Audit summary of Security of Infrastructure Control Systems for Water and Transport
|
|
|
- Clara Ward
- 9 years ago
- Views:
Transcription
1 V I C T O R I A Victorian Auditor-General Audit summary of Security of Infrastructure Control Systems for Water and Transport Tabled in Parliament 6 October 2010
2 Background Infrastructure critical to the provision of essential water and transport services includes the physical assets, facilities, distribution systems, information technologies and communication networks. This infrastructure relies on control and management systems, such as Supervisory Control and Data Acquisition (SCADA) systems. SCADA systems are usually computer-based. Computer interconnectivity has increased since the 1990s, especially the use of the internet, which has revolutionised the way that the government and broader community communicate and do business. While the benefits of this widespread interconnectivity have been enormous, it also exposes computer systems, and the essential services and critical infrastructure they support, to major security risks. If not properly controlled, the increased speed and accessibility that benefits intended users can also give unauthorised individuals and organisations access to operational information that is used for mischievous or malicious purposes, including fraud or sabotage. The Longford gas crisis in 1998 and the electronic attacks on the Maroochy Shire sewerage control system in Queensland in 2000, highlight the need to manage and promote the security and protection of critical infrastructure. If exploited, unauthorised access to infrastructure control systems has the potential to disrupt or disable the provision of essential services. The Australian Security and Intelligence Organisation warns that Australia faces ongoing threats from terrorism, espionage, and foreign interference, including cyber threats. The ability to keep delivering essential community services depends on a number of factors, including effective computer system security controls and procedures that either prevent unauthorised access or detect and respond to security breaches. This audit examined the security of infrastructure control systems at selected water and transport operators and oversight of these operators by relevant portfolio agencies. Victorian Auditor-General s Report Security of Infrastructure Control Systems for Water and Transport vii
3 Conclusions The risk of unauthorised access to water and transport infrastructure control systems is high. This access could compromise these systems and affect the stable delivery of essential services to the community. Operators do not have: the physical and electronic controls to detect and prevent inappropriate access to their infrastructure control systems appropriate governance arrangements, such as risk, emergency and business continuity management, policies and procedures, and monitoring and reporting mechanisms to assure management that their infrastructure control systems are secure. Operators are not fully aware of the weaknesses in, and risks to their infrastructure control systems. The responsible oversight agencies, the Department of Sustainability and Environment (DSE), Department of Transport (DOT), and Victoria Police are not fully aware of the weaknesses in infrastructure control systems used by operators for the delivery of essential services. This is because: these agencies are not actively monitoring and guiding operators in the management of infrastructure control systems there is a lack of clarity among operators about their roles and responsibilities, and those of the oversight agencies, in securing infrastructure control systems. Findings Securing infrastructure control systems Operators are not properly securing their infrastructure control systems. As a result, staff and external parties can inappropriately access and manipulate these systems. Operators recognise this situation, and are developing strategies to address it. Security processes and controls are not satisfactory and appropriate and do not comply with relevant industry standards, such as: Standards Australia AS/NZS ISO/IEC 27001:2005 Information technology, Security techniques Information security management systems (ISO 27001) Standards Australia AS/NZS ISO/IEC 27002:2005 Security techniques Code of practice for information security management (ISO 27002). In addition, operators do not have: provisions in their contracts with external parties accessing their infrastructure, that address security requirements procedures to monitor and control external-party access to infrastructure control systems. viii Security of Infrastructure Control Systems for Water and Transport Victorian Auditor-General s Report
