Document ID: chunk:federal_register_of_legislation:F2024C01258:schedule:2:p5
Version: federal_register_of_legislation:F2024C01258
Segment Type: schedule
Provision Reference: sch 2 (pt 5/6)
Character Range: 360425–369635

(2)  An accredited data recipient of CDR data must take steps to secure their network and systems within the CDR data environment.                                                               (a)                                                                                                                                                                                                                                                                                                                                                                                                    Encryption                                         Encryption methods are utilised to secure CDR data at rest by encrypting file systems, end‑user devices, portable storage media and backup media. Cryptographic keys are securely stored, backed‑up and retained.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Appropriate user authentication controls (consistent with control requirement 1) are in place for access to encryption solutions and cryptographic keys.

(b)  Firewalls                                                                                                                                                                                   Firewalls are used to limit traffic from untrusted sources. This could be achieved by implementing a combination of strategies including, but not limited to:
                                                                                                                                                                                                 (a) restricting all access from untrusted networks; and
                                                                                                                                                                                                 (b) denying all traffic aside from necessary protocols; and
                                                                                                                                                                                                 (c) restricting access to configuring firewalls, and review configurations on a regular basis.

(c)  Server hardening                                                                                                                                                                            Processes are in place to harden servers running applications, databases and operating systems in accordance with accepted industry standards.

(d)  End‑user devices                                                                                                                                                                            End‑user devices, including bring‑your‑own‑device (BYOD) systems, are hardened in accordance with accepted industry standards.

(e)  Data Segregation                                                                                                                                                                            CDR data that is stored or hosted on behalf of an accredited data recipient or CDR representative is segregated from other CDR data to ensure it is accessible only by the accredited data recipient for whom consent was given and remains directly attributable to that accredited data recipient.

(3)  An accredited data recipient must securely manage information assets within the CDR data environment over their lifecycle.                                                                  (a)                                                                                                                                                                                                                                                                                                                                                                                                    Data loss prevention                               Data loss and leakage prevention mechanisms are implemented to prevent data leaving the CDR data environment, including, but not limited to:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           (a) blocking access to unapproved cloud computing services; and
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           (b) logging and monitoring the recipient, file size and frequency of outbound emails; and
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           (c)  email filtering and blocking methods that block emails with CDR data in text and attachments; and
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           (d) blocking data write access to portable storage media.

(b)  CDR data in non‑production environments                                                                                                                                                     CDR data is secured from unauthorised access by masking data, prior to being made available in non‑production environments.

(c)  Information asset lifecycle (as it relates to CDR data)                                                                                                                                     The accredited data recipient must document and implement processes that relate to the management of CDR data over its lifecycle, including an information classification and handling policy (which must address the confidentiality and sensitivity of CDR data) and processes relating to CDR data backup, retention, and, in accordance with rules 7.12 and 7.13, deletion and de‑identification.

(4)  An accredited data recipient must implement a formal vulnerability management program to identify, track and remediate vulnerabilities within the CDR data environment in a timely manner.  (a)                                                                                                                                                                                                                                                                                                                                                                                                    Security patching                                  A formal program is implemented for identifying, assessing the risk of and applying security patches to applications and