnaires and children's registers are highly sensitive if disclosed. Bank details are sensitive to alteration, because changed details could divert payments. The booking system matters most for availability, since centres cannot admit members without it. FIPS 199 describes this approach of rating confidentiality, integrity and availability impact separately, and Jamal finds it useful for small organisations too. He adds a column to his table showing the most important objective for each type.
2.3 Where it lives
Jamal traces storage. Member data live in a cloud-hosted booking system. Health questionnaires are on paper in each gym office, then scanned to a shared drive. Swimming registers are printed daily. Camera footage is stored on recorders in each centre. He finds scanned questionnaires in a folder all staff can open. He reports this to Riverbend's IT manager, who restricts it to instructors and managers the same day. He adds a storage column to his table, noting for each type whether it is held in the cloud, on a shared drive, on paper or on a local device in a centre.
2.4 Paper and people
Not all information is digital. Printed registers left at poolside can be read by anyone passing. Jamal suggests clipboards with covers and collecting registers at the end of each session for secure disposal. Ms. Grant explains that information security covers paper and conversations too. Reception staff reading a member's details aloud in a queue can disclose information as easily as a hacked database. The centre manager tries the covered clipboards for a month and keeps them. Jamal also suggests that receptionists ask members to check details on a screen rather than reading them aloud, and two centres adopt this practice.
Worked example
Jamal lists Riverbend's information and users, rates sensitivity by objective, finds an over-shared questionnaire folder and suggests covering printed registers.
Synthetic case. Information types are synthetic.
Errors and limits
Scanned sensitive forms often end up in folders everyone can open.
Exercises
- EX004 — Health users. Who uses health questionnaires? Rubric: 3 = instructors;; 2 = partly correct;; 1 = other;; 0 = none.
- EX005 — Bank details risk. Which objective matters most for bank details? Rubric: 3 = integrity;; 2 = partly correct;; 1 = other;; 0 = none.
- EX006 — Folder fix. What happens to the questionnaire folder? Rubric: 3 = restricted to instructors and managers;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 02 (chapter 02 of 30)
← Chapter 01 · Course chapter index · Chapter 03 →
Continue to the next authored lesson.