4 With the exception of one out of the five operators reviewed, security-related design considerations are not incorporated into operators procurement processes for new infrastructure control systems. Where security requirements are considered by operators, the requirements are determined without reference to an existing security standard. Operator governance arrangements While operators have established governance arrangements to help them effectively manage their businesses, there is little evidence that infrastructure control system security issues and details of major security breaches were being discussed with operator boards and senior management for consideration and action. This is not surprising given that most operators do not have a central person or group that takes responsibility for infrastructure control system security. While all operators had developed risk management frameworks and established many of the framework components, none had effective processes to manage the risks to their infrastructure control systems. None of the operators were fully compliant with the risk management requirements of the Terrorism (Community Protection) Act In addition, the audit revealed that: operators do not have comprehensive up-to-date policies and procedures to manage infrastructure control system security information collected and reported to management about security breaches, non-compliance with policies and procedures, information and communication technology (ICT) risks and infrastructure control system vulnerabilities is inadequate operators are not adequately monitoring and controlling the infrastructure control systems that external parties manage on their behalf. Establishing response capabilities The quality of operators emergency response and business continuity plans varied. Overall, they do not adequately address issues associated with infrastructure control systems. If a security breach shut these systems down, essential services may be lost for an unacceptable period. Departmental oversight DSE and DOT do not: actively monitor operator security management of infrastructure control systems have mechanisms to assure themselves that security breaches and incidents are reported and acted on use suitably qualified and experienced staff to advise operators about securing infrastructure control systems and managing cyber risks review and provide feedback on security-related documents, such as risk management, business continuity and emergency response plans. DOT does, however, review operator risk management plans. Victorian Auditor-General s Report Security of Infrastructure Control Systems for Water and Transport ix
5 Recommendations Given the sensitive nature of the audit findings, we have provided details of security weaknesses identified and associated recommendations to each operator and the responsible departments, which are not included in this report. The following generic recommendations apply to all operators of critical infrastructure and providers of essential services, and oversight agencies. Number Recommendation Page 1. Operators should rigorously review the security of their 22 infrastructure control systems against the relevant state and international security standards and implement improvements, where required. 2. The Department of Sustainability and Environment should: 33 increase its monitoring of operator ICT and infrastructure control system risk, and business continuity management use suitably qualified and experienced staff from within the department to provide advice to operators on infrastructure control system security and risk, and business continuity management. 3. The Department of Transport should establish an ICT security team. It should be comprised of suitably qualified and experienced staff to provide advice to operators on infrastructure control system security and risk, and business continuity management. 33 Submissions and comments received In addition to progressive engagement during the course of the audit, in accordance with section 16(3) of the Audit Act 1994 a copy of this report, or relevant extracts from the report, was provided to the Department of Transport, the Department of Sustainability and Environment, Victoria Police, and the Department of Premier and Cabinet, with a request for submissions or comments. Agency views have been considered in reaching our audit conclusions and are represented to the extent relevant and warranted in preparing this report. Their full section 16(3) submissions and comments however, are included in Appendix A. x Security of Infrastructure Control Systems for Water and Transport Victorian Auditor-General s Report
Audit summary of Business Continuity Management in Local Government
V I C T O R I A Victorian Auditor-General Audit summary of Business Continuity Management in Local Government Tabled in Parliament 1 September 2010 Local councils provide a wide range of services. Disruptions
How To Manage Risk On A Scada System
Risk Management for Industrial Control Systems (ICS) And Supervisory Control Systems (SCADA) Information For Senior Executives (Revised March 2012) Disclaimer: To the extent permitted by law, this document
AUDITOR GENERAL S REPORT. Protection of Critical Infrastructure Control Systems. Report 5 August 2005
AUDITOR GENERAL S REPORT Protection of Critical Infrastructure Control Systems Report 5 August 2005 Serving the Public Interest Serving the Public Interest THE SPEAKER LEGISLATIVE ASSEMBLY THE PRESIDENT
WoVG Information Security Management Framework
WoVG Information Security Management Framework Victorian Auditor-General s Report November 2013 2013 14:12 V I C T O R I A Victorian Auditor-General WoVG Information Security Management Framework Ordered
NSW Government Digital Information Security Policy
NSW Government Digital Information Security Policy Version: 1.0 Date: November 2012 CONTENTS PART 1 PRELIMINARY... 3 1.1 Scope... 3 1.2 Application... 3 1.3 Objectives... 3 PART 2 CORE REQUIREMENTS...
