DOCUMENT 1

OFFICIAL

Approved: 18/05/21
Owner: BM Protective & Cyber Security
Contact: security@ndis.gov.au

The content of this document is OFFICIAL.

Security Risk Management Procedure

1. Purpose

This Procedure describes how the Agency will implement the Security Risk Management Policy (the Policy).

The Procedure is for use by Protective and Cyber Security Branch.

2. Definitions

ASA: Agency Security Adviser — handles the majority of the day-to-day protective security on behalf of the CSO.

CSO: Chief Security Officer — the SES1 who has been appointed by the CEO to manage security in the NDIA.

PSPF: Protective Security Policy Framework: the Australian Government’s protective security policy. It also provides guidance to entities to support the effective implementation of the policy across the areas of security governance, personnel security, physical security and information security

RAS: Risk Appetite Statement: The Board approved direction for the Agency’s readiness to bear the risk after risk treatment in order to achieve its objectives.

Risk: Effect of uncertainty on objectives — what has to ‘go right’ to ensure we are successful. An effect may be positive or negative.

Threat: A negative event that can lead to an undesired outcome, such as damage to, or loss of, an asset.

Vulnerability: The factors or processes which increase the susceptibility of a threat.

3. Procedure

The Security Risk Management Procedure describes how the Agency manages risks across all areas of security (governance, information, personnel and physical) to determine sources of threat and risk (and potential events) that could affect government or entity business.

The latest version of the risk management tools referred to in this section are available on the “Risk Assessment Tools” page on the Intranet.

OFFICIAL

3.1 Risk management framework

Security risks must be managed consistent with the agency’s Risk Management Framework. Every site will develop a Site Security Plan which takes into consideration the functions and location of the site.

The Risk Management Framework is a set of components that provide the foundations and organisational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management processes throughout the Agency.

Risk Branch and the Risk Committee oversee the agency’s risk management. The CSO has a seat on the Risk Committee and will raise security risks as appropriate.

Protective and Cyber Security Branch, through this Procedure, is responsible for whole of agency security risks. Site security specific risks (e.g. for participant contact facilities) are addressed through Site Security Plans. Process or portfolio specific security risks are addressed by the appropriate authority.

3.2 Security risk management

Security risk management will follow this methodology to analyse agency wide risks.

Security risk assessments
Security risk assessments are structured and comprehensive processes to identify, analyse and evaluate security risks and determine practical steps to minimise the risks.

The Agency Security Adviser (ASA), on behalf of the CSO, conducts 6-monthly security risk assessments in the NDIA using the Risk Management Guide.

The ASA will identify and categorise whole of agency security risks to a; Low, Medium, High or Critical risk rating.

Low risks will be addressed through business as usual activities.

Medium, High and Critical risks require additional risk treatments.

Security risk treatments
Security risk treatments are the considered, coordinated and efficient actions and resources required to mitigate or lessen the likelihood or negative consequences of risks.

The Risk Management Framework has established the Risk Action Plan for risk treatments. Risks are put through the Risk Action Plan which has three categories of information for each risk: Identify, Assess and Manage.

Medium, High and Critical risks will be analysed. Controls will be implemented and accountability assigned to address the risks.

OFFICIAL

Risk Committee
The CSO will report on risks in the Risk Action Plan to the Risk Committee.

The Agency Security Adviser and Protective and Cyber Security Branch will develop reporting tools, data and other resources to enable the CSO to report on Medium, High and Critical risks to the Risk Committee.

4. Policy

This procedure is authorised by the current version of the Security Risk Management Policy (‘the Policy’).

The Procedure should be read in conjunction with the Risk Management Framework and Agency Security Plan.

DOCUMENT 2

OFFICIAL

Approved: 18/05/21
Owner: BM Protective & Cyber Security
Contact: security@ndis.gov.au

The content of this document is OFFICIAL.

Security Risk Management Policy

1. Purpose

Security Risk Management is vital to ensuring the Agency properly assesses and manages risks to the Agency; its people, information, assets and reputation. This Policy describes how the Agency will manage security risks, as part of the Agency’s compliance with the Protective Security Policy Framework (PSPF).

Security Risk Management is part of the Agency’s broader risk management practices. This policy should be read in conjunction with the NDIA Risk Appetite Statement and Risk Management Framework as well as the Agency Security Plan.

2. Definitions

RAS: Risk Appetite Statement: The Board approved direction for the Agency’s readiness to bear the risk after risk treatment in order to achieve its objectives.

Risk: Effect of uncertainty on objectives — what has to ‘go right’ to ensure we are successful. An effect may be positive or negative.

