Table 2 Suggested coverage for security plan Governance Information (including Personnel security Physical security arrangements ICT) security Suggested coverage for Suggested coverage for Suggested coverage for Suggested coverage for governance arrangements: information security: personnel security: physical security: roles and classification and personnel security access control systems responsibilities management provisions during security monitoring risk tolerances arrangements for recruitment in and alarm systems security risk information holdings conjunction with human measures to increase management (including access to information resource management security if the National threat, vulnerability and including sharing security clearance Terrorism Alert Level criticality assessments) information maintenance plans that or entity-specific security incidents ICT access and system address risks identified by threats increase. security culture security security vetting agencies security awareness cyber security to security assessment training mitigate targeted position list security monitoring intrusions contact reporting reporting security information handling security clearance maturity within the entity as well aftercare contracted service as when in transit or out ongoing security providers. of the office. awareness training managing the separation of personnel. When developing or reviewing the security plan (and supporting security plans), entities are encouraged to seek advice and technical assistance from specialist entities such as: Australian Security Intelligence Organisation for threat assessments ASIO-T4 Protective Security for physical security advice or technical assistance local police for state and territory criminal threat information Australian Government Security Vetting Agency for security vetting procedural advice Australian Signals Directorate for ICT, cyber security and certified cloud services advice subject-matter experts. Security planning for projects The Attorney-General’s Department recommends that security is considered during all stages of project management and planning. This is particularly important for projects that involve: major acquisitions establishment of infrastructure or major modifications to existing infrastructure information that is: sensitive in nature or security classified proprietary in nature or meets the financial and economic impact threshold with a business impact of low to medium (level two) or higher. Security plan – goals and objectives Security is everyone’s responsibility, however, overall accountability for security planning and risk management rests with the entity’s accountable authority, supported by the CSO. Security arrangements support an entity’s business objectives by identifying and managing risks that could adversely affect achieving those objectives. The accountable authority and CSO determine the security arrangements required for:
Table 2 Suggested coverage for security plan Governance arrangements Information (including ICT) security Personnel security Physical security Suggested coverage for governance arrangements: roles and responsibilities risk tolerances security risk management (including threat, vulnerability and criticality assessments) security incidents security culture security awareness training security monitoring reporting security maturity contracted service providers. Suggested coverage for information security: classification and management arrangements for information holdings access to information including sharing information ICT access and system security cyber security to mitigate targeted intrusions information handling within the entity as well as when in transit or out of the office. Suggested coverage for personnel security: personnel security provisions during recruitment in conjunction with human resource management security clearance maintenance plans that address risks identified by security vetting agencies security assessment position list contact reporting security clearance aftercare ongoing security awareness training managing the separation of personnel. Suggested coverage for physical security: access control systems security monitoring and alarm systems measures to increase security if the National Terrorism Alert Level or entity-specific threats increase. When developing or reviewing the security plan (and supporting security plans), entities are encouraged to seek advice and technical assistance from specialist entities such as: Australian Security Intelligence Organisation for threat assessments ASIO-T4 Protective Security for physical security advice or technical assistance local police for state and territory criminal threat information Australian Government Security Vetting Agency for security vetting procedural advice Australian Signals Directorate for ICT, cyber security and certified cloud services advice subject-matter experts. Security planning for projects The Attorney-General’s Department recommends that security is considered during all stages of project management and planning. This is particularly important for projects that involve: major acquisitions establishment of infrastructure or major modifications to existing infrastructure information that is: sensitive in nature or security classified proprietary in nature or meets the financial and economic impact threshold with a business impact of low to medium (level two) or higher. Security plan – goals and objectives Security is everyone’s responsibility, however, overall accountability for security planning and risk management rests with the entity’s accountable authority, supported by the CSO. Security arrangements support an entity’s business objectives by identifying and managing risks that could adversely affect achieving those objectives. The accountable authority and CSO determine the security arrangements required for:
pspf-govsec-03-security-planning-risk-management.DOCX