MICROSOFT COPILOT RISK ASSESSMENT

DOCUMENT 1 OFFICIAL

EXECUTIVE BRIEF

Required Action: For decision / For information                                                             PDR: EC24-000104 Critical Date: Due date for Executive action — min. 3 bus. days                                                     Div: OCIO

MICROSOFT COPILOT RISK ASSESSMENT

1. Purpose

1.1. To seek authorisation and inform you of the findings of the Short Form Risk Assessment (SFRA) for the Microsoft 365 CoPilot Trial.

2. Background

2.1. A SFRA has been conducted on the implementation of Microsoft 365 CoPilot planned trial and determined that the level of residual risk to the NDIA Operating Environment after the application of treatments is LOW.

2.2. This trial is being introduced to a number of different government agencies and is being managed as a project with the Digital Transformation Agency (DTA) of which NDIA is a participant.

2.3. The SFRA conducted to support the trial can be found in Attachment A.

3. Risks

3.1. Three risks were identified in the assessment. This included:

• 3.1.1. R1 Unauthorised data access
• 3.1.2. R2 Improper use of output
• 3.1.3. R3 Instability introduced into the NDIA environment.

3.2. CoPilot is a generative Artificial Intelligence tool integrated with the Microsoft 365 tenancy. It makes use of the existing permissions and access provided to users within the current SharePoint environment. An existing error or misconfiguration of permission could result in output from CoPilot utilising information and producing output that the user may not be permitted to access.

3.3. While a potentially valuable business tool, the output generated by CoPilot may be incorrect or produce biased or unreliable answers. A lack of understanding of the level of trust that can be placed in these tools could result in incorrect data being used to make a business decision.

3.4. CoPilot is a relatively new technology being offered by Microsoft 365. There is currently little experience and knowledge regarding how this tool will function in an established organisation and what impact it may have on the environment.

3.5. Four treatments have been proposed to reduce the residual risk to LOW. These are:

• 3.5.1. Treatment 1: Development of a process to enable users to report any instances of incorrect or excessive data permissions.
• 3.5.2. Treatment 2: Restrictions on any direct import of large volumes of participant data
• 3.5.3. Treatment 3: CoPilot User Awareness training to provide users with perspectives on how to best utilise this tool.
• 3.5.4. Treatment 4: Incident Disengagement Plan to ensure quick response in the event of problems or degradation of services being introduced into the NDIA environment.

OFFICIAL

4. Authorisation

4.1. The Microsoft CoPilot Trial Project Manager, Director of Desktop Services and Director of Cyber Security Operations were consulted during this assessment. They endorse the findings and treatments.

5. Recommendation

5.1. That you authorise the use of Microsoft 365 CoPilot within the NDIA environment within the constraints of this risk assessment and the following additional considerations:

5.1.1. CoPilot is in the final stages of an IRAP Assessment. The IRAP Assessment will be made available to trial participants. In the event that significant negative findings are identified in the IRAP Assessment, this authorisation is revisited.

Signature: redacted: s47F - personal privacy                                                               Date: 24/01/24.

CISO

6. Distribution

A copy of this brief has been provided to: Sean Giddings

CISO

7. Attachments

Attachment A: Microsoft CoPilot Short Form Risk Assessment

DOCUMENT 1.1

OFFICIAL

National Disability Insurance Agency

Short Form Risk Assessment Microsoft CoPilot

OFFICIAL

OFFICIAL

Document Information

Item	Content
ATO redacted	redacted
ATO ID: redacted	redacted
Classification of Information:	OFFICIAL: Sensitive
Assessor Name:	Deepti redacted: s47F - personal privacy and Niki redacted: s47F - personal privacy
SFRA approved for use by:	ITSA
SFRA approved for use on:	Click or tap to enter a date.

Table 1. Document information

Document Control

Version	Date	Author	Comments
V0.1	Click or tap to enter a date.	Deepti redacted: s47F - personal privacy	Initial Draft
V0.2	Click or tap to enter a date.	Daryl redacted: s47F - personal privacy	Review
	Click or tap to enter a date.		Edits
	Click or tap to enter a date.		Final Review
	Click or tap to enter a date.		Endorsement

Table 2. Document control

Underpinning Services

Service	Current Authorisation Status	ATO Expiry Date
NDIA OE	☒ ATO ☐ IATO ☐ NIL	Under review
	☐ ATO ☐ IATO ☐ NIL	Click or tap to enter a date.
	☐ ATO ☐ IATO ☐ NIL	Click or tap to enter a date.
	☐ ATO ☐ IATO ☐ NIL	Click or tap to enter a date.
	☐ ATO ☐ IATO ☐ NIL	Click or tap to enter a date.

