SENSITIVE Information with a ‘medium’ confidentiality business impact level requiring additional care in handling Must be labelled SENSITIVE SENSITIVE information requires additional handling care due to its sensitivity or moderate business impact if compromised or lost Examples may be: government or agency business, whose compromise could affect the government’s capacity to make decisions or operate, the public’s confidence in government, the stability of the market place and so on commercial interests, whose compromise could affect the competitive process and provide the - opportunity for unfair advantage legal professional privilege law enforcement operations, whose compromise could hamper or render less useful crime prevention strategies or investigations or adversely affect personal safety personal information, which is required to be safeguarded under the Information Privacy Act 2009, the Public Records Act 2002 or other legislation. Store, handle, archive and disposal - Subject to requirements of the Queensland Information Security Policy (IS18); AND - Store and handle based on risk acceptable to the information owner as outlined in agency Information Security Management System (ISMS); AND - In accordance with authorised retention and disposal schedule issued under the . For minimum requirements: Refer to and The chosen controls must provide sufficient safeguards to adequately protect the information based on the confidentiality level of the information. PROTECTED Must be labelled PROTECTED Green folder, yellow stripe Information with a ‘High’ confidentiality business impact level, whose compromise could cause actual damage to the State, the Government, commercial entities or members of the public. For instance, compromise could: endanger individuals’ lives and private entities; work substantially against government finances or economic and commercial interests; substantially undermine the financial viability of major organisations; and/or impede the investigation or facilitate the commission of serious crime. Information passed by other governments that is marked PROTECTED Cabinet information The dictates security classifications, markings and handling for Queensland Cabinet material.
Example assessment of business impacts to confidentiality, integrity, availability levels This shows an example of an assessment, and in this case the asset has been assessed as high BIL based on integrity, medium availability and low for confidentiality. The agency should consider existing controls required by the Information Security Policy (IS18) and whether these mandatory requirements treat assessed risk to a level that is tolerable to the information owner. If not, consider additional integrity controls. Note that establishing cumulative control sets for CIA high-low may simplify architecture. For example, an agency may choose to assess risk above baseline controls or create controls standards for classification, as follows: Low Medium High Confidentiality Assess Baseline Controls Baseline + Risk Assess need for any additional agency controls. ASD – Cyber Security Man. + Risk Assess need for any additional agency controls. Integrity Assess Baseline Controls Baseline + Risk Assess need for any additional agency controls. Baseline + Risk Assess need for any additional agency controls. Availability Assess Baseline Controls Baseline + Risk Assess need for any additional agency controls. Baseline + Risk Assess need for any additional agency controls. Or, it may be efficient for agencies create controls standards for some/all of the CIA configurations: Low Medium High Confidentiality C Controls Standard Low C Controls Standard Med C Controls Standard High (ASD - Cyber Security Man. Controls, plus agency controls) Integrity I Controls Standard Low I Controls Standard Med I Controls Standard High Availability A Controls Standard Low A Controls Standard Med A Controls Standard High
Integrity – Business impact assessment - example Integrity Impact Low Medium High Risk to Individual safety Consider any risk of injury or impact on safety, as well as the possibility of loss of life. This could be due to a semantic attack which causes a SCADA system to misfunction Risk to individual safety Direct actual risk to individual safety Direct actual risk to individual life / lives Data Quality Effect on agency data quality requirements Record keeping does not meet Public Record Act (2002 QLD) requirements Loss of historically important records Significant failure of Evidentiary requirements (QLD Evidence Act 1977), Chain of Custody Distress caused to any party Information gathered about a party that is incorrect. Inability to correct inaccuracies effectively. Information is aged and therefore less accurate. A party is concerned that information gathered is incorrect Multiple parties are concerned or issues Direct, tangible and significant distress caused Personally sensitive data integrity failure Does information held about clients have appropriate integrity/quality. Examples include medical records and other personal information. Inability to correct inaccurate information in a timely manner Quality of personal information held is not fit for purpose Low quality of holdings affects customers adversely over days Inaccuracies in personal information have significant & tangible effects on multiple customers Impact on Government finances or economic and Impact on Government finances or economic and commercial interests. Fraud through the changing of government financial data is an integrity threat Low - Moderate impact Severe impact on a single agency Catastrophic impact on multiple agencies
commercial interests Financial loss to any client[1] of the service provider or third party Consider this from the service provider’s perspective - what losses could they incur? Considerations include possibility of fraud, a party illegally transferring money, a party gaining control of assets they don't legally own (e.g. by using the provided information to establish an identity which is not theirs, and then changing ownership details Low - Moderate impact Severe impact on small numbers of clients or third party Catastrophic impact on multiple third parties, service providers or significant numbers of clients Financial Loss to Agency / Service Provider Consider this from the service provider’s perspective - what losses could they incur? Considerations include possibility of fraud, a party illegally transferring money, or a party gaining control of assets they don't legally own Low - Moderate impact Severe impact to an agency or a service provider Catastrophic impact on multiple agencies and service providers Assistance to Crime or impact on its detection If the integrity of the information were low, would this have the potential to assist criminals. Low Moderate detriment Significant Impact on development or operation of government policy Would integrity loss impact government during the stages where policy is being formulated or implemented? The negative impact may be that a policy initiative will not proceed. Low Medium Catastrophic Impact on risk of litigation Integrity loss impacts litigation against the state of QLD negatively Low Medium Catastrophic
higher confidentiality classification, or integrity and availability requirements. Examples include credit card data (PCI-DSS) or information subject to specific legislation, such as the Privacy Act. Public information PUBLIC is not a security classification level under the new classification framework. However, there is no restriction on an information owner choosing to label information PUBLIC, noting that where the information is held on an information system, it will be subject to Integrity and Availability requirements. Public information is OFFICIAL information that has undergone an agency authorised publication process to identify that it was suitable to be published. Some of these processes are not security related including relevant copyright identification processes. Agencies need to maintain their own processes to approve information for public release. Some information assets intended for public consumption may have time-limited confidentiality requirements before release (for example, budget papers). In this case, the information should be embargoed, marked and appropriately safeguarded until publication is authorised. De-identification, de-aggregation and redaction techniques can be used to support proactive information release under right to information and open data goals. However, care and expertise is required to ensure these are effective. Special care is required to ensure privacy is preserved with data derived from information about individuals. The Office of the Information Commissioner Queensland has some useful guidance on ‘’ and . Further information - . National security information National security information (NSI) is not a confidentiality classification as different NSI may need different levels of safe guarding. NSI is any official resource (including equipment) that records information about, or is associated with, Australia’s: National security information relates to: protection from espionage, sabotage, politically motivated violence, promotion of communal violence, attacks on Australia’s defence system, acts of foreign interference and the protection of Australia’s territorial and border integrity from serious threats defence capability In some cases, the risk may dictate that national interest information requires the same safe guards as national security information. National interest information comprises official resources (including equipment) that records information about, or is associated with: Australia’s international relations, significant political and economic relations with international organisations and foreign governments law and governance, including: interstate/ territory relations law enforcement operations where compromise could hamper or make useless national crime prevention strategies or investigations, or endanger personal safety economic, scientific or technological matters vital to Australia’s stability, integrity and wellbeing heritage or culture. The source of most national security information is the federal government.