Operational Procedure: ACNC Data Breach Response Plan

Transcription

1 OP 2015/03 Oprtionl Prour: ACNC Dt Brh Rspons Pln This Oprtionl Prour is issu unr th uthority of th Assistnt Commissionr Gnrl Counsl n shoul r togthr with th ACNC Poliy Frmwork, whih sts out th sop, ontxt n finitions ommon to our poliis. Tl of Contnts Contnts Prour... 1 ACNC Stff mmr to notify irtor... 2 Dirtor to ssss th rh... 2 Dirtor Lgl (n othr rlvnt irtors) to ssss th sriousnss of th rh... 2 Dt Brh Rspons Tm... 3 Contt prsons:... 3 Pross:... 4 Stp 1: Contin th rh n o prliminry ssssmnt... 5 Stp 2: Evlut th risks ssoit with th rh... 5 Stp 3: Notifition... 7 Stp 4: Prvnt futur rhs Rfrns... 9 Prour 1. This Dt Brh Rspons Pln (Rspons Pln) sts out th prour to follow y ACNC stff in th vnt tht th ACNC xprins t rh, or suspts tht t rh hs ourr. 2. A t rh ours whn prsonl informtion (fin in stion 6 of th Privy At 1988 (Cth)) is lost or sujt to unuthoris ss, moifition, us or islosur or othr misus. Prsonl informtion rfrs to informtion tht intifis or rsonly intifis n iniviul. 3. A t rh will lso our whr prott ACNC informtion is unlwfully us or islos. Prott ACNC informtion inlus ror rng of informtion thn prsonl informtion s it inlus informtion out ll ntitis, not just UNCLASSIFIED 1

2 iniviuls (S Prt 7-1 n stion of th Austrlin Chritis n Not-forprofits Commission At 2012 (Cth)). 4. Whilst th pross outlin in this Rspons Pln pplis to ll t rhs it is importnt to not tht in som instns, th sry provisions my impos stritr stnrs on th ACNC thn thos ontin in this Rspons Pln. Thus, whr rh involvs prott ACNC informtion oth th Rspons Pln n th lgisltion must onsir olltivly. 5. It is lso importnt to not tht Offi of th Austrlin Informtion Commissionr (OAIC) is only onrn with rhs tht involv prsonl informtion. Dt rhs tht involv prott ACNC informtion tht is not prsonl informtion o not n to rport to th OAIC. 6. Ahrn with th Rspons Pln will nsur th ACNC n ontin, ssss n rspon to t rhs in timly fshion in orr to mitigt potntil hrm to fft prsons. 7. This pln: sts out th rols n rsponsiilitis of stff; sts out th ontt tils of pproprit stff in th vnt of t rh; n outlins th prour to follow in th vnt of t rh. ACNC Stff mmr to notify irtor 8. Immitly notify your irtor of th suspt t rh. 9. Ror n vis your irtor of th tim n t th suspt rh ws isovr, th typ of informtion involv, th us n xtnt of th rh, n th ontxt of th fft informtion n th rh. Dirtor to ssss th rh 10. Th irtor must ssss n trmin whthr t rh hs ourr. 11. If th irtor hs ny suspiion tht rh hs ourr, th irtor must immitly notify th Dirtor Lgl n th Privy Offir. Dirtor Lgl (n othr rlvnt irtors) to ssss th sriousnss of th rh 12. In som instns, minor rh my l to lt with t th irtor lvl (with ssistn from th Privy Offir). Whr minor rh is lt with t th irtor lvl, th following tils must ror: sription of th rh or suspt rh; tion tkn y th irtor or ACNC stff mmr to rss th rh or suspt rh; outom of tht tion; 2

3 sign off from th Dirtor of Lgl tht no furthr tion is rquir; n onfirmtion tht th inint hs n ror in th ACNC Dt rh inint log. 13. Th ror must sv in th folr low: [Fil lotion rt] 14. If th rh is srious, it must immitly slt to th Dt Brh Rspons Tm. Dt Brh Rspons Tm Contt prsons: 15. Th Rspons Tm inlus: Lgl: [Nm n ontt tils rt] (primry ontt) [Nm n ontt tils rt] (sonry ontt) IT: [Nm n ontt tils rt] (primry ontt) [Nm n ontt tils rt] (sonry ontt) Communitions: [Nm n ontt tils rt] (primry ontt) [Nm n ontt tils rt] (sonry ontt) Complin: [Nm n ontt tils rt] (primry ontt) 3