Department of the Premier and Cabinet Circular. PC030 Protective Security Policy Framework
Department of the Premier and Cabinet Circular PC030 Protective Security Policy Framework February 2012 PROTECTIVE SECURITY MANAGEMENT FRAMEWORK TABLE OF CONTENTS TABLE OF CONTENTS 2 1. PURPOSE 3 2. SCOPE
Managing internet security
Managing internet security GOOD PRACTICE GUIDE Contents About internet security 2 What are the key components of an internet system? 3 Assessing internet security 4 Internet security check list 5 Further
Security Management of Government Buildings
GUIDELINE Security Management of Government Buildings The Queensland Government has a responsibility to ensure its services are resilient to all foreseeable risks. In the context of security management,
for Critical Infrastructure Protection Supervisory Control and Data Acquisition SCADA SECURITY ADVICE FOR CEOs
for Critical Infrastructure Protection Supervisory Control and Data Acquisition SCADA SECURITY ADVICE FOR CEOs EXECUTIVE SUMMARY Supervisory Control and Data Acquisition (SCADA) systems are used for remote
External Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
Victorian Government Risk Management Framework. March 2015
Victorian Government Risk Management Framework March 2015 This document reproduces parts of the AS/NZS ISO 31000:2099 Risk Management Principles and Guidelines. Permission has been granted by SAI Global
ACT Auditor-General s Office. Performance Audit Report. Whole-of-Government Information and Communication Technology Security Management and Services
ACT Auditor-General s Office Performance Audit Report Whole-of-Government Information and Communication Technology Security Management and Services Report No. 2 / 2012 PA 09/03 The Speaker ACT Legislative
The UK cyber security strategy: Landscape review. Cross-government
REPORT BY THE COMPTROLLER AND AUDITOR GENERAL HC 890 SESSION 2012-13 12 FEBRUARY 2013 Cross-government The UK cyber security strategy: Landscape review 4 Key facts The UK cyber security strategy: Landscape
RUAG Cyber Security. More security for your data
RUAG Cyber Security More security for your data More security in cyberspace The RUAG Cyber Security Portfolio offers greater protection for your data through inspection, event analysis and decision-making
Report to Parliament No. 4 for 2011 Information systems governance and security. Financial and Assurance audit. Enhancing public sector accountability
Financial and Assurance audit Report to Parliament No. 4 for 2011 Information systems governance and security ISSN 1834-1128 Enhancing public sector accountability RTP No. 4 cover.indd 1 15/06/2011 3:19:31
ICT Security Incident Policy ITD 5.3-02
ICT Security Incident Policy ITD 5.3-02 Published by the Information Technology Division Department of Education and Early Childhood Development Melbourne September 2011 State of Victoria (Department of
Western Australian Auditor General s Report. Information Systems Audit Report
Western Australian Auditor General s Report Information Systems Audit Report Report 10 June 2012 Auditor General s Overview The Information Systems Audit Report is tabled each year by my Office. It summarises
HMG Security Policy Framework
HMG Security Policy Framework Security Policy Framework 3 Foreword Sir Jeremy Heywood, Cabinet Secretary Chair of the Official Committee on Security (SO) As Cabinet Secretary, I have a good overview of
OVERVIEW. In all, this report makes recommendations in 14 areas, such as. Page iii
The Office of the Auditor General has conducted a procedural review of the State Data Center (Data Center), a part of the Arizona Strategic Enterprise Technology (ASET) Division within the Arizona Department
Tasmanian Government Information Security Framework
Tasmanian Government Information Security Framework Tasmanian Government Information Security Charter Version 1.0 May 2003 Department of Premier and Cabinet Inter Agency Policy And Projects Unit 1 Purpose
SECURITY INCIDENT REPORTING AND MANAGEMENT. Standard Operating Procedures
SECURITY INCIDENT REPORTING AND MANAGEMENT Standard Operating Procedures Notice: This document has been made available through the Police Service of Scotland Freedom of Information Publication Scheme.
