1.2 Is or will the Document the details of Document where the The authoritative version is the agreed source of information or information or data: the information or data authoritative source of data to be shared within your agency that is deemed reliable be the authoritative held in the system, i.e. information or data is held. • and trustworthy. source of what and why it is the An example of a system that manages the authoritative source relied on to create authoritative source of If you have answered No • of truth is the whole of government Parliamentary Workflow the authoritative information. for 1.1 as well, the Solution. record, or information and data held in Examples of systems where information or data are generally feed into a system Continue to Question 1.3 the system has been • 'saved into' the authoritative system such as email to EDRMS that holds the assessed as low and or a case management system. authoritative source of risk and therefore does not information or data? require further assessment. Document the outcome in your systems information management plan. No. Question Considerations Response For responses For responses ‘Yes’ ‘No’ (Y/N) 1.3 Is the risk or value of Document the details of Continue to Question 1.5 Answering this question will depend on your risk tolerance. If the information or data the and value of the the value of the information or data in the business system is high enough to warrant information or data in the not sufficient, or if the risks associated with the information is additional controls to system and whether it is within your stated risk tolerance, then the trustworthiness of the ensure that it is the authoritative source. information may not need to be assessed as a priority. trustworthy? Document the additional To determine the of risk, think about how critical the controls in place to reduce information or data is to the performance of your agency's risks and ensure the functions. If situations where you have to demonstrate that information and data's your information or data is authentic, reliable and has integrity trustworthiness. are likely, you need to ensure that you can demonstrate these characteristics when asked. Examples of these may include: You will need to complete Module 1: Information is FOI requests audits trusted in Phase 2. inquiries (including Royal Commissions of Inquiry) Continue to Question 1.4 legal proceedings. Note: A yes response should be recorded for any systems that manage information or data identified as 'Retain as National
1.2 Is or will the information or data: • be the authoritative source of • relied on to create the authoritative record, or • feed into a system that holds the authoritative source of information or data? The authoritative version is the agreed source of information or data to be shared within your agency that is deemed reliable and trustworthy. An example of a system that manages the authoritative source of truth is the whole of government Parliamentary Workflow Solution. Examples of systems where information or data are generally 'saved into' the authoritative system such as email to EDRMS or a case management system. Document the details of the information or data held in the system, i.e. what and why it is the authoritative source of information. Continue to Question 1.3 Document where the authoritative source of information or data is held. If you have answered No for 1.1 as well, the information and data held in the system has been assessed as low and risk and therefore does not require further assessment. Document the outcome in your systems information management plan. No. Question Considerations Response (Y/N) For ‘Yes’ responses For ‘No’ responses 1.3 Is the risk or value of the information or data high enough to warrant additional controls to ensure that it is trustworthy? Answering this question will depend on your risk tolerance. If the value of the information or data in the business system is not sufficient, or if the risks associated with the information is within your stated risk tolerance, then the trustworthiness of the information may not need to be assessed as a priority. To determine the of risk, think about how critical the information or data is to the performance of your agency's functions. If situations where you have to demonstrate that your information or data is authentic, reliable and has integrity are likely, you need to ensure that you can demonstrate these characteristics when asked. Examples of these may include: FOI requests audits inquiries (including Royal Commissions of Inquiry) legal proceedings. Note: A yes response should be recorded for any systems that manage information or data identified as 'Retain as National Document the details of the and value of the information or data in the system and whether it is the authoritative source. Document the additional controls in place to reduce risks and ensure the information and data's trustworthiness. You will need to complete Module 1: Information is trusted in Phase 2. Continue to Question 1.4 Continue to Question 1.5