Threat: A negative event that can lead to an undesired outcome, such as damage to, or loss of, an asset.

Vulnerability: The factors or processes which increase the susceptibility of a threat.

3. Objective

The objectives of this policy are to:

describe how the Agency will manage security risks,
provide a framework and defined roles, and
put security risk management into the organisational and operational context.

OFFICIAL

4. Policy application

A security risk is something that could result in the compromise, loss, unavailability or damage to information or assets, or cause harm to people or Agency/Scheme reputation. Security risk is the effect of uncertainty on objectives and is often measured in terms of its likelihood and consequences. The causes are generally people, systems, processes, procedures, crime, attacks or natural events. An:

effect is a deviation from the expected and may be positive or negative
objective has different aspects such as financial, health and safety and environmental goals, and can apply at multiple levels such as strategic, organisation-wide, project, product and process levels.

4.1 Security goals and strategic objectives

The NDIA’s security goals are to:

establish protective security management in the NDIA,
implement controls to meet the requirements of the PSPF, and
develop a positive risk culture.

4.2 Threats, risks and vulnerabilities

The primary security threats, risks and vulnerabilities faced by the Agency are:

Threats, including
- Aggression toward NDIA personnel and assets
- Hostile actors attempting to access information
Risks, including
- Compromise of information
- Physical harm to NDIA and partner personnel
- Loss or damage to assets and information
- Reputational damage to the NDIA and/or NDIS
Vulnerabilities, including
- Multiple sites of varying security levels
- Work conducted in and out of offices
- Shared ICT infrastructure with Services Australia
- Face-to-face contact with members of the public
- Service Providers and other third party delivery of the NDIS

4.3 Tolerance to security risks

The Agency’s risk tolerance is given in the Risk Appetite Statement, which is approved by the Board.

The Board has set our appetite for risk as conservative. In practice, this means we must closely monitor and regularly review how we are managing the risks we face.

The CSO has applied this interpretation and tolerance to security risks. Accordingly, security risks will be monitored and reviewed so that our operations are properly designed and conducted to ensure there is no undue risk to the Agency, its assets, information or people.

OFFICIAL

4.4 Capability to manage security risks

The Procedure includes:

security risk assessments, which are structured and comprehensive processes to identify, analyse and evaluate security risks and determine practical steps to minimise the risks, and
security risk treatments, which are the considered, coordinated and efficient actions and resources required to mitigate or lessen the likelihood or negative consequences of risks.

4.5 Strategies to implement security risk management

The success of security risk management depends on the effectiveness of security planning and how well arrangements are supported by the entity’s senior leadership and integrated into business processes.

The NDIA will implement security risk management through a risk based approach to all security policies.

Protective and Cyber Security Branch will foster a culture where risk management is an important and valued aspect of decision-making, where risk management processes are understood and applied appropriately; and where personnel can be confident in managing and taking risks, within defined parameters, in order to achieve objectives.

Business areas are responsible for a lot of the day-to-day security risk management. Protective and Cyber Security will work with them to build their capability and provide support as required.

4. Procedure

This policy is supported by the current version of the Security Risk Management Procedure (‘the Procedure’) and the procedures referred to therein.

The Procedure should be read in conjunction with the Risk Management Framework and Agency Security Plan.

5. Key principles

The following key principles underpin the NDIA’s approach to security risk management:

The CSO is the owner for all security risks in the NDIA, and is accountable to the CEO and Board.
Security risks will be managed consistent with the Risk Appetite Statement, Risk Management Framework and relevant legislation.
Security risks may impact on all of the Agency’s strategic risks.

OFFICIAL

Security risks will be considered relative to the five consequences (Participant outcomes, Scheme sustainability, Market, Our Agency Staff and Partners in the Community, and Public confidence & trust) described in the Risk Assessment Criteria.
Security risk management will be addressed using the Agency Risk Management Cycle.
Protective and Cyber Security Branch is responsible for the delivery of a secure Agency. The Branch will work closely with different business areas to address security risks.

6. Mandatory Requirements

Protective and Cyber Security Branch will follow this Policy, and the associated Procedure, at all times when delivering protective security for the Agency.

The approach to security risk management will be consistent with the Agency’s broader approach to risk management.

Each business area is responsible for delivering day-to-day security risk management in their operations and sites. Protective and Cyber Security Branch will support the development of security conscious business practices.

7. Relevant legislation

This Policy is supported by Commonwealth legislation including:

Public Governance, Performance and Accountability Act 2013
National Disability Insurance Scheme Act 2013
National Disability Insurance Scheme – Risk Management Rules 2013

Other

Protective Security Policy Framework
Information Security Manual