Medicare certificate PKI-IO HPI-O NASH certificate PKI-I NASH-I Electronic transfer of prescriptions – certificates eTP supplier Support details Encryption keys Template 2.19: Asset register – other software programs (e.g. pathology, diagnostics download) Name/version Description Serial numbers/licence codes Which computers Location of media
Human – deliberate – internal (insider threats/staff/authorised third parties) or damage of equipment Financial loss Disruption of operational activities Legitimate access to premises and equipment register up to date (see CISS Section 2.5) Removal of all equipment and assets formally recorded (see CISS Section 11.3) Assets (keys and equipment) returned on termination of employment (see CISS Section 4.1) Equipment located to minimise unnecessary access (see CISS Section 11.3) Network connections and cabling protected, including segregation of power and communications cables, electromagnetic shielding, and documented setup of patching (seek technical advice for confirmation of these Portable devices policy and procedures enforced and monitored (see CISS Section 10) Leakage or theft of information Violation of legislation or regulation Adverse effect on reputation Breach of confidentiality (potential information disclosure) Legitimate access to systems Confidentiality and non-disclosure agreements signed (see CISS Section 3.4) Agreements with parties including compliance with practice policies signed (see CISS Section 3.5) Access rights removed on termination of employment (see CISS Section 4.5) Information securely deleted when equipment and assets disposed of (see CISS Section 11.5) Use of external and personal devices such as USBs controlled or prohibited (see CISS Section 10) Employee sabotage Disruption of operational activities Breach of integrity (potential information modification or destruction) Legitimate access to systems Lack of policy and procedure monitoring Access control policy and procedure implemented and monitored (see CISS Section 4) Breach reporting in place (see CISS Section 2.9) Access rights removed on termination of employment (see CISS Section 4.5) Access to system utilities limited (see CISS Section 11.8) Financial loss Access to systems Access control policy and procedure implemented and monitored (see CISS Section 4)
Threat/risk source Disruption/impact Vulnerability Suggested appropriate solutions and mitigation strategies Solutions Person responsible Existing Required (to action) – deliberate - external Theft or damage of equipment Financial loss Disruption of operational activities Inadequate physical controls of system and network Asset register up to date (see CISS Section 2.5) Equipment effectively physically protected, including limited access to critical resources such as server (see CISS Section 11.3) Removal of all equipment and assets formally recorded (see CISS Section 11.3) Assets (keys and equipment) returned on termination of employment (see CISS Section 4.1) Equipment located to minimise unnecessary access (see CISS Section 11.3) Network connections and cabling protected, including segregation of power and communications cables, electromagnetic shielding, and documented set up of patching (seek technical advice confirmation of these) Portable devices policy and procedures enforced and monitored (see CISS Section 10) Theft of information Violation of legislation or regulation Adverse effect on reputation Breach of confidentiality Lack of appropriate access control Limited network controls Access control policy and procedures in place (see CISS Section 4) Use of external and personal devices such as USBs controlled or prohibited (see CISS Section 10) Breach reporting to authorities in place (see CISS Section 2.9) Perimeter controls including firewalls and IDS security effective (see CISS Section 9) Secure messaging and transfer of information using encryption and authentication in place (see CISS Section 12.2)
Information loss Violation of legislation or regulation Adverse effect on reputation Breach of confidentiality Poor or no backup procedures Lack of appropriate access control Backup procedures are effective and monitored (see CISS Section 7) Breach reported to authorities (see CISS Section 2.9) System utilities segregated from application software (seek advice from technical service provider) Access to system utilities limited (see CISS Section 11.8) Denial of service (DoS – attempt to make computer resources unavailable) Loss or degradation of network capacity Loss of internet connectivity Intrusion detection system configured to detect DoS (see CISS Section 9.4) Firewall configured to block specified network traffic (see CISS Section 9) Outgoing connections to internet relay chat (IRC), instant messaging and peer-to-peer services blocked (seek advice from technical service provider)
Template 5.6: Business continuity – backlog of information schedule Data entry from manual processing What needs to be entered? Person responsible Re-enter appointments Re-enter invoices and payments Run banking and administration processes if already processed manually Process Medicare claims Request re-send of results electronically that may have been received in printed form computer system was inoperable Update consultation notes