Table 3. Underpinning services

System Overview

Copilot for Microsoft 365 is an AI assistant built into Microsoft 365 and Office (Outlook, Teams, Word, Excel, PowerPoint, and Whiteboard). It utilises the same generative AI technology that is powering CHAT GPT, but with enterprise level functionality that is designed for use within business and government.

The trial is expected to commence in January 2024. The DTA has established an order form for Copilot participation under Microsoft Volume Sourcing Agreement. The DTA is working with Microsoft to arrange training, onboarding, and implementation assistance with participating agencies.

OFFICIAL

The trial includes up to 300 participants from NDIA and will include SES members and selected personnel from OCIO. A workshop was conducted on 15 December for agencies to understand the Microsoft Copilot AI fundamentals and technical fundamentals to understand the process.

The below table provides the high-level overview of the timeline and key steps of the Microsoft Copilot trial.

Timeline	Key Steps
24 November 2023 - 8 December 2023	Agencies receive Copilot for MS 365 trial licence agency commitment and order form.
8 December 2023 - 15 December 2023	Agency commitments received and collated
15 December 2023 — 18-21 December 2023	Receive agency invoices from SDO & send to agencies
1 January 2024- Early April 2024	Copilot trial commences. Agencies required to notify Microsoft if seeking to extend Copilot.
April 2024 — May 2024	Expected trial evaluation by DTA
May 2024- June 2024	Copilot trial end

The minimum term commitment is to 30 June 2024. An IRAP assessment is being undertaken by Microsoft with anticipated publication in January 2024.

Both Copilot and Azure Open AI Service (the large language model (LLM) host platform) are within the scope of the ongoing IRAP assessment.

Exclusion/Out of Scope

This SFRA scope covers the use of Microsoft CoPilot as part of the DTA Government Trial as detailed above. Any use of CoPilot, other Generative AI, or other tools (including third-party plug-ins) outside the application of this DTA trial is out of scope and not addressed in this SFRA.

Vendor Information

Detail
Vendor Name:	Microsoft
Contract:	☒ Yes      ☐ No
If Yes, Contract Details:	DTA Order form
Contract Attached:	☒ Yes      ☐ No
Vendor Contact:	redacted: s47E(d) - certain operations of agencies
NDIA Contract Manager
Contract Legal Review attached:	☐ Yes      ☐ No
Contract Period:	January to June 2024
Contract Expiry Date:	30 June 2024

Table 4. Vendor and contract information

OFFICIAL

System State

The Microsoft Copilot trial will enable NDIA to use the existing NDIA Operating environment to add the Microsoft Copilot 365 features.

The following diagram Figure 1- Microsoft Copilot Architecture provides a high-level overview of the proposed Microsoft 365 service boundary

Diagram 1: Microsoft Copilot Architecture

Steps of data flow:

1. The user enters a prompt or query.
2. Microsoft Copilot preprocess the prompt through an approach called grounding.
3. Microsoft Copilot sends modified prompt to Large Language Model (LLM).
4. Microsoft Copilot receives the LLM response.
5. Microsoft Copilot access Microsoft Graph for compliance and purview.

Access Management:

Data Protection:

As per the information pack, Microsoft has confirmed that:

• Copilot for Microsoft 365 doesn’t store NDIA data outside of NDIA Azure tenancy.
• Copilot doesn’t train the LLM (the GPT AI engine of Copilot) with customer data.
• Unlike public generative AI tools, Microsoft Copilot is a paid product, designed to meet the needs of Australian Government Security Standards.

OFFICIAL

Microsoft employs a permission model that prevents unintended data leaks between users, groups, and tenants. Microsoft Copilot 365 operates within the same access controls used by the other MS 365 services, ensuring it only uses data accessible to authorised staff.

The Semantic index adheres to the user identity-based access boundary, ensuring that its process only access content authorised for the current user.

