Solutions Suggested appropriate solutions and mitigation Person Threat/risk source Disruption/impact Vulnerability Required strategies responsible Existing (to action) deliberate - external – Asset register up to date (see CISS Section 2.5) Theft or damage of Financial loss Inadequate physical equipment controls of system and Disruption of operational activities network Equipment effectively physically protected, including limited access to critical resources such as server (see CISS Section 11.3) Removal of all equipment and assets formally recorded (see CISS Section 11.3) Assets (keys and equipment) returned on termination of employment (see CISS Section 4.1) Equipment located to minimise unnecessary access (see CISS Section 11.3) Network connections and cabling protected, including segregation of power and communications cables, electromagnetic shielding, and documented set up of patching (seek technical advice confirmation of these) Portable devices policy and procedures enforced and monitored (see CISS Section 10) Theft of information Violation of legislation Lack of appropriate Access control policy and procedures in place (see CISS or regulation access control Section 4) Adverse effect on Limited network reputation controls Use of external and personal devices such as USBs Breach of confidentiality controlled or prohibited (see CISS Section 10) Breach reporting to authorities in place (see CISS Section 2.9) Perimeter controls including firewalls and IDS security effective (see CISS Section 9) Secure messaging and transfer of information using encryption and authentication in place (see CISS Section 12.2)
Threat/risk source Disruption/impact Vulnerability Suggested appropriate solutions and mitigation strategies Solutions Person responsible Existing Required (to action) – deliberate - external Theft or damage of equipment Financial loss Disruption of operational activities Inadequate physical controls of system and network Asset register up to date (see CISS Section 2.5) Equipment effectively physically protected, including limited access to critical resources such as server (see CISS Section 11.3) Removal of all equipment and assets formally recorded (see CISS Section 11.3) Assets (keys and equipment) returned on termination of employment (see CISS Section 4.1) Equipment located to minimise unnecessary access (see CISS Section 11.3) Network connections and cabling protected, including segregation of power and communications cables, electromagnetic shielding, and documented set up of patching (seek technical advice confirmation of these) Portable devices policy and procedures enforced and monitored (see CISS Section 10) Theft of information Violation of legislation or regulation Adverse effect on reputation Breach of confidentiality Lack of appropriate access control Limited network controls Access control policy and procedures in place (see CISS Section 4) Use of external and personal devices such as USBs controlled or prohibited (see CISS Section 10) Breach reporting to authorities in place (see CISS Section 2.9) Perimeter controls including firewalls and IDS security effective (see CISS Section 9) Secure messaging and transfer of information using encryption and authentication in place (see CISS Section 12.2)
RACGP_CISS_templates_word_version.docx