Module 2: Security and access This module considers the level of security and access needed for the digital approval process based on the security classification of the information or data, its value and the risks associated with it. Your agency’s own internal policies and procedures, consistent with the Australian Government’s Information Security Manual and Note: Protective Security Policy Framework should also be used in conjunction with the following questions to determine appropriate controls for the approval process. to the Module 2: Security and access Question Considerations Y/N For responses For responses ‘Yes’ ’No’ 1 Role-based access control Consider the applicable access or Identify and document Continue to Q2. Does the requestor or approver need to be in a approval authorities for the position details and controls specific position to carry out an approval action? position responsible for required to out undertaking the approval. approvals. Does it require a certain position in a workflow, as it has the Continue to Q2. financial delegation to approve. 2 Privacy Consider any potential issues for You must be able to ensure Continue to Q3. Does the approval involve classified, sensitive or inappropriate disclosure of the approval process meets personal information or data that requires security-classified or sensitive the requirements of the protection? information. Australian Privacy Principles The Australian Privacy Principles and any agency-specific outline how to handle, use and requirements (including manage personal information. compliance with Australian Government policy).
Module 2: Security and access This module considers the level of security and access needed for the digital approval process based on the security classification of the information or data, its value and the risks associated with it. Note: Your agency’s own internal policies and procedures, consistent with the Australian Government’s Information Security Manual and Protective Security Policy Framework should also be used in conjunction with the following questions to determine appropriate controls for the approval process. to the Module 2: Security and access Question Considerations Y/N For ‘Yes’ responses For ’No’ responses 1 Role-based access control Does the requestor or approver need to be in a specific position to carry out an approval action? Consider the applicable access or approval authorities for the position responsible for undertaking the approval. Does it require a certain position in a workflow, as it has the financial delegation to approve. Identify and document position details and controls required to out approvals. Continue to Q2. Continue to Q2. 2 Privacy Does the approval involve classified, sensitive or personal information or data that requires protection? Consider any potential issues for inappropriate disclosure of security-classified or sensitive information. The Australian Privacy Principles outline how to handle, use and manage personal information. You must be able to ensure the approval process meets the requirements of the Australian Privacy Principles and any agency-specific requirements (including compliance with Australian Government policy). Continue to Q3.
DigitalAuthorisationsFramework-August2018.docx