Storage and Use an encryption Use an Evaluation electronic product that Assurance Level (EAL) transmission of implements a DACA 2 encryption product personal information as per ISM from DSD’s Evaluated requirements Products List (EPL) practical, that has completed a cryptographic DCE see for further – products must information. provide a means of Data centres used data recovery to store personal Use an encryption information must be product that located in Australia. implements a DACP to communicate sensitive information over public network infrastructure see – for further information Demonstrate an Compliance with Physical security Physical security appropriate physical the PSPF Physical arrangements security environment Security Protocol at certified by for the protection of Gatekeeper business assets and Authorised Physical processes Security Evaluator – Documented see Physical Security Policy as part of overall SRMP Personnel Security Compliance with Documented Vetting of PERSEC 1 in the PSPF Personnel Security personnel and (self assessment). Management Plan contractors in including: verification Positions of Trust in of qualifications, accordance with police records check, AS4811-2006: referee checks, Employment identity verification. Screening including appropriate personnel security aftercare arrangements PCI-DSS requirements Not allowed Not allowed Completion of the for storage of Attestation of payment card data Compliance with the Payment Card Industry Data Security Standard (PCI DSS).by a Qualified Security Assessor (QSA). Authentication Requirements National e-Authentication Framework (NeAF) Levels of Assurance Identity/Attributes – Minimal assurance Low assurance Moderate assurance High assurance 1 Level 2 Level 3 Level 4
Storage and electronic transmission of personal information Use an encryption product that implements a DACA as per ISM requirements practical, cryptographic products must provide a means of data recovery Use an encryption product that implements a DACP to communicate sensitive information over public network infrastructure – see for further information Use an Evaluation Assurance Level (EAL) 2 encryption product from DSD’s Evaluated Products List (EPL) that has completed a DCE – see for further information. Data centres used to store personal information must be located in Australia. Physical security Demonstrate an appropriate physical security environment for the protection of business assets and processes Documented Physical Security Policy as part of overall SRMP Compliance with the PSPF Physical Security Protocol at Physical security arrangements certified by Gatekeeper Authorised Physical Security Evaluator – see Personnel Security Compliance with PERSEC 1 in the PSPF (self assessment). Documented Personnel Security Management Plan including: verification of qualifications, police records check, referee checks, identity verification. Vetting of personnel and contractors in Positions of Trust in accordance with AS4811-2006: Employment Screening including appropriate personnel security aftercare arrangements PCI-DSS requirements for storage of payment card data Not allowed Not allowed Completion of the Attestation of Compliance with the Payment Card Industry Data Security Standard (PCI DSS).by a Qualified Security Assessor (QSA). Authentication Requirements National e-Authentication Framework (NeAF) Levels of Assurance – Identity/Attributes Minimal assurance Low assurance Moderate assurance High assurance 1 Level 2 Level 3 Level 4
draft-commercial-service-provider.docx