Example assessment of business impacts to confidentiality, integrity, availability levels This shows an example of an assessment, and in this case the asset has been assessed as high BIL based on integrity, medium availability and low for confidentiality. The agency should consider existing controls required by the Information Security Policy (IS18) and whether these mandatory requirements treat assessed risk to a level that is tolerable to the information owner. If not, consider additional integrity controls. Note that establishing cumulative control sets for CIA high-low may simplify architecture. For example, an agency may choose to assess risk above baseline controls or create controls standards for classification, as follows: Low Medium High Confidentiality Assess Baseline Controls Baseline + Risk Assess ASD Cyber Security Man. – need for any additional + Risk Assess need for any agency controls. additional agency controls. Integrity Assess Baseline Controls Baseline + Risk Assess Baseline + Risk Assess need for any additional need for any additional agency controls. agency controls. Availability Assess Baseline Controls Baseline + Risk Assess Baseline + Risk Assess need for any additional need for any additional agency controls. agency controls. Or, it may be efficient for agencies create controls standards for some/all of the CIA configurations: Low Medium High Confidentiality C Controls Standard Low C Controls Standard Med C Controls Standard High (ASD - Cyber Security Man. Controls, plus agency controls) Integrity I Controls Standard Low I Controls Standard Med I Controls Standard High Availability A Controls Standard Low A Controls Standard Med A Controls Standard High
Example assessment of business impacts to confidentiality, integrity, availability levels This shows an example of an assessment, and in this case the asset has been assessed as high BIL based on integrity, medium availability and low for confidentiality. The agency should consider existing controls required by the Information Security Policy (IS18) and whether these mandatory requirements treat assessed risk to a level that is tolerable to the information owner. If not, consider additional integrity controls. Note that establishing cumulative control sets for CIA high-low may simplify architecture. For example, an agency may choose to assess risk above baseline controls or create controls standards for classification, as follows: Low Medium High Confidentiality Assess Baseline Controls Baseline + Risk Assess need for any additional agency controls. ASD – Cyber Security Man. + Risk Assess need for any additional agency controls. Integrity Assess Baseline Controls Baseline + Risk Assess need for any additional agency controls. Baseline + Risk Assess need for any additional agency controls. Availability Assess Baseline Controls Baseline + Risk Assess need for any additional agency controls. Baseline + Risk Assess need for any additional agency controls. Or, it may be efficient for agencies create controls standards for some/all of the CIA configurations: Low Medium High Confidentiality C Controls Standard Low C Controls Standard Med C Controls Standard High (ASD - Cyber Security Man. Controls, plus agency controls) Integrity I Controls Standard Low I Controls Standard Med I Controls Standard High Availability A Controls Standard Low A Controls Standard Med A Controls Standard High
QGISCF-v4.0.0.docx