Operational Framework Questionnaire The intent of this questionnaire is to develop a base understanding of the Security posture of Digital Service Provider (DSP) products and their supply chain arrangements. Question Applicable to Suitable Evidence AUSkey - Do you have an AUSkey? All SBR Software - Are you currently using SBR software with All If yes, details to be provided the ATO or other government departments? Personnel Security - Can you confirm that all personnel All Internal policy document who will have any access to ATO Taxpayer information Process description have satisfied a personnel security integrity check process? (i.e. Police Checks) System Certification - Can you supply the ATO with All iRAP letter of compliance current evidentiary documentation (iRAP or iRAP assessor engagement details conformance with ISO Standard 27001) demonstrating Independently assessed ISO 27001 certification the security posture of your product? (including Scoping documentation and Certificate of Compliance / Registration or Statement of Applicability with Certificate of Compliance / Registration) Self-prepared / conformance with ISO (including Scoping documentation and Certificate of Compliance / Registration or Statement of Applicability with Certificate of Compliance / Registration) Details of other certification Supply Chain Security - As part of your supply chain, will All If no - business details required: entity name, ABN, you be interacting directly with the ATO? service provider role / function (i.e. sending service provider, gateway) Hosting Environment Security - Can you verify that your Cloud / Name of the provider software product will use an ASD certified environment? Gateway Provider location (onshore / offshore), Redundancy location (Redundancy also onshore) required.
Operational Framework Questionnaire The intent of this questionnaire is to develop a base understanding of the Security posture of Digital Service Provider (DSP) products and their supply chain arrangements. Question Applicable to Suitable Evidence AUSkey - Do you have an AUSkey? All SBR Software - Are you currently using SBR software with the ATO or other government departments? All If yes, details to be provided Personnel Security - Can you confirm that all personnel who will have any access to ATO Taxpayer information have satisfied a personnel security integrity check process? (i.e. Police Checks) All Internal policy document Process description System Certification - Can you supply the ATO with current evidentiary documentation (iRAP or conformance with ISO Standard 27001) demonstrating the security posture of your product? All iRAP letter of compliance iRAP assessor engagement details Independently assessed ISO 27001 certification (including Scoping documentation and Certificate of Compliance / Registration or Statement of Applicability with Certificate of Compliance / Registration) Self-prepared / conformance with ISO (including Scoping documentation and Certificate of Compliance / Registration or Statement of Applicability with Certificate of Compliance / Registration) Details of other certification Supply Chain Security - As part of your supply chain, will you be interacting directly with the ATO? All If no - business details required: entity name, ABN, service provider role / function (i.e. sending service provider, gateway) Hosting Environment Security - Can you verify that your software product will use an ASD certified environment? Cloud / Gateway Name of the provider Provider location (onshore / offshore), Redundancy location (Redundancy also onshore) required.
Operational_Framework_Questionnaire.docx