Implementation Guidance Marking Description Portable Storage Devices Remote Access Sanitisation and Re-use Public Information authorised for unlimited public access and circulation, such as agency publications and web sites. Such information should still be accompanied by Integrity and Availability classifications. Labelling or of devices according to classification is recommended per controls 0332-0336 in the ISM. No special controls applicable No special controls applicable. For Official Use Only Information is only available for official use by South Australian or Australian Government personnel (including authorised contractors). The public release of this information may be authorised by an agency head or agency policy. PSDs only be connected to systems with an equal or greater classification per control 0337 in the ISM. Password control plus basic encryption shall apply. Additional mechanisms for Information marked as Protected should include use of strong ciphers and additional key files. Cryptographic controls and guidance are described in the ISM. Dual phase password control (Remote Access login and system login) plus transmission encryption as described in the ISM. Media should be wiped in alignment with ISMF Standard 60. Post sanitisation media classifications for magnetic media and for non-volatile flash memory are described in the ISM. Sensitive (legislation cited) Sensitive: Personal Compromise could cause limited damage to the State, the Government, an agency, commercial entities or members of the public. (refer control S19.13 in the ISMF) Responsible Parties observe the authentication requirements described by ISMF Standard 86 Cryptographic (encryption) mechanisms must be enabled in alignment with the Cryptography chapter in the ISM. Sensitive: Legal Sensitive: Commercial Sensitive: Medical Compromise could cause moderate damage to the State, the Government, commercial entities or members of the public. Sensitive: SA Cabinet Sensitive: Cabinet Compromise could cause significant damage to the State, the Government, commercial entities or members of the public. Sensitive: Cabinet materials received from the Australian Government must be classified as [P] Protected. PSD use not permitted without formal exemption process and authorisation by Agency Chief Executive. Secure wipe per ISM *or* destruction of media per the relevant sections of the ISM. Classification Description [P] Protected The PROTECTED security classification is used when the compromise of the information could cause damage to the Australian Government including states and territories, commercial entities or members of the public. For instance, where compromise could:
Additional controls based on DLMs and protective markings Classification Additional Controls [P] Protected [SC] Sensitive: Cabinet [I4] Integrity 4 [A4] Availability 4 Processing facilities managed by the Responsible should be segregated physically from those managed by third parties. [SLC] Sensitive: Legal or Commercial [SM] Sensitive: Medical [SP] Sensitive: Personal [I3] Integrity 3 [A3] Availability 3 Intruder prevention and detection systems for physical incursions, including alarms should be installed and regularly tested. Locations of sensitive information processing facilities and other areas should not be included on directories and phone books, with special consideration given to publicly accessible directory information such as that located in lobbies, foyers and stairwells. [FOUO] Official Use Only [SOUO] Sensitive [I2] Integrity 2 [A2] Availability 2 Office equipment and support functions should be situated within the secure area to reduce the likelihood of information compromised. To the extent practicable, site locations should not give indication of the information processing activities and requirements transpiring in situ. Key facilities should be located to avoid or reduce general access by the public. Note: Controls begin to apply at the classifications listed and are retained at higher levels. Working in Secure ISMF Standard 38 (Secure Areas) Each Agency should enforce controls for working in secure areas and should apply such controls to all personnel or third parties working there, as well as third party activities taking place there. Suppliers and their contractors or representatives must adhere to Agency controls for working in secure areas. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Each Responsible Party should implement the guidance described in (alternately refer ). Additional controls on DLMs and protective markings
System planning and acceptance Standards Capacity management ISMF Standard 52 (Capacity management) Responsible Parties should ensure that capabilities, resources and services are monitored, optimised and projections for demand particularly during peak periods (whether calendar or event driven) are factored into the service delivery plan. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Capacity planning and management activities should be incorporated into Agency Business Continuity [BCP] and Disaster Recovery Plans [DRP] and should include the overflow capabilities for supporting assets and/or services such as communication transmission links for voice, video and data networks or network attached storage devices. Implementation of ISMF Standard 52 satisfies the objectives described in (or alternately ). Additional controls based on DLMs and protective markings Classification Additional Controls [A4] Availability 4 [A3] Availability 3 Responsible Parties must incorporate services and platforms classified at Availability 3 or Availability 4 into a documented capacity management plan. System acceptance ISMF Standard 53 (System acceptance) Responsible Parties shall implement provisions for acceptance testing of new ICT systems, services, upgrades and releases. Business Controls