4 Avi: [Nm n ontt tils rt] (primry ontt) [Nm n ontt tils rt] (sonry ontt) Rgistrtions: [Nm n ontt tils rt] (primry ontt) [Nm n ontt tils rt] (sonry ontt) Poliy n Eution [Nm n ontt tils rt] (primry) [Nm n ontt tils rt] (sonry) Businss Srvis [Nm n ontt tils rt] (primry ontt) [Nm n ontt tils rt] (sonry ontt) 16. It is not nssry tht ll mmrs of th Rspons Tm inlu in ll t rh rsponss. Howvr, whr irtort is fft or involv in rh, or whr irtort n ssist in mitigting th hrm us y rh, list or lgt primry or sonry ontt must involv in th rspons. Pross: 17. On mttr hs n slt to th Rspons Tm, th pross outlin low must follow. Th Rspons Tm must work in onsulttion with th Exutiv in rsponing to th rh. Eh rh will n to lt with on s-y-s sis, unrtking n ssssmnt of th risks involv n using tht risk ssssmnt s th sis for iing wht tions to tk in th irumstns. 4

5 18. Thr r four ky stps to onsir whn rsponing to rh or suspt rh. Gnrlly, stps 1-3 shoul rri out onurrntly or in los sussion. Stp 1: Contin th rh n o prliminry ssssmnt Stp 2: Evlut th risks ssoit with th rh Stp 3: notifition Stp 4: Prvnt futur rhs Stp 1: Contin th rh n o prliminry ssssmnt Contin th rh 19. On t rh hs n intifi, tion must tkn to immitly ontin it. For xmpl, stop th unuthoris prti, rovr th rors or shut own th systm tht ws rh. Initit prliminry ssssmnt 20. Mov quikly to ppoint somon to l th initil invstigtion. This prson must suitly qulifi n hv suffiint uthority to onut th initil invstigtion. In som instns, this my mmr of th Rspons Tm. In othr instns, it will prson most suitly qulifi to rry out th initil invstigtion (s trmin y th mmrs of th Rspons Tm). 21. In som situtions it will nssry to ssml tm tht inlus rprsnttivs from pproprit rs of th ACNC to onut th prliminry ssssmnt. 22. Th following qustions shoul rss whn mking th prliminry ssssmnt: Wht informtion os th rh involv? Wht ws th us of th rh? Wht is th xtnt of th rh? Wht r th hrms (to fft prsons) tht oul potntilly us y th rh? How n th rh ontin? Stp 2: Evlut th risks ssoit with th rh 23. Th following ftors r rlvnt whn ssssing th risk: 5

6 Th typ of informtion involv i) Is it prsonl informtion or prott ACNC informtion? ii) Dos th typ of informtion tht hs n ompromis rt grtr risk of hrm? iii) Who is fft y th rh? Dtrmin th ontxt of th fft informtion n th rh i) Wht is th ontxt of th informtion involv? ii) Wht prtis hv gin unuthoris ss to th fft informtion? iii) Hv thr n othr rhs tht oul hv umultiv fft? iv) How oul th informtion us? Estlish th us n xtnt of th rh i) Is thr risk of ongoing rhs or furthr xposur of th informtion? ii) Is thr vin of thft? iii) Is th informtion qutly nrypt, nonymis or othrwis not ssil? iv) Wht ws th sour of th rh? (risk of hrm my lowr whr sour of th rh is intl rthr thn intntionl) v) Hs th informtion n rovr? vi) Wht stps hv lry n tkn to mitigt th hrm? vii) Is this systmi prolm or n isolt inint? viii) How mny prsons r fft y th rh? Assss th risk of hrm to th fft prsons i) Who is th ripint of th informtion? ii) Wht hrm to prsons oul rsult from th rh? Assss th risk of othr hrms i) Othr possil hrms, inluing to th gny or orgnistion tht suffr th rh. For xmpl: (1) Th loss of puli trust in th gny (2) Rputtionl mg (3) Lgl liility (4) Brh of sry provisions 6

