Compliance Checklist Data Vault/Mailbox Requirements Levels of Assurance Data Management Services (data vaults, mailboxes etc) – Minimal assurance Low assurance Moderate High assurance assurance Level 1 Level 2 3 Level 4 Minimal confidence Low confidence in Moderate High confidence in in the services the services confidence in the the services offered provided services provided provided. Important Achieving LoA 4 Assurance requires completion of the requirements for LOA1 LoA 3. – Where the Provider supports storage of digital copies of government issued credentials (eg passports or motor vehicle licences) these credentials remain the property of the issuing agency. Where the Provider supports storage of financial data such as credit card details, compliance with the Payment Card Industry Data Security Standard (PCI-DSS) will apply (see ). Where a Provider utilises secure data storage services from a third party the security and privacy controls must clearly identify the respective roles and responsibilities of both the Provider and third party. Note Providers must specify the physical location of data centres used to store personal information. Where a Provider utilises services outside Australia to store, backup, process, transmit, manage or otherwise support its Australian operations these must be clearly identified and included in the Provider’s security and privacy documentation. Agencies will apply a risk assessment process in making decisions to rely on data or credentials known to be stored by an individual outside Australia. REQUIREMENT LOA 1 LOA 2 LOA 3 LOA 4 Fully operational Published Liability Annual service Financial situation Services legal entity compliant Policy management audit sufficient for liability with all relevant legal Financial situation (external) see ASAE exposure – requirements sufficient for liability 3402: Assurance (independent including agency exposure (self Reports on Controls assessment by a specific legislation assessed). at a Service qualified accountant and policies (self Organisation who is a member of a assessed). records professional maintained for 36 accounting body) months Privacy Independent Privacy Impact Assessment (PIA) – see for further information. Demonstrated compliance with all National Privacy Principles (NPPs), the Information Privacy Principles (IPP’s) as applicable and all Australian Privacy
Compliance Checklist Data Vault/Mailbox Requirements Levels of Assurance – Data Management Services (data vaults, mailboxes etc) Minimal assurance Low assurance Moderate assurance High assurance Level 1 Level 2 3 Level 4 Minimal confidence in the services offered Low confidence in the services provided Moderate confidence in the services provided High confidence in the services provided. Important Achieving LoA 4 Assurance requires completion of the requirements for LOA1 – LoA 3. Where the Provider supports storage of digital copies of government issued credentials (eg passports or motor vehicle licences) these credentials remain the property of the issuing agency. Where the Provider supports storage of financial data such as credit card details, compliance with the Payment Card Industry Data Security Standard (PCI-DSS) will apply (see ). Where a Provider utilises secure data storage services from a third party the security and privacy controls must clearly identify the respective roles and responsibilities of both the Provider and third party. Note Providers must specify the physical location of data centres used to store personal information. Where a Provider utilises services outside Australia to store, backup, process, transmit, manage or otherwise support its Australian operations these must be clearly identified and included in the Provider’s security and privacy documentation. Agencies will apply a risk assessment process in making decisions to rely on data or credentials known to be stored by an individual outside Australia. REQUIREMENT LOA 1 LOA 2 LOA 3 LOA 4 Services Fully operational legal entity compliant with all relevant legal requirements including agency specific legislation and policies (self assessed). Published Liability Policy Financial situation sufficient for liability exposure (self assessed). Annual service management audit (external) – see ASAE 3402: Assurance Reports on Controls at a Service Organisation records maintained for 36 months Financial situation sufficient for liability exposure (independent assessment by a qualified accountant who is a member of a professional accounting body) Privacy Independent Privacy Impact Assessment (PIA) – see for further information. Demonstrated compliance with all National Privacy Principles (NPPs), the Information Privacy Principles (IPP’s) as applicable and all Australian Privacy
draft-commercial-service-provider.docx