The policies under this outcome outline how entities classify and handle official information to guard against information compromise. They also set out how to provide appropriate and secure access to official information, mitigate common and emerging cyber threats and safeguard official information and communication technology systems.
The 4 core requirements in these policies, and the accompanying supporting requirements, set out what entities must do to achieve the information security outcome.
Each entity maintains confidentiality, integrity and availability of all official information.
Policy 8: Sensitive and classified information
Each entity must:
- identify information holdings
- assess the sensitivity and security classification of information holdings
- implement operational controls for these information holding proportional to their value, importance and sensitivity.
- Official information
- Sensitive and security classified information
- Caveats and accountable material
- Information management markers
- Minimum protections for sensitive and security classified information
- Disposal of sensitive and security classified information
- Emergencies, breaches or security violations involving security classified information
- Minimum protections and handling requirements for sensitive and security classified information
Policy 9: Access to information
Each entity must enable appropriate access to official information. This includes:
- sharing information within the entity, as well as with other relevant stakeholders
- ensuring that those who access sensitive or security classified information have an appropriate security clearance and need to know that information
- controlling access (including remote access) to supporting ICT systems, networks, infrastructure, devices and applications.
- Internal and external information sharing
- The need-to-know principle
- Personnel security requirements for access to sensitive and security classified resources
- Temporary access to classified resources
- ICT access controls
Policy 10: Safeguarding information from cyber threats
Each entity must mitigate common and emerging cyber threats by:
- implementing the following mitigation strategies from the Strategies to Mitigate Cyber Security Incidents:
- application control
- patching applications
- restricting administrative privileges
- patching operating systems
- considering which of the remaining mitigation strategies from the Strategies to Mitigate Cyber Security Incidents you need to implement to protect your entity.
- Achieving PSPF maturity with the mandated mitigation strategies
- Implementing the Essential Eight and other Strategies to Mitigate Cyber Security Incidents
- Cyber security responsibilities when transacting online with the public
Policy 11: Robust ICT systems
Each entity must assess ensure the secure operation of their ICT systems to safeguard information and the continuous delivery of government business by applying the Australian Government Information Security Manual’s cyber security principles during all stages of the lifecycle of each system.
- Ensuring secure ICT systems at all stages of their lifecycle
- Authorising ICT systems to operate
- Secure internet gateways