The President s Critical Infrastructure Protection Board. Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
cover_comp_01 9/9/02 5:01 PM Page 1 For further information, please contact: The President s Critical Infrastructure Protection Board Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
Department of Treasury & Finance. Victorian Government Risk Management Framework
Victorian Government Risk Management Framework July 2007 Table of contents Table of contents... i Foreword... 1 1 Overview... 2 2 Introduction... 3 3 Purpose... 3 4 Coverage and application... 4 5 Adoption
Head of Information & Communications Technology Responsible work team: ICT Security. Key point summary... 2
Policy Procedure Information security policy Policy number: 442 Old instruction number: MAN:F005:a1 Issue date: 24 August 2006 Reviewed as current: 11 July 2014 Owner: Head of Information & Communications
E-SECURITY REVIEW 2008 DISCUSSION PAPER FOR PUBLIC CONSULTATION
1. Introduction E-SECURITY REVIEW 2008 DISCUSSION PAPER FOR PUBLIC CONSULTATION Australia s national security and economic and social well-being rely upon the use and availability of a range of Information
Information Management Advice 35: Implementing Information Security Part 1: A Step by Step Approach to your Agency Project
Information Management Advice 35: Implementing Information Security Part 1: A Step by Step Approach to your Agency Project Introduction This Advice provides an overview of the steps agencies need to take
Protective Security Governance Policy. Outlines ANAO protective security arrangements
Protective Security Governance Policy Outlines ANAO protective security arrangements Version 2.0 Effective JULY 2012 Document management Document identification Document ID Document title Release authority
Enterprise Risk Management Framework 2012 2016. Strengthening our commitment to risk management
Enterprise Risk Management Framework 2012 2016 Strengthening our commitment to risk management Contents Director-General s message... 3 Introduction... 4 Purpose... 4 What is risk management?... 4 Benefits
Cyber security standard
Cyber security standard Brief description This *Standard specifies security standards that protect *ICT systems and data from unintended or unauthorized access, damage or destruction. Related policies
NSW Government Digital Information Security Policy
NSW Government Digital Information Security Policy Version: 2.0 Date: April 2015 CONTENTS PART 1 PRELIMINARY... 3 1.1 Scope... 3 1.2 Application... 3 1.3 Objectives... 3 PART 2 POLICY STATEMENT... 4 Core
Compliance Review Report Internal Audit and Risk Management Policy for the New South Wales Public Sector
Compliance Review Report Internal Audit and Risk Management Policy for the New South Wales Public Sector Background The Treasury issued TPP 09-05 Internal Audit and Risk Management Policy for the New South
How To Protect Decd Information From Harm
Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the
august09 tpp 09-05 Internal Audit and Risk Management Policy for the NSW Public Sector OFFICE OF FINANCIAL MANAGEMENT Policy & Guidelines Paper
august09 09-05 Internal Audit and Risk Management Policy for the NSW Public Sector OFFICE OF FINANCIAL MANAGEMENT Policy & Guidelines Paper Preface Corporate governance - which refers broadly to the processes
Polish Financial Supervision Authority. Guidelines
Polish Financial Supervision Authority Guidelines on the Management of Information Technology and ICT Environment Security for Insurance and Reinsurance Undertakings Warsaw, 16 December 2014 Table of Contents
CONTROL AND COMPLIANCE AUDITS
V I C T O R I A Auditor-General of Victoria CONTROL AND COMPLIANCE AUDITS Payroll management and Administration of the goods and services tax March 2003 Ordered to be printed by Authority. Government Printer
GAO. INFORMATION SECURITY Persistent Weaknesses Highlight Need for Further Improvement
GAO For Release on Delivery Expected at time 1:00 p.m. EDT Thursday, April 19, 2007 United States Government Accountability Office Testimony Before the Subcommittee on Emerging Threats, Cybersecurity,
Information System Audit Guide
Australian Government Department of Defence Information System Audit Guide VERSION 11.1 January 2012 Commonwealth of Australia 2011 Page 1 TABLE OF CONTENTS 1. INTRODUCTION TO ACCREDITATION...4 2. THE
The Danish Cyber and Information Security Strategy
February 2015 The Danish Cyber and Information Security Strategy 1. Introduction In December 2014 the Government presented a National Cyber and Information Security Strategy containing 27 government initiatives
Agenda. Introduction to SCADA. Importance of SCADA security. Recommended steps
Agenda Introduction to SCADA Importance of SCADA security Recommended steps SCADA systems are usually highly complex and SCADA systems are used to control complex industries Yet.SCADA systems are actually
Cyber Security: Threat & The Maritime Environment Cyber Security: now byting the maritime industry
Cyber Security: Threat & The Maritime Environment Cyber Security: now byting the maritime industry Templar Executives NIAS 2007 DHR 2008 IAMM 2008 1 st CSS 2009 2 nd CSS 2011 Advising Government & Industry
Standards, quality processes and accountability
Standards, quality processes and accountability Delivering and coordinating planning and infrastructure for the community are achieved through a strong management structure that is supported by management
Policy Title: HIPAA Security Awareness and Training
Policy Title: HIPAA Security Awareness and Training Number: TD-QMP-7011 Subject: HIPAA Security Awareness and Training Primary Department: TennDent/Quality Monitoring/Improvement Effective Date of Policy:
Are controls to prevent, detect and respond to security breaches effective? Is the risk to business continuity being managed appropriately?
