The policies under this outcome outline how entities classify and handle official information to guard against information compromise. They also set out how to provide appropriate and secure access to official information, mitigate common and emerging cyber threats and safeguard official information and communication technology systems.
The 4 core requirements in these policies, and the accompanying supporting requirements, set out what entities must do to achieve the information security outcome.
Each entity maintains confidentiality, integrity and availability of all official information.
Policy 8: Classification system
Each entity must:
- identify information holdings
- assess the sensitivity and security classification of information holdings
- implement operational controls for these information holding proportional to their value, importance and sensitivity.
- Official information
- Sensitive and security classified information
- Caveats and accountable material
- Information management markers
- Minimum protections for sensitive and security classified information
- Disposal of sensitive and security classified information
- Emergencies, breaches or security violations involving security classified information
- Minimum protections and handling requirements for sensitive and security classified information
Policy 9: Access to information
Each entity must enable appropriate access to official information. This includes:
- sharing information within the entity, as well as with other relevant stakeholders
- ensuring that those who access sensitive or security classified information have an appropriate security clearance and need to know that information
- controlling access (including remote access) to supporting ICT systems, networks, infrastructure, devices and applications.
- Internal and external information sharing
- The need-to-know principle
- Personnel security requirements for access to sensitive and security classified resources
- Temporary access to classified resources
- ICT access controls
Policy 10: Safeguarding data from cyber threats
Each entity must mitigate common cyber threats by:
- implementing the following mitigation strategies from the Strategies to Mitigate Cyber Security Incidents:
- application control
- patch applications
- configure Microsoft Office macro settings
- user application hardening
- restrict administrative privileges
- patch operating systems
- multi-factor authentication
- regular backups
- considering which of the remaining mitigation strategies from the Strategies to Mitigate Cyber Security Incidents need to be implemented to achieve an acceptable level of residual risk for their entity.
- Achieving PSPF maturity with the mandated mitigation strategies
- Implementing the Essential Eight and other strategies to mitigate cyber security incidents
- Cyber security responsibilities when transacting online with the public
Policy 11: Robust ICT systems
Each entity must assess ensure the secure operation of their ICT systems to safeguard information and the continuous delivery of government business by applying the Australian Government Information Security Manual's cyber security principles during all stages of the lifecycle of each system.
- Ensuring secure ICT systems at all stages of their lifecycle
- Authorising ICT systems to operate
- Secure internet gateways