Business Operations

Policy

Description

Acceptable use of ICT services, facilities, and devices policy

This policy sets out the department’s commitment to authorising, managing, and monitoring the acceptable use of ICT resources and proactively manage misuse.

Administrative release policy and procedure

This policy guides the department’s release of information where practicable and appropriate.

Human resources security policy

This policy outlines the implementation of information security controls for managing and reducing security risks during an employee’s lifecycle.

ICT Access control policy

This policy outlines the security access control to manage access to the departments information and information processing facilities.

ICT Asset management policy

This policy outlines information security controls, processes and appropriate protections when identifying the department owned business systems, devices, or applications.

ICT Communications security policy

This policy outlines the implementation of security to manage communication security risks associated with the network and its processing facilities to ensure the secure transfer of information within the department and with any external party.

ICT Compliance policy

This policy outlines the management of breaches of legal, statutory, regulatory, or contractual obligations related to information security and of any security requirements.

ICT Cryptographic controls policy

This policy outlines the implementation of the use of cryptographic controls to protect the confidentiality, authenticity and/or integrity and availability of the departments sensitive information.

ICT Information security aspects of business continuity management policy

This policy outlines the implementation of security controls as part of business continuity for the departments information and business systems.

ICT Information security incident management policy

This policy outlines the approach to the management of information security incidents, and communication on security events and weaknesses.

ICT Operations security policy

This policy outlines information security management to correct and secure operations of information processing in internal or externally managed facilities.

ICT Supplier relationships policy

This policy outlines information security to ensure protection of the departments assets that are accessible by suppliers.

ICT System acquisition, development, and maintenance policy

This policy outlines implementing information security to ensure that information security is an integral part of information systems across the entire lifecycle across internal and public networks.

Information management policy

This policy outlines the departments information management practices to support effective and efficient service delivery.

Information privacy policy

This policy outlines how the department collects, stores, uses and discloses personal information.

Information security classification policy

This policy outlines the departments commitment to classifying its information and business systems.

Information security policy

This policy outlines the departments approach to the implementation of information security.

Organisation of information security policy

This policy outlines the implementation and operation of information security, the controls for the use of mobile devices and the protection of information being accessed processed and stored at teleworking sites.

Physical and environment security policy

This policy underpins the department’s information security management system and aligns with International standards ISO 27001:2013 Information technology – security techniques – information security management systems requirements relating to ISO 27001 Security Control A.11 – Physical and environment security.

Records management policy

This policy outlines the department’s commitment to meeting its recordkeeping obligations under the Public Records Act 2002 and whole-of-government information standards.

Right to information policy

This policy outlines the department’s commitments to giving the community greater access to government-held information where it is in the public interests to do so.

Telecommunications policy

This policy outlines expectations of use for fixed and mobile telecommunication services on a departmental device or Bring Your Own Device used for official purposes.