Confidentiality and Information Security Management Toolkit © OECD 2020 Table of Contents
Total Page：16
File Type：pdf, Size：1020Kb
Confidentiality and Information Security Management Toolkit © OECD 2020 Table of contents This work is published under the responsibility of the Secretary‑General of the OECD. The opinions expressed and arguments employed herein do not necessarily reflect Abbreviations and acronyms 2 the official views of member countries of the OECD or of members of the Global Forum on Transparency and Preface 3 Exchange of Information for Tax Purposes. About this toolkit 4 This document and any map included herein are without 1. INTRODUCTION 5 prejudice to the status of or sovereignty over any territory, to the delimitation of international frontiers and Confidentiality and data safeguarding as pillars boundaries and to the name of any territory, city or area. of tax information exchange 5 The use of this work, whether digital or print, is governed Ensuring developing countries also benefit by the Terms and Conditions to be found at from AEOI 6 http://www.oecd.org/termsandconditions. A toolkit to assist developing country tax administrations’ confidentiality and data safeguarding 6 The AEOI Standard and the Global Forum’s assessment Core Requirements and Sub‑requirements 6 2. LEGAL FRAMEWORK TO ENSURE CONFIDENTIALITY AND APPROPRIATE USE OF EXCHANGED INFORMATION (CORE REQUIREMENT 3.1) 8 Requirements in international exchange agreements 8 Sub‑requirement 3.1.1: Legal framework that ensures the confidentiality and proper use of information exchanged 10 Legal framework protecting the confidentiality of taxpayer information, including exchanged information 10 Appropriate disclosure and use of exchanged information in line with international exchange agreements 11 3. INFORMATION SECURITY MANAGEMENT FRAMEWORK THAT ADHERES TO INTERNATIONALLY RECOGNISED STANDARDS OR BEST PRACTICES (CORE REQUIREMENT 3.2) 13 The need for an ISM framework 13 Internationally recognised standards or best This toolkit was prepared by the Secretariat of the Global practices 13 Forum on Transparency and Exchange of Information for Tax Purposes. Table of contents An ISM framework for tax information exchange 14 Sub‑requirement 3.2.5: Protection of information 64 Key steps for the implementation of Lifecycle of information 65 an ISM framework 15 SR 3.2.5.1. General information lifecycle controls 65 Step 1: Scoping of the ISM framework 15 SR 3.2.5.2. Protection of exchanged information 79 Step 2: Defining an ISM policy 16 Sub‑requirement 3.2.6: Operations management Step 3: Identification of security risks 16 framework, including incident management, Step 4: Establishing specific policies, processes and change management, monitoring and audit 82 procedures in relevant areas 16 SR 3.2.6.1. General outline of security operations Step 5: Training of personnel 16 management framework 82 Step 6: Check the effective uptake of the ISM system 16 SR 3.2.6.2. Log management 84 SR 3.2.6.3. Operational management of IT security risks 87 Sub‑requirement 3.2.1: Overall ISM framework 17 SR 3.2.6.4. Vulnerability management 88 SR 3.2.1.1. Clear understanding the lifecycle of exchanged information and commitment to SR 3.2.6.5. Change management 89 safeguard its confidentiality and appropriate use 17 SR 3.2.6.6. Incident management 91 SR 3.2.1.2. ISM policy, leadership and commitment, SR 3.2.6.7. Internal and external audit function 92 and organisational framework 20 SR 3.2.1.3. ISM system 24 4. ENFORCEMENT PROVISIONS AND SR 3.2.1.4. Information security risk management 25 PROCESSES TO ADDRESS CONFIDENTIALITY BREACHES (CORE REQUIREMENT 3.3) 94 SR 3.2.1.5. Business Continuity Management 27 Sub‑requirement 3.2.2: Human resources controls 29 Sub‑requirement 3.3.1: Sanctions for improper Personnel lifecycle 30 disclosure or use of taxpayer information 94 SRs 3.2.2.1 and 3.2.2.2. Stage 1: Recruitment controls 31 Sub‑requirement 3.3.2: Processes to deal with SRs 3.2.2.3 and 3.2.2.4. Stage 2: Controls that relate to suspected or actual breaches or other non the ongoing employer‑employee relationship 34 compliance, including effectively applying sanctions 95 SR 3.2.2.5. Stage 3: Controls that relate to the termination of employment 37 SR 3.3.2.1. Processes when there is a suspected or actual breach, to ensure reporting and investigation 96 Sub‑requirement 3.2.3: Access controls, SR 3.3.2.2. Resources, processes and procedures to including physical and logical access 38 take remedial action and apply appropriate sanctions Overarching principles of access management 39 where issues are identified 97 SRs 3.2.3.1 and 3.2.3.2. Physical access security 40 SR 3.3.2.3. Notifying foreign competent authorities of SRs 3.2.3.3 and 3.2.3.4. Logical access 43 breaches of confidentiality of exchanged information 97 Sub‑requirement 3.2.4: IT system security 48 SR 3.3.2.4 Review of security controls, monitoring and enforcement processes in response to non‑compliance 98 SR 3.2.4.1. Make security an integral part of providing IT services 48 ANNEXES 100 SR 3.2.4.2. Deploy an appropriate range of IT security controls 50 Annex A. Glossary of concepts 101 SR 3.2.4.3. Management