Introduction 1. Security of critical IT 1.1 The nature of the risk The failure or disruption of the day-to-day delivery of essential services to the community can cause a significant loss of brand and
AUSTRALIAN GOVERNMENT INFORMATION MANAGEMENT OFFICE CYBER SECURITY CAPABILITY FRAMEWORK & MAPPING OF ISM ROLES
AUSTRALIAN GOVERNMENT INFORMATION MANAGEMENT OFFICE CYBER SECURITY CAPABILITY FRAMEWORK & MAPPING OF ISM ROLES Final Report Prepared by Dr Janet Tweedie & Dr Julie West June 2010 Produced for AGIMO by
NATIONAL CYBERSECURITY STRATEGIES: AUSTRALIA AND CANADA
NATIONAL CYBERSECURITY STRATEGIES: AUSTRALIA AND CANADA JOÃO MANUEL ASSIS BARBAS Coronel de Artilharia. Assessor de Estudos do IDN INTRODUCTION Globalization and information and communication technologies
Protective security governance guidelines
Protective security governance guidelines Reporting incidents and conducting security investigations Approved 13 September 2011 Version 1.0 Commonwealth of Australia 2011 All material presented in this
TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY
IT FIREWALL POLICY TABLE OF CONTENT 1. INTRODUCTION... 3 2. TERMS AND DEFINITION... 3 3. PURPOSE... 5 4. SCOPE... 5 5. POLICY STATEMENT... 5 6. REQUIREMENTS... 5 7. OPERATIONS... 6 8. CONFIGURATION...
Asset Management and Maintenance by Councils
Asset Management and Maintenance by Councils Victorian Auditor-General s Report February 2014 2013 14:22 V I C T O R I A Victorian Auditor-General Asset Management and Maintenance by Councils Ordered
CYBER SECURITY AND RISK MANAGEMENT. An Executive level responsibility
CYBER SECURITY AND RISK MANAGEMENT An Executive level responsibility Cyberspace poses risks as well as opportunities Cyber security risks are a constantly evolving threat to an organisation s ability to
ISO 27000 Information Security Management Systems Foundation
ISO 27000 Information Security Management Systems Foundation Professional Certifications Sample Questions Sample Questions 1. is one of the industry standards/best practices in Service Management and Quality
A practical guide to IT security
Data protection A practical guide to IT security Ideal for the small business The Data Protection Act states that appropriate technical and organisational measures shall be taken against unauthorised or
Understanding SCADA System Security Vulnerabilities
Understanding SCADA System Security Vulnerabilities Talking Points Executive Summary Common Misconceptions about SCADA System Security Common Vulnerabilities Affecting SCADA Networks Tactics to Strengthen
Australian Government Information Security Manual CONTROLS
2014 Australian Government Information Security Manual CONTROLS 2014 Australian Government Information Security Manual CONTROLS Commonwealth of Australia 2014 All material presented in this publication
Data Governance Policy. Staff Only Students Only Staff and Students. Vice-Chancellor
Name of Policy Description of Policy Policy applies to Data Governance Policy To establish proper standards to assure the quality and integrity of University data. This policy also defines the roles and
Managing Risk in Procurement Guideline
Guideline DECD 14/10038 Managing Risk in Procurement Guideline Summary The Managing Risk in Procurement Guideline assists in the identification and minimisation of risks involved in the acquisition of
Cyber Attacks: Securing Agencies ICT Systems
The Auditor-General Audit Report No.50 2013 14 Performance Audit Cyber Attacks: Securing Agencies ICT Systems Across Agencies Australian National Audit Office Commonwealth of Australia 2014 ISSN 1036 7632
Cybersecurity Awareness. Part 1
Part 1 Objectives Discuss the Evolution of Data Security Define and Discuss Cybersecurity Review Threat Environment Part 1 Discuss Information Security Programs s Enhancements for Cybersecurity Risks Threat
The Management of Physical Security
The Auditor-General Audit Report No.49 2013 14 Performance Audit Australian Crime Commission Geoscience Australia Royal Australian Mint Australian National Audit Office Commonwealth of Australia 2014 ISSN
Section A: Introduction, Definitions and Principles of Infrastructure Resilience
Section A: Introduction, Definitions and Principles of Infrastructure Resilience A1. This section introduces infrastructure resilience, sets out the background and provides definitions. Introduction Purpose
Cloud Computing and Records Management
GPO Box 2343 Adelaide SA 5001 Tel (+61 8) 8204 8773 Fax (+61 8) 8204 8777 DX:336 [email protected] www.archives.sa.gov.au Cloud Computing and Records Management June 2015 Version 1 Version