Logical isolation² of customer content within each tenant is implemented via Azure Active Directory authorisation and role- based access control.

Microsoft Copilot uses Azure OpenAI services for processing, not OpenAI’s publicly available services.

Encryption: Microsoft Copilot encrypts³ data at rest and in transit.

For customer data at rest, Microsoft Azure uses Bitlocker, Azure Storage Service Encryption, Distributed Key Manager (DKM) and Microsoft 365 service encryption. Microsoft utilises 256-bit AES encryption to encrypt data at rest.

For customer data in transit, Microsoft uses Transport Layer Security (TLS) 1.2 and Internet Protocol Security (IPsec) between user devices and Microsoft datacentres.

Information Overview: Data used by this CoPilot will consist of NDIA data stored within the existing Microsoft 365 tenancy. CoPilot will apply the current access control and permissions that are in place within the existing NDIA data stores. CoPilot will not have access to PACE and will only process participant data that is stored in SharePoint.

Security and Compliance: As per the information pack, Microsoft has confirmed that Copilot for Microsoft 365 and the Azure platform are both in the final stages of IRAP assessment with anticipated publication in January 2024. Both Copilot for Microsoft 365 and Azure Open AI Service (the large language model (LLM) host platform) are in scope for the current IRAP assessments. The IRAP report will provide the technical assessment of the entire MS 365 products (including Copilot) against the Australian Signals Directorate’s (ASD) Information Security Manual (ISM).

Microsoft has mapped Australian Government Standards into their own security control set, including the ISM at PROTECTED, the Australian Privacy Principles (APP) and the PSPF.

---

² https://learn.microsoft.com/en-us/compliance/assurance/assurance-microsoft-365-isolation-controls

³ Encryption in the Microsoft Cloud | Microsoft Learn

OFFICIAL

Risk Analysis

All assessment of must consider four critical aspects when determining ICT risk:

• The ASSET you are assessing.
• The THREAT environment for the NDIA and against the ASSET specifically
• The LIKELIHOOD of the THREAT being successful, and
• The CONSEQUENCE on the ASSET and the wider NDIA of a successful THREAT outcome.

Assets

Asset	Asset Type	Asset Criticality
NDIA Participant Data	Information-PII	Critical
NDIA Reputation	Intangible	High

Table 5. Assets in relation to the product

OFFICIAL

Threat Actors

Threat	Level of Threat
Malicious Insider	Medium
Trusted Insider	Medium

Table 6. Threat actors in relation to the product

Risk from Design

R1: Unauthorised Data Access:

Associated to NDIA R5:

With elevated or misconfigured permissions, NDIA users may access a wide array of sensitive participant information. Misuse of the user access through Microsoft Copilot might lead to the unauthorised retrieval or viewing of confidential data beyond their intended scope, potentially violating confidentiality of information.

R2: Improper use of Output

Associated to NDIA R5 & R2

Generative tools can produce output that is inaccurate or biased. Before sharing the information, NDIA users must validate the output fairly and accurately reflects the data.

Misuse or mishandling of Microsoft Copilot may result in unintentional sharing of NDIA participant information. Inaccurate outputs or accidental sharing of data generated through Microsoft Copilot might lead to the access of confidential details to unauthorised parties.

R3: Instability in Environment:

Associated to NDIA R6

The integration of Microsoft Copilot might introduce instability within the NDIA environment, potentially causing disruptions or inconsistencies in the system’s functionality.

Australian Government Security Framework (AGSF) Implications

The following are the relevant impacted areas from the Australian Government Information Security Manual with the implementation of the reporting functionality:

Guidelines

ISM Controls

Access to Systems

ISM- 1648: Privileged access to systems and applications is disabled after 45 days of inactivity. ISM- 0407: A secure record is maintained for the life of each system covering the following for each user. ISM-1865: Personnel agree to abide by usage policies associated with a system and its resources before being granted access to the system and its resources. ISM – 0435: Personnel receive any necessary briefings before being granted access to a system and its resources.

OFFICIAL

Guidelines	ISM Controls
Data Transfers	ISM- 0661: Users transferring data to and from systems are held accountable for data transfers they perform.

