Document ID: chunk:federal_register_of_legislation:F2021L01392:clause:6_22:p3
Version: federal_register_of_legislation:F2021L01392
Segment Type: clause
Provision Reference: sch 6 cl 22 (pt 3/3)
Character Range: 98427–103562

backup, retention, and, in accordance with rules 7.12 and 7.13, deletion and de‑identification.

(4)  An accredited data recipient must implement a formal vulnerability management program to identify, track and remediate vulnerabilities within the CDR data environment in a timely manner.  (a)                                                                                                                                                                                                                                                                                                                                                                                                    Security patching                                  A formal program is implemented for identifying, assessing the risk of and applying security patches to applications and operating as soon as practicable.

(b)  Secure coding                                                                                                                                                                               Changes to the accredited data recipient's systems (including its CDR data environment) are designed and developed consistent with industry accepted secure coding practices, and are appropriately tested prior to release into the production environment.

(c)  Vulnerability management                                                                                                                                                                    A formal vulnerability management program is designed and implemented, which includes regular vulnerability scanning and penetration testing on systems within the CDR data environment.

(5)  An accredited data recipient must take steps to limit prevent, detect and remove malware in regards to their CDR data environment.                                                          (a)                                                                                                                                                                                                                                                                                                                                                                                                    Anti-malware anti-virus                            Anti-virus and anti-malware solutions are implemented on endpoint devices and on servers to detect and remove malware from the CDR data environment and are updated on a regular basis. End-user systems are updated with the latest virus definitions when they connect to the network. Reports or dashboards highlighting compliance metrics are regularly generated and monitored, and non-compliant items are actioned as soon as practicable.

(b)  Web and email content filtering                                                                                                                                                             Solutions are implemented to identify, quarantine and block suspicious content arising from email and the web.

(c)  Application whitelisting                                                                                                                                                                    Download of executables and installation of software on infrastructure and end-user devices (including on BYOD devices) is restricted to authorised software only.

(6)  An accredited data recipient must implement a formal information security training and awareness program for all personnel interacting with CDR data.                                       (a)                                                                                                                                                                                                                                                                                                                                                                                                    Security training and awareness                    All users undergo mandatory security and privacy training prior to interacting with the CDR data environment, with 'refresher courses' provided at least annually.

(b)  Acceptable use of technology                                                                                                                                                                A policy relating to the CDR data environment is created, implemented, communicated and agreed to by all personnel prior to being able to access the CDR data environment. This policy sets out the responsibilities of these personnel in interacting with the CDR data environment and is regularly made aware to personnel.

(c)  Human resource security                                                                                                                                                                     Background checks are performed on all personnel prior to being able to access the CDR data environment. These may include, but are not limited to, reference checks and police checks.