NDIA Accountability Project

This project is in DRAFT

FOI 22/23-0830 (Florence)

‹ PrevPage 1 of 2 · Source p. 1Next ›

FOI 22/23-0830 (Florence)

Scope

“1. Who specifically provided the advice that the NDIA was not required to comply with or follow the PSPF? Job title and location will suffice 2. Noting all these new roles and requirements, was the person(s) consulted at the NDIS at the time qualified and competent to answer questions on cyber/security and the PSPF?

  1. As the NDIS seems to have overnight sought to align with and comply with the PSPF, please provide a copy of the instruction or directive to do so.

  2. Has there been (or is there) an investigation into providing inaccurate, seemingly false or potentially misleading information about the NDIS security (cyber included) obligations, compliance and assurance requirements?

  3. Prior to this new found support and embracing of the PSPF, which specific security standards and framework did the NDIS/NDIA employ, attest to, report to the Attorney General’s Department or provide guarantees, compliance or alignment with to any other Government/public entity?

  4. Please provide a copy of the requirement and approval for all these new, sudden cyber security roles. Has the threat changed?

  5. How many NDIS staff, contractors, providers and participants have been affected or compromised as a result of the Medibank, Optus, Australian Clinical Labs, or any other data breach, compromise or hack?”

Response

  1. Who specifically provided the advice that the NDIA was not required to comply with or follow the PSPF? Job title and location will suffice

The NDIA is a corporate Commonwealth entity. As stated is the Protective Security Policy Framework (PSPF), the PSPF applies to non-corporate Commonwealth entities subject to the Public Governance, Performance and Accountability Act 2013 (PGPA Act) to the extent consistent with legislation. The PSPF represents better practice for corporate Commonwealth entities and wholly-owned Commonwealth companies under the PGPA Act.

A link to the PSPF is provided below for ease of reference:

protective-security-quidance-for-executives.pdf

  1. Noting all these new roles and requirements, was the person(s) consulted at the NDIS at the time qualified and competent to answer questions on cyber/security and the PSPF?

The persons consulted included, but was not limited to, the Chief Security Officer and Chief Information Officer.

  1. As the NDIS seems to have overnight sought to align with and comply with the PSPF, please provide a copy of the instruction or directive to do so.

Please refer to question one providing clarification on the NDIA’s requirement to comply with the PSPF.

  1. Has there been (or is there) an investigation into providing inaccurate, seemingly false or potentially misleading information about the NDIS security (cyber included) obligations, compliance and assurance requirements?

No.

FOI 22/23-0830

  1. Prior to this new found support and embracing of the PSPF, which specific security standards and framework did the NDIS/NDIA employ, attest to, report to the Attorney General’s Department or provide guarantees, compliance or alignment with to any other Government/public entity? Please refer to response provided in Question 1.

Furthermore, whilst the NDIA is not required to report, the Agency have elected to respond to the Attorney General’s Department maturity assessment. This commenced from 1 July 2021 for the period 1 July 2020 to 30 June 2021.

  1. Please provide a copy of the requirement and approval for all these new, sudden cyber security roles. Has the threat changed? Please see document 1 and 2 (see below)

  2. How many NDIS staff, contractors, providers and participants have been affected or compromised as a result of the Medibank, Optus, Australian Clinical Labs, or any other data breach, compromise or hack? The NDIA is not responsible for the management of breaches by third parties. Requests for information from third parties should be directed to impacted entities.

Page 2 of 7