OFFICIAL

Inherent Risk Rating

Risk	Proposed Treatment	Associated Threats	Likelihood	Consequences	Rating
R1	T1, T2, T3	TE1, TE2	3	A	LOW
R2	T1, T2, T3	TE4, TE5	2	B	LOW
R3	T4	TE7, TE8	1	C	MEDIUM

Table 7. Inherent risk rating

Overall Risk Rating

Likelihood 3 - POSSIBLE      Consequence C - MODERATE      Rating MEDIUM

Identified Treatments

Treatment ID No.	Proposed Treatment	Associated NDIA Risks	Implement Date
T1	Process to manage information exposure incidents. CoPilot will make use of data that users have existing permissions to. This will have the potential to highlight issues where excessive permissions may exists. A process is to be developed that will provide users of the trial an avenue to report any incorrect or excessive permissions to data that are highlighted by CoPilot	R1, R2	End of January 2024
T2	Restriction on any direct import of participant data For the duration of the trial a restriction is placed upon any of processing or importing of large volumes of participant data	R1, R2	End of January 2024
T3	CoPilot User Awareness Training All users participating in the trail are to undertake awareness training specifically on issues relating to the usage of CoPilot functions within a business context	R1, R2	End of January
T4	Incident Disengagement Plan A plan is to be developed to provide a process where disengagement of CoPilot can be undertaken in the event that security or performance issues is introduced into the NDIA environment	R3	End of January

Table 8. Identified Treatments

OFFICIAL

Residual Risk Rating

Likelihood 2 - UNLIKELY      Consequence B - MINOR      Rating LOW

Recommendation/s

☒ ATO

☐ ATO with Conditions                                                   Length of ATO with Conditions:

☐ NOT RECOMMENDED

Justification of Recommendation

Based upon the identified risks and on the understanding that the CoPilot system has successfully undergone an IRAP assessment with no adverse findings, the level of risk to the NDIA is assessed as LOW.

It is recommended granting an Authority to Operate (ATO) for the period of the trial outlined above.

OFFICIAL

OFFICIAL

     Page 13 of 189

OFFICIAL

CYBER USE ONLY

System Owner Notified:                ☐ YES                ☐ NO

Detail:

ATO Register Updated:                 ☐ YES                ☐ NO

Detail:

Cyber Risk Register Updated:          ☐ YES                ☐ NO

Detail:

OFFICIAL

Risk Assessment Guidance & Matrices

Threat Sources

No.	Threat Source	Description
TS1	Malicious Insider	NDIA end users or privileged users that seek to exploit vulnerabilities in NDIA’s information systems and networks.
TS2	External Attacker	Individuals, groups and organisations or nation states that seek to exploit vulnerabilities in NDIA’s information systems and networks.
TS3	Trusted Insider	NDIA’s end users or privileged users, erroneous actions taken by whom in the course of their everyday responsibilities exposes vulnerabilities in NDIA’s information systems and networks.
TS4	Structural	Failures of equipment or software due to aging, poor design, resource depletion or other circumstances which exceed operating parameters.
TS5	Environmental	Natural disasters and failure of critical infrastructure on which NDIA’s information systems and networks depend but which are outside of controls of NDIA’s management.

Table 3. Threat sources

Threat Events

No.	Threat Event	Threat Source
TE1	Malicious Insider deliberately allows or facilitates unauthorised access to information by unauthorised entities.	TS1 and TS2
TE2	Trusted Insider accidentally allows or facilitates unauthorised access to information by unauthorised entities.	TS3
TE3	External Attacker conducts targeted or untargeted activities to discover, reveal, exfiltrate or capture information that has not been publicly released.	TS2
TE4	Malicious Insider deliberately misuses their access or allows or facilitates unauthorised access to data, facilities or systems by unauthorised entities, resulting in their corruption or reliability coming into question.	TS1 and TS2
TE5	Trusted Insider accidentally allows or facilitates unauthorised access to systems, processes or information by unauthorised entities, resulting in their corruption or reliability coming into question.	TS3
TE6	External attacker conducts targeted or untargeted activities to influence processing through injecting data, malicious code or configuration information or creating deception or deleting data.	TS2
TE7	Malicious Insider deliberately misuses their access or allows or facilitates unauthorised access to data, facilities or systems by unauthorised entities, to disrupt, damage or destroy.	TS1 and TS2
TE8	Trusted Insider accidently allows or facilitates systems, processes or information to be disrupted, damaged or destroyed.	TS3
TE9	External Attacker conducts targeted or untargeted activities to disrupt processing through denial of service injecting data, malicious code or configuration information or deleting data.	TS2

Table 4. Threat events

Threat Level

The threat level for ICT is published on the GRC Confluence Page. This is reflected in the Enterprise Risk Assessment and the Protective Security Risk Review. The Threat Level will be reviewed Quarterly in line with Risk Reporting.