CIO, CISO and Practitioner Guidance IT Security Governance
CIO, CISO and Practitioner Guidance IT Security Governance June 2006 (Revision 1, August 2007) 1 CIO, CISO and Practitioner Guidance Whatever your business, security and privacy are key matters that affect
Information Security Policy
Office of the Prime Minister document CIMU P 0016:2003 Version: 2.0 Effective date: 01 Oct 2003 Information 1. statement i) General The Public Service of the Government of Malta (Public Service) shall
ASPG Conference, Perth Jonathan O'Dea - October 2013. "Financial Overseers and their Oversight A NSW Public Accounts Committee Perspective"
ASPG Conference, Perth Jonathan O'Dea - October 2013 "Financial Overseers and their Oversight A NSW Public Accounts Committee Perspective" OVERVIEW Statutory Officers play central roles as financial overseers
HMG Security Policy Framework
HMG Security Policy Framework Version 11.0 October 2013 Contents Introduction... 4 Government Security Responsibilities... 4 Role of the Centre... 5 Policy Context... 7 Critical National Infrastructure
Highland Council Information Security Policy
Highland Council Information Security Policy Document Owner: Vicki Nairn, Head of Digital Transformation Page 1 of 16 Contents 1. Document Control... 4 Version History... 4 Document Authors... 4 Distribution...
Digital Pathways. Penetration Testing
Penetration Testing [email protected] Penetration testing, vulnerability tests, assurance projects, ethical hacking it all means broadly the same thing; testing a corporate network to determine
Security Management Systems (SEMS) for Air Transport Operators. Executive Summary
Security Management Systems (SEMS) for Air Transport Operators Executive Summary March 2011 Security Management Systems (SeMS) for Air Transport Operators Introduction and Scope Executive Summary In early
Victorian Government Information and Communication Technology (ICT) Governance
Governance Victorian Government Information and Communication Technology (ICT) Governance Framework A framework to describe ICT governance in the Victorian Government Keywords: ICT Strategy; governance;
Best Practices in ICS Security for System Operators. A Wurldtech White Paper
Best Practices in ICS Security for System Operators A Wurldtech White Paper No part of this document may be distributed, reproduced or posted without the express written permission of Wurldtech Security
ISO27001 Controls and Objectives
Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the
Central Sponsor for Information Assurance. A National Information Assurance Strategy
Central Sponsor for Information Assurance A National Information Assurance Strategy A NATIONAL INFORMATION ASSURANCE STRATEGY i Foreword Information and communications technology is changing the way that
Statement of Danny Harris, Ph.D. Chief Information Officer U.S. Department of Education
Statement of Danny Harris, Ph.D. Chief Information Officer U.S. Department of Education Before the U.S. House Oversight and Government Reform Committee Hearing on Agency Compliance with the Federal Information
Budget development and management within departments
V I C T O R I A Auditor General Victoria Budget development and management within departments Ordered to be printed by Authority. Government Printer for the State of Victoria No. 39, Session 2003-2004
NEW ZEALAND S CYBER SECURITY STRATEGY
Appendix 1 NEW ZEALAND S CYBER SECURITY STRATEGY June 2011 New Zealand Government 7 June 2011 ISBN: 978-0-478-38200-6 www.med.govt.nz/cyberstrategy MED11 Foreword from the Minister The Internet and digital
This is a free 15 page sample. Access the full version online.
AS/NZS ISO/IEC 17799:2001 This Joint Australian/New Zealand Standard was prepared by Joint Technical Committee IT-012, Information Systems, Security and Identification Technology. It was approved on behalf
Council Meeting Agenda 27/07/15
3 Risk Management Framework Abstract Council s Risk Management Framework ( the Framework ) was adopted by Council in 2012. The Framework provides structure and guidance to Council s risk management activities
Audit of Business Continuity Planning
Cumbria Office of the Police & Crime Commissioner Audit of Business Continuity Planning 0 Cumbria Shared Internal Audit Service Images courtesy of Carlisle City Council except: Parks (Chinese Gardens),
Australian Government Information Security Manual CONTROLS
2015 Australian Government Information Security Manual CONTROLS 2015 Australian Government Information Security Manual CONTROLS Commonwealth of Australia 2015 All material presented in this publication