Human deliberate internal (insider threats/staff/authorised third parties) – – or damage of Financial loss Legitimate access to register up to date (see CISS Section 2.5) equipment premises and Removal of all equipment and assets formally recorded (see equipment CISS Section 11.3) Disruption of operational activities Assets (keys and equipment) returned on termination of employment (see CISS Section 4.1) Equipment located to minimise unnecessary access (see CISS Section 11.3) Network connections and cabling protected, including segregation of power and communications cables, electromagnetic shielding, and documented setup of patching (seek technical advice for confirmation of these Portable devices policy and procedures enforced and monitored (see CISS Section 10) Leakage or theft of Violation of legislation Legitimate access to Confidentiality and non-disclosure agreements signed (see information or regulation systems CISS Section 3.4) Adverse effect on Agreements with parties including compliance with practice reputation policies signed (see CISS Section 3.5) Breach of confidentiality (potential information Access rights removed on termination of employment (see disclosure) CISS Section 4.5) Information securely deleted when equipment and assets disposed of (see CISS Section 11.5) Use of external and personal devices such as USBs controlled or prohibited (see CISS Section 10) Access control policy and procedure implemented and Employee sabotage Disruption of Legitimate access to monitored (see CISS Section 4) operational activities systems Breach of integrity Lack of policy and Breach reporting in place (see CISS Section 2.9) (potential information procedure monitoring modification or Access rights removed on termination of employment (see destruction) CISS Section 4.5) Access to system utilities limited (see CISS Section 11.8) Financial loss Access to systems Access control policy and procedure implemented and monitored (see CISS Section 4)
Human – deliberate – internal (insider threats/staff/authorised third parties) or damage of equipment Financial loss Disruption of operational activities Legitimate access to premises and equipment register up to date (see CISS Section 2.5) Removal of all equipment and assets formally recorded (see CISS Section 11.3) Assets (keys and equipment) returned on termination of employment (see CISS Section 4.1) Equipment located to minimise unnecessary access (see CISS Section 11.3) Network connections and cabling protected, including segregation of power and communications cables, electromagnetic shielding, and documented setup of patching (seek technical advice for confirmation of these Portable devices policy and procedures enforced and monitored (see CISS Section 10) Leakage or theft of information Violation of legislation or regulation Adverse effect on reputation Breach of confidentiality (potential information disclosure) Legitimate access to systems Confidentiality and non-disclosure agreements signed (see CISS Section 3.4) Agreements with parties including compliance with practice policies signed (see CISS Section 3.5) Access rights removed on termination of employment (see CISS Section 4.5) Information securely deleted when equipment and assets disposed of (see CISS Section 11.5) Use of external and personal devices such as USBs controlled or prohibited (see CISS Section 10) Employee sabotage Disruption of operational activities Breach of integrity (potential information modification or destruction) Legitimate access to systems Lack of policy and procedure monitoring Access control policy and procedure implemented and monitored (see CISS Section 4) Breach reporting in place (see CISS Section 2.9) Access rights removed on termination of employment (see CISS Section 4.5) Access to system utilities limited (see CISS Section 11.8) Financial loss Access to systems Access control policy and procedure implemented and monitored (see CISS Section 4)
RACGP_CISS_templates_word_version.docx