Human Resources ISMF Standard 21 (Security in job and person specifications) ISMF Standard 22 (Personnel screening) Business Owners ISMF Standard 24 (Management and supervisory obligations) ISMF Standard 25 (Ongoing security awareness) ISMF Standard 26 (Disciplinary process) Business Owners ISMF Standard 28 (Return of assets) ISMF Standard 29 (Removal of access) Business Owners and Security ISMF Standard 31 (Reporting vulnerabilities) ISMF Standard 140 (Notifiable Incidents) ISMF Standard 32 (Incident management) ISMF Standard 34 (Evidence) Building Management ISMF Standard 36 (Physical access control) ISMF Standard 37 (Security of offices and facilities) ISMF Standard 39 (Delivery and loading areas) Business Owners ISMF Standard 40 (Equipment site selection) ISMF Standard 45 (Secure disposal or re-use) ISMF Standard 46 (Removal of property) Responsible Parties ISMF Standard 48 (Change management) ISMF Standard 50 (Separation of test, development and production environments) Procurement and Security ISMF Standard 51 (Security in party service delivery) Business Owners ISMF Standard 53 (System acceptance) Responsible Parties ISMF Standard 54 (Malware and prevention) ISMF Standard 141 (Endpoint protection) Responsible Parties ISMF Standard 56 (Archives and backups) Responsible Parties ISMF Standard 57 (Network security) ISMF Standard 58 (Network services) Business Owners ISMF Standard 59 (Portable Storage Devices) ISMF Standard 60 (Sanitisation and/or disposal of media) Business Owners ISMF Standard 64 (Media in transit) ISMF Standard 65 (Messaging and social networking) ISMF Standard 69 (E-commerce) Responsible Parties ISMF Standard 73 (Administrator and operator logs) Responsible Parties ISMF Standard 76 (Access Control)
Responsible Parties ISMF Standard 78 (Management of privileges) ISMF Standard 80 (User access review) Business Owners ISMF Standard 81 (Password use obligations) Responsible Parties ISMF Standard 88 (Configuration port protection) ISMF Standard 89 (Network segregation) Responsible Parties ISMF Standard 93 (Secure Logon) ISMF Standard 94 (User identification and authentication) ISMF Standard 95 (Password management system) ISMF Standard 96 (Control of system tools and utilities) ISMF Standard 97 (Inactive sessions) Business Owners ISMF Standard 99 (Legitimate need-to-access / Business Owners ISMF Standard 101 (Mobile and portable storage devices) ISMF Standard 44 (Remote, portable and off premises devices) Procurement, Security and Responsible Parties ISMF Standard 103 (Security in new or enhanced ICT systems) Business Owners The subordinate ISMF Standards must be applied to systems operating at I4 classification for integrity, and should be applied to I3 systems. Responsible Parties ISMF Standard 112 (Cryptographic key management) Responsible Parties ISMF Standard 113 (Installation and deployment of software) Responsible Parties ISMF Standard 116 (Change control in development and support) ISMF Standard 117 (Change review) ISMF Standard 143 (Secure development principles) Responsible Parties ISMF Standard 121 (Vulnerability management) Business Owners ISMF Standard 122 (Business continuity management) ISMF Standard 124 (Business continuity ISMF Standard 126 (BCP review) Responsible Parties ISMF Standard 127 (Legislative and regulatory requirements) ISMF Standard 128 (Intellectual property) ISMF Standard 129 (Protection of government records) ISMF Standard 130 (Privacy and confidentiality)
ANNEX F - MAPPING TO AUSTRALIAN AND INTERNATIONAL STANDARDS The following table provides a simplified mapping of International, South Australian and Australian Commonwealth legislation, policies, controls and standards as well as listing complementary standards and measures implemented in this framework. SOUTH AUSTRALIAN GOVERNMENT AUSTRALIAN GOVERNMENT INTERNATIONAL ISO IMPLEMENTATION GUIDANCE ISMF Policy Statements and Standards Other SA policy, standards and legislation Information Security Manual controls Protective Security Policy Framework (PSPF) ISO 27001:2006 Control Objectives & Controls ISO Control Objectives & Controls Miscellaneous supporting standards & guidelines and information sheets Section 4-8 Section 4-10 Section 4-8 Section 4-10 Section 4 (ISO Section 6 Refer Other A.5.1 A.5.1 A.5.1.1 A.5.1.1 A.5.1.2 A.5.1.2 A.6.1 Section 6 A.6.1.1 Section 6 A.6.1.2 (retired) A.6.1.3 A.6.1.1 A.10.1.3 A.6.1.2 A.6.1.4 (retired) A.6.1.6 A.6.1.3 A.6.1.7 A.6.1.4 n/a A.6.1.5 A.6.2 A.15.1
A.8.2.2 A.7.2.2 A.8.2.3 A.7.2.3 A.8.3 A.7.3 A.8.3.1 A.7.3.1 A.8.3.2 A.8.1.4 A.8.3.3 A.9.2.6 A.13.1 A.13.2 A.16.1 A.13.1.1 A.16.1.2 n/a A.16.1.4 A.13.1.2 A.16.1.3 A.13.2.1 A.16.1.1 A.16.1.5 A.13.2.2 A.16.1.6 A.13.2.3 A.16.1.7 s5.4 of the Physical security chapter A.9.1 A.11.1 Physical security chapter A.9.1.1 A.11.1.1 A.9.1.2 A.11.1.2 A.9.1.3 A.9.1.4 A.11.1.3 A.11.1.4 A.9.1.5 A.11.1.5 A.9.1.6 A.11.1.6 A.9.2 A.11.2 A.9.2.1 A.11.2.1 A.9.2.2 A.11.2.2