Freedom of Information request — Notification of Decision
Our reference: FOI 22/23-0830
GPO Box 700 Canberra ACT 2601 1800 800 110 dis.gov.au
5 August 2023
Florence
By email: foi+request-9565-685e9c44@righttoknow.org.au
Dear Florence
Thank you for your correspondence of 13 November 2022, in which you requested access to documents held by the National Disability Insurance Agency (NDIA), under the Freedom of Information Act 1982 (FOI Act).
The purpose of this letter is to provide you with a decision on your request.
Scope of your request
You have requested access to the following documents:
“So, my questions are:
- Who specifically provided the advice that the NDIA was not required to comply with or follow the PSPF? Job title and location will suffice 2. Noting all these new roles and requirements, was the person(s) consulted at the NDIS at the time qualified and competent to answer questions on cyber/security and the PSPF?
- As the NDIS seems to have overnight sought to align with and comply with the PSPF, please provide a copy of the instruction or directive to do so.
- Has there been (or is there) an investigation into providing inaccurate, seemingly false or potentially misleading information about the NDIS security (cyber included) obligations, compliance and assurance requirements?
- Prior to this new found support and embracing of the PSPF, which specific security standards and framework did the NDIS/NDIA employ, attest to, report to the Attorney General’s Department or provide guarantees, compliance or alignment with to any other Government/public entity?
- Please provide a copy of the requirement and approval for all these new, sudden cyber security roles. Has the threat changed?
- How many NDIS staff, contractors, providers and participants have been affected or compromised as a result of the Medibank, Optus, Australian Clinical Labs, or any other data breach, compromise or hack?”
Decision on access to documents
I am authorised to make decisions under section 23(1) of the FOI Act. My decision on your request and the reasons for my decision are set out below.
Section 17(1)(c) of the FOI Act provides that an agency can produce a written document containing the requested information, by the use of a computer or other equipment that is ordinarily available for retrieving or collating stored information. We have been able to produce documents containing some of the information you requested. I have, therefore,
Senior Freedom of Information Officer
Treated your request as if it were a request for access to those documents in accordance with section 17(1)(c) of the FOI Act.
I have identified 3 documents, which fall within the scope of your request. Additionally, I have provided 1 publicly available link that addresses the scope of your request. protective-security-guidance-for-executives.pdf
The documents were identified by conducting searches of NDIA’s systems, using all reasonable search terms that could return documents relevant to your request, and consulting with relevant NDIA staff who could be expected to be able to identify documents within the scope of the request.
I have decided to grant access to 3 documents in full.
In reaching my decision, I took the following into account:
- your correspondence outlining the scope of your request
- the nature and content of the documents falling within the scope of your request
- the FOI Act
- the FOI Guidelines published under section 93A of the FOI Act
Access to edited copies with exempt or irrelevant material deleted (section 22)
I have decided that Documents 2 and 3 redacted material that is exempt from disclosure
under the FOI Act.
I have also identified that Documents 2 and 3 redacted material that is irrelevant to your
request. The irrelevant material relates to names and contact details of NDIA staff /
information which is not relevant to the subject matter of your request.
In accordance with section 22 of the FOI Act, I have considered whether it is possible to delete the exempt and irrelevant material from the documents and have concluded that it is reasonably practicable to do so. Accordingly, I have prepared an edited copy of the documents with the exempt and irrelevant material removed.
Release of documents
The documents for release, as referred to in the Schedule of Documents at Attachment A, are enclosed.
Rights of review
Your rights to seek a review of my decision, or lodge a complaint, are set out at Attachment B.
Should you have any enquiries concerning this matter, please do not hesitate to contact me by email at foi@ndis.gov.au.
Yours sincerely
Ankit Senior Freedom of Information Officer Parliamentary, Ministerial & FOI Branch Government Division
Attachment A
Schedule of Documents for FOI 22/23-0830
| Document number | Page number | Description | Access Decision | Comments |
|---|---|---|---|---|
| 1 | 1-2 | Section 17 Document Created Date: Various |
FULL ACCESS | Document created under section 17 of the FOI Act |
| 2 | 3 | Email Subject: Approval to Approach Market - EL2 Director Cyber Security Risk and Compliance Date:19 October 2022 |
FULL ACCESS | Irrelevant material removed under section 22 of the FOI Act |
| 3 | 4-7 | Email Subject: Approval Required: EL1 Assistant Director CSOC Capability Development Date:13 October 2022 |
FULL ACCESS | Irrelevant material removed under section 22 of the FOI Act |
Attachment B
Your review rights
Internal Review
The FOI Act gives you the right to apply for an internal review of this decision. The review will be conducted by a different person to the person who made the original decision.
If you wish to seek an internal review of the decision, you must apply for the review, in writing, within 30 days of receipt of this letter.
No particular form is required for an application for internal review, but to assist the review process, you should clearly outline your grounds for review (that is, the reasons why you disagree with the decision). Applications for internal review can be lodged by email to foi@ndis.gov.au or sent by post to:
Freedom of Information Section Parliamentary, Ministerial & FOI Branch Government Division National Disability Insurance Agency GPO Box 700 CANBERRA ACT 2601
Review by the Office of the Australian Information Commissioner
The FOI Act also gives you the right to apply to the Office of the Australian Information Commissioner (OAIC) to seek a review of this decision.
If you wish to have the decision reviewed by the OAIC, you may apply for the review, in writing, or by using the online merits review form available on the OAIC’s website at www.oaic.gov.au, within 60 days of receipt of this letter.
Applications for review can be lodged with the OAIC in the following ways:
- Online: www.oaic.gov.au
- Post: GPO Box 5218, Sydney NSW 2001
- Email: enquiries@oaic.gov.au
- Phone: 1300 363 992 (local call charge)
Complaints to the Office of the Australian Information Commissioner or the Commonwealth Ombudsman
You may complain to either the Commonwealth Ombudsman or the OAIC about actions taken by the NDIA in relation to your request. The Ombudsman will consult with the OAIC before investigating a complaint about the handling of an FOI request.
Your complaint to the OAIC can be directed to the contact details identified above. Your complaint to the Ombudsman can be directed to:
- Phone: 1300 362 072 (local call charge)
- Email: ombudsman@ombudsman.gov.au
Your complaint should be in writing and should set out the grounds on which it is considered that the actions taken in relation to the request should be investigated
1