Travel Security: advice and instruction (Employees)

The purpose of these travel guidelines and instructions is to increase employees’ awareness of their personal safety and information security, both in Norway and abroad. Many HiØ employees have access to information and assets that may be of interest to cybercriminals and foreign intelligence services. This may include research data, sensitive personal data or access to critical systems.

The appropriate travel advice and instructions will depend on the country you are travelling to and the situation you are in. It is therefore important to maintain safety-conscious behaviour that helps prevent unwanted incidents and enables you to respond appropriately if an incident occurs.

You are responsible for following HiØ’s procedures and assessing the risks associated with your travel.

Travel Advice for Personal Safety and Information Security

Before You Travel

Find information about the country you are travelling to

• Read the Norwegian Ministry of Foreign Affairs’ (MFA) travel advice for your destination. The MFA continuously assesses the situation in different countries. Information, including official travel advice, is available on the Norwegian Government’s travel information website.
• See the MFA’s information on consular assistance abroad.
• Read the Norwegian Police Security Service’s (PST) advice on safe travel (PDF).

Let others know where you are going

• Inform your immediate manager about your travel.
• Make sure your contact details and next-of-kin information are up to date.
• We recommend registering your trip with the Norwegian Ministry of Foreign Affairs at Reiseregistrering.no.
• We recommend preparing a personal emergency plan in case an unwanted incident or crisis occurs while you are abroad.

Information Security

• Only bring electronic equipment that is necessary for your trip.
• Make sure all digital devices are up to date and that encryption and other available security mechanisms are enabled. The IT Service Desk can assist you with this.
• Digital devices must only be used by the person authorised to use them. HiØ-owned equipment must not be lent to others.
• Remove all sensitive or security-classified information that is not required for the trip.

During Your Trip

• Always use a VPN when working with HiØ data. Avoid using unknown or unsecured Wi-Fi networks offered at cafés, hotels and similar locations.
• Maintain safety-conscious behaviour to reduce the risk of unwanted incidents.
• Keep yourself informed about the situation in the area where you are staying.
• Processing HiØ data on privately owned devices is only permitted if the device is handled securely and kept up to date at all times.
• If you must leave digital devices unattended, switch them off and store them securely, preferably in an approved tamper-evident bag. Tamper-evident bags are available from the IT Service Desk.
• Use biometric authentication where possible.
• Shield passwords and PIN codes from others when entering them.
• Exercise caution when transferring data, as communications may be intercepted.
• Avoid communicating sensitive information via SMS, MMS or regular telephone calls. Use HiØ’s approved digital platforms, such as Teams or Zoom, instead.
• Do not download or install new software. Avoid installing security updates during your stay unless you are connected through VPN and the update is considered critical.

After Returning Home

• Change all passwords and PIN codes if you suspect that a security incident may have occurred during your trip. Contact the IT Service Desk so that the necessary investigations can be carried out.
• Return any borrowed equipment to the IT Service Desk for reformatting.
• Report security incidents to your immediate manager and relevant security personnel.

Travel Instructions – If You Are Travelling to a High-Risk Country

Employees travelling to high-risk countries (China, Russia, Iran and North Korea) are required to follow all of the advice above, in addition to the following requirements.

Before Departure

• Complete a security and risk awareness briefing with your immediate manager and/or security personnel.
• Dedicated IT equipment must be used for travel to these countries. Contact the IT Service Desk well in advance of departure so that the necessary equipment can be prepared.
• Familiarise yourself with the Norwegian National Security Authority’s (NSM) security advice for travel.

During Your Trip

• Avoid leaving electronic devices unattended. If this cannot be avoided, use a tamper-evident bag.
• Do not download or install new software, and avoid installing security updates during your stay.

After Returning Home

• Change all passwords and PIN codes.
• Return all HiØ-owned equipment used during the trip to the IT Service Desk for reformatting.
• If necessary, a debriefing may be conducted with security personnel.

Personal Preparedness – When an Unwanted Incident or Crisis Occurs

If you are in an area affected by an accident, natural disaster or other serious incident:

• Get to a safe place.
• Follow advice and instructions from local authorities and the relevant Norwegian embassy or diplomatic mission.
• Contact your next of kin and keep them informed about your situation.
• Notify your immediate manager. If you are unable to reach your manager, call HiØ’s Security and Emergency Preparedness number on +47 22 88 14 53. The security provider will ensure that HiØ is notified.

In the event of a crisis or other unwanted incident:

• Prioritise your own safety and follow advice from local authorities, the relevant Norwegian embassy or diplomatic mission, and other relevant authorities.
• Call the appropriate local emergency number if necessary.
• Contact your next of kin and keep them informed about your situation.
• Contact the Norwegian Ministry of Foreign Affairs Emergency Response Centre (UDops) on +47 23 95 00 00 or by email at UDops@mfa.no for advice and assistance.
• You can contact the Norwegian Seamen’s Church emergency phone on +47 951 19 181 (24/7) for advice and assistance.
• Contact your immediate manager. If you are unable to reach your manager, call HiØ’s Security and Emergency Preparedness number on +47 22 88 14 53 (24/7). The security provider will ensure that your employer is notified.