When calculating the Likelihood, it is essential to understand and incorporate the threat and threat level for planning purposes.

OFFICIAL

Risks

Risk	Description
1	Loss of Confidence by the Minister
2	Loss of Confidence by the Board
3	Loss of Confidence by the Public
4	Fraud, Theft or misuse of funds or assets
5	Theft, Loss, misuse and/or compromise of Data
6	Inability to deliver services to Government, Partners and Participants.

Table 5. NDIA risks

Likelihood Rating

Likelihood Rating	Explanation	Measure against Timeframe
1	Rare	Issue may occur in exceptional circumstances.
2	Unlikely	A slight possibility an issue may occur
3	Possible	A history exists in this or similar activities occasionally.
4	Likely	A history exists in this or similar activities where issues occur frequently.
5	Almost Certain	It is expected to occur.

Table 6. Likelihood ratings

Timeframe Measure: Lifecycle of the product as defined in the System Security Plan

During procurement or ATO assessment process, staff will be required to justify their selection.

Consequence Rating

| Rating | Description | Impact Categories |

		Financial Impact	User Impact	Business Interruption	Reputation	Corporate Objectives
A	Insignificant	< 10% TCO4 or <$100,000 whichever is less.	1-10 Participant/NDIA User impacted	Critical services unavailable or degraded for less than one hour	Negligible impact Loss of confidence by OCIO BM	Resolved in day to day management
B	Minor	10 – 25% TCO or $100,000 to $250,000 whichever is less.	> 10 but <100 Participants/NDIA Users impacted	Critical services unavailable or degraded for 1-4 hours	Low Key Adverse media coverage. Possible Portfolio Communication Loss of Confidence by CIO	Potential to have Minor impact on the Corporate Plan or ICT Strategy
C	Moderate	26 – 40 % TCO or $250,001	=>100 but <1000 Participants/NDIA Users impacted	Critical services unavailable or degraded for 4 – 8 hours	Adverse media coverage. Possible political referral Loss of confidence by CEO/ELT	Potential to have Significant

---

⁴ TCO - Total Cost of Ownership - an estimate of all the direct and indirect costs involved in acquiring and operating a product or system over its lifetime

OFFICIAL

		-$500,000 whichever is less			Loss of confidence by Minister Loss of confidence by participants Loss of Public confidence Loss of Confidence by the Board	impact on the Corporate Plan or ICT Strategy
D	Major	41 – 60% TCO or $500,001 to $1M or whichever is less	=> 1000 but <=10,000 Participants/NDIA Users impacted	Critical services unavailable or degraded for 1 business day	Significant Media Attention Potential Loss of Confidence by Minister Potential Loss of Confidence by participants Potential Loss of Public confidence Loss of Confidence by the Board	Will disrupt the Corporate Plan or ICT Strategy
E	Extreme	=>61% TCO or >$1M whichever is less	>10,000 Participants impacted/NDIA Users impacted	Critical services unavailable or degraded for > 1 business day	Significant Media Attention Loss of Confidence by Minister Loss of Confidence by participants Loss of Public confidence	May require adjustment of the ICT Strategy or could require advice to the Minister on the Corporate Plan

Table 7. Consequences ratings

Risk Heat Map

Consequence	Likelihood
	1	2	3	4	5
E	E/1	E/2	E/3	E/4	E/5
D	D/1	D/2	D/3	D/4	D/5
C	C/1	C/2	C/3	C/4	C/5
B	B/1	B/2	B/3	B/4	B/5
A	A/1	A/2	A/3	A/4	A/5

Risk Level	LOW	MEDIUM	HIGH	CRITICAL

Table 8. Risk heat map

OFFICIAL

OFFICIAL

     Page 18 of 189