Implementation Guidance Portable Storage Remote Access Sanitisation and Marking Description Devices Re-use Information authorised for Labelling or No special controls No special controls Public unlimited public access and of devices applicable applicable. circulation, such as agency according to publications and web sites. classification is Such information should still recommended per controls 0332-0336 be accompanied by Integrity in the ISM. and Availability classifications. Information is only available for PSDs only be Dual phase For Official Media should be wiped in official use by South Australian connected to password control Use Only alignment with or Australian Government systems with an (Remote Access ISMF Standard 60. personnel (including authorised equal or greater login and system contractors). The public release classification per login) plus Post sanitisation media of this information may be control 0337 in the transmission classifications for authorised by an agency head ISM. encryption as magnetic media or agency policy. described in the and for non-volatile flash Password control ISM. memory are described in plus basic the ISM. encryption shall Compromise could cause Sensitive Responsible apply. Additional limited damage to the State, the Parties (legislation mechanisms for Government, an agency, observe the cited) Information marked commercial entities or members authentication as Protected of the public. (refer control should include use Sensitive: requirements S19.13 in the ISMF) of strong ciphers Personal described by ISMF and additional key Standard 86 files. Sensitive: Compromise could cause moderate damage to the State, Cryptographic Legal Cryptographic (encryption) the Government, commercial controls and mechanisms must Sensitive: entities or members of the guidance are be enabled in Commercial public. described in the alignment with the ISM. Cryptography Sensitive: chapter in the ISM. Medical Compromise could cause PSD use not Secure wipe per ISM *or* Sensitive: significant damage to the State, permitted without destruction of media per SA Cabinet the Government, commercial formal exemption the relevant sections of entities or members of the process and the ISM. Sensitive: public. Sensitive: Cabinet authorisation by Cabinet materials received from the Agency Chief Australian Government must be Executive. classified as [P] Protected. Classification Description [P] Protected The PROTECTED security classification is used when the compromise of the information could cause damage to the Australian Government including states and territories, commercial entities or members of the public. For instance, where compromise could:
Implementation Guidance Marking Description Portable Storage Devices Remote Access Sanitisation and Re-use Public Information authorised for unlimited public access and circulation, such as agency publications and web sites. Such information should still be accompanied by Integrity and Availability classifications. Labelling or of devices according to classification is recommended per controls 0332-0336 in the ISM. No special controls applicable No special controls applicable. For Official Use Only Information is only available for official use by South Australian or Australian Government personnel (including authorised contractors). The public release of this information may be authorised by an agency head or agency policy. PSDs only be connected to systems with an equal or greater classification per control 0337 in the ISM. Password control plus basic encryption shall apply. Additional mechanisms for Information marked as Protected should include use of strong ciphers and additional key files. Cryptographic controls and guidance are described in the ISM. Dual phase password control (Remote Access login and system login) plus transmission encryption as described in the ISM. Media should be wiped in alignment with ISMF Standard 60. Post sanitisation media classifications for magnetic media and for non-volatile flash memory are described in the ISM. Sensitive (legislation cited) Sensitive: Personal Compromise could cause limited damage to the State, the Government, an agency, commercial entities or members of the public. (refer control S19.13 in the ISMF) Responsible Parties observe the authentication requirements described by ISMF Standard 86 Cryptographic (encryption) mechanisms must be enabled in alignment with the Cryptography chapter in the ISM. Sensitive: Legal Sensitive: Commercial Sensitive: Medical Compromise could cause moderate damage to the State, the Government, commercial entities or members of the public. Sensitive: SA Cabinet Sensitive: Cabinet Compromise could cause significant damage to the State, the Government, commercial entities or members of the public. Sensitive: Cabinet materials received from the Australian Government must be classified as [P] Protected. PSD use not permitted without formal exemption process and authorisation by Agency Chief Executive. Secure wipe per ISM *or* destruction of media per the relevant sections of the ISM. Classification Description [P] Protected The PROTECTED security classification is used when the compromise of the information could cause damage to the Australian Government including states and territories, commercial entities or members of the public. For instance, where compromise could:
ISMF-v3.3.docx