of IT assets and services, and service level management 55 Annex B. Useful resources 106 SR 3.2.4.4. Management of supplier service delivery 59 Relevant information on international standards on tax transparency and exchange of information 106 SR 3.2.4.5. Assuring the continuity of IT services based on Service Level Agreements 61 Model international exchange agreements 107 CONFIDENTIALITY AND INFORMATION SECURITY MANAGEMENT TOOLKIT 1 Abbreviations and acronyms Abbreviations and acronyms AEOI Automatic Exchange of Information EOI Exchange of Information AML Anti‑money laundering EOIR Exchange of Information on Request AUP Acceptable Use Policy ETR Exchange of Tax Rulings BCM Business Continuity Management FI Financial Institution BCP Business Continuity Plan Global Forum Global Forum on Transparency and Exchange of Information for Tax Purposes BEPS Base Erosion and Profit Shifting ISM Information Security Management BIA Business Impact Analyses ISO Information Security Officer CCTV Closed‑Circuit TV IT Information Technology CDP Clean/Clear Desk Policy ITSC Information Technology Service Continuity CoE Council of Europe MAAC Convention on Mutual Administrative Assistance in Tax Matters as Amended by the 2010 Protocol CMDB Configuration Management Database MCAA Multilateral Competent Authority Agreement CR Core Requirement OECD Organisation for Economic Co‑operation and Development CRS Common Reporting Standard PDCA Plan; Do; Check; Act DLP Data Loss Prevention SIEM Security Information and Event Management DMZ De‑Militarised Zone SLA Service Level Agreement DR Disaster Recovery SOC Security Operations Centre DRP Disaster Recovery Plan SR Sub‑requirement 2 CONFIDENTIALITY AND INFORMATION SECURITY MANAGEMENT TOOLKIT Preface Preface Information confidentiality and security is essential to the relationship between tax administrations and taxpayers around the world. It also underpins the exchange of information in tax matters between governments, one of Maria José Garde the pillars of the international taxation system and the Chair of the Global Forum multilateral efforts to combat tax evasion and avoidance. The international community would not have endorsed the Standard for Automatic Exchange of Financial Account Information in Tax Matters, leading to unprecedented global improvement in tax compliance, without its extensive confidentiality and information security management (ISM) requirements. The Global Forum on Transparency and Exchange of Information for Tax Purposes (Global Forum) has worked since 2014 to monitor, peer review and support members implementing the AEOI Standard. Checking and supporting Zayda Manatta compliance with the confidentiality requirements has been Head of the Global Forum at the heart of this work. Secretariat Collectively, members have taken note of the fact that tax administrations around the world take ISM very seriously. Through the multilateral review and support process, a global picture has emerged of the confidentiality laws and ISM good practices already in place across member jurisdictions, and how their tax administrations incorporate international security standards into their operations. As we aim to ensure more developing countries can benefit from AEOI, this Confidentiality and ISM toolkit has been developed to offer guidance on the key ISM good practices that form the backbone of the Global Forum’s standards in this area. We hope that all tax administrations, and particularly developing countries aspiring to implement the AEOI Standard and other forms of exchange, will make good use of this guidance to continuously strengthen their handling of exchanged data and other types of data. CONFIDENTIALITY AND INFORMATION SECURITY MANAGEMENT TOOLKIT 3 About this toolkit About this toolkit The aim of this Confidentiality and ISM toolkit (the • Part 2 provides guidance to help jurisdictions ensure “toolkit”) is to assist countries that wish to participate their legal framework on the confidentiality of in the automatic exchange of information (AEOI) by taxpayer information is adequate and protects the ensuring that they meet good practice standards in confidentiality and appropriate use of information confidentiality and data safeguarding. It provides exchanged under an international exchange general guidance on implementing legal and agreement. information security management (ISM) frameworks that ensure the confidentiality of taxpayer information, • Part 3 presents guidance to help developing including information exchanged under international countries’ tax administrations implement the agreements (“exchanged information”), in line with the building blocks of an ISM framework that adheres requirements of the Standard for Automatic Exchange to internationally recognised standards or best of Financial Account Information in Tax Matters or practices, as required by the AEOI Standard. This “AEOI Standard”.1 The implementation of good practice section is divided into six key areas of ISM (“Sub ISM frameworks is also relevant to other types of requirements”) into which the Global Forum’s exchange, such as the exchange of information on requirements are organised.