7 24. A thorough vlution of th risks will ssist th ACNC in trmining th pproprit ours of tion to tk. Stp 3: Notifition Diing whthr to notify fft iniviuls or ntitis 25. In gnrl, if t rh rts rl risk of srious hrm to prson, th fft prson shoul notifi. 26. Th ky onsirtion is whthr notifition is nssry to voi or mitigt srious hrm to n fft prson. 27. Consir th following ftors: Wht is th risk of srious hrm to th prson s trmin y stp 2? Wht is th ility of th prson to voi or mitigt possil hrm if notifi of rh (in ition to stps tkn y th gny or orgnistion)? Evn if th prson woul not l to tk stps to fix th sitution, is th informtion tht hs n ompromis snsitiv or likly to us humilition or mrrssmnt? Wht r th lgl n ontrtul oligtions to notify n wht r th onsquns of notifition? Notifition pross 28. In gnrl, notifition shoul our s soon s rsonly possil. Howvr, in som instns, ly my nssry. 29. Notifition shoul irt y phon, lttr, mil or in prson, to th fft iniviuls. 30. Inirt notifition, ithr y wsit, post notis or mi shoul only our whr irt notifition oul us furthr hrm, is ost prohiitiv or th ontt informtion for fft prsons is unknown. Dtils to inlu in th notifition 31. Th ontnt of th notifition will vry pning on th prtiulr rh n notifition mtho. Howvr, th OAIC rommn tht notifitions shoul inlu th following informtion: inint sription; typ of informtion involv; rspons to th rh; ssistn offr to fft prsons; othr informtion sours sign to ssist in protting ginst intity thft or intrfrns with privy (.g. 7

8 f g h i j th ACNC s ontt tils; whthr rh notifi to rgultor or othr xtrnl ontt(s); lgl implitions (.g. th sry provisions); how iniviuls n log omplint with th ACNC; n how iniviuls n log omplint with th OAIC (whr th informtion is prsonl informtion). Othr notifitions 32. It my lso pproprit to notify othr thir prtis, suh s: f g Th OAIC. Th Poli. Insurn provirs. Crit r ompnis, finnil institutions. Profssionl or othr rgultory ois. Othr intrnl or xtrnl prtis who hv not lry n notifi. Agnis tht hv irt rltionship with th informtion lost/stoln. 33. Th OAIC strongly nourgs gnis to rport srious t rhs involving prsonl informtion. Th following ftors shoul onsir in iing whthr to rport rh to th OAIC: ny pplil lgisltion tht my rquir notifition; th typ of prsonl informtion involv n whthr thr is rl risk of srious hrm rising from th rh; whthr lrg numr of popl wr fft y th rh; whthr th informtion ws fully rovr without furthr islosur; whthr th fft iniviuls hv n notifi; n f if thr is rsonl xpttion tht th OAIC my riv omplints/inquiris out th rh. Stp 4: Prvnt futur rhs. 34. On immit stps hv n tkn to mitigt th risks ssoit with rh, th ACNC must tk th tim to invstigt th us of th rh. 35. Th ACNC Exutiv must rif on th outom of th invstigtion, inluing rommntions: to mk pproprit hngs to poliis n prours if nssry; rvis stff trining prtis if nssry; n 8

9 upt this Rspons Pln if nssry. Rfrns This Dt Brh Rspons Pln hs n vlop in orn with n with rfrn to th OAIC s Dt rh notifition: gui to hnling informtion surity rhs (Th Gui). In th vnt of t rh, th Rspons Tm shoul rfrn th Gui s it provis furthr til tht my of ssistn to th Rspons Tm. Othr Rfrns: Austrlin Chritis n Not-for-profits Commission At 2012 (Cth) Prt 7-1 Privy At 1988 (Cth) ACNC Privy Poliy Oprtionl Prour: ACNC Prott Informtion Prour OP 2015/01 9

10 10

11 Vrsion Dt of fft Brif summry of hng Vrsion 1 - Initil poliy Initil PP nors y pproving uthority on 11