Compliance Checklist Data Vault/Mailbox Requirements Levels of Assurance – Data Management Services (data vaults, mailboxes etc) Minimal assurance Low assurance Moderate assurance High assurance Level 1 Level 2 3 Level 4 Minimal confidence in the services offered Low confidence in the services provided Moderate confidence in the services provided High confidence in the services provided. Important Achieving LoA 4 Assurance requires completion of the requirements for LOA1 – LoA 3. Where the Provider supports storage of digital copies of government issued credentials (eg passports or motor vehicle licences) these credentials remain the property of the issuing agency. Where the Provider supports storage of financial data such as credit card details, compliance with the Payment Card Industry Data Security Standard (PCI-DSS) will apply (see ). Where a Provider utilises secure data storage services from a third party the security and privacy controls must clearly identify the respective roles and responsibilities of both the Provider and third party. Note Providers must specify the physical location of data centres used to store personal information. Where a Provider utilises services outside Australia to store, backup, process, transmit, manage or otherwise support its Australian operations these must be clearly identified and included in the Provider’s security and privacy documentation. Agencies will apply a risk assessment process in making decisions to rely on data or credentials known to be stored by an individual outside Australia. REQUIREMENT LOA 1 LOA 2 LOA 3 LOA 4 Services Fully operational legal entity compliant with all relevant legal requirements including agency specific legislation and policies (self assessed). Published Liability Policy Financial situation sufficient for liability exposure (self assessed). Annual service management audit (external) – see ASAE 3402: Assurance Reports on Controls at a Service Organisation records maintained for 36 months Financial situation sufficient for liability exposure (independent assessment by a qualified accountant who is a member of a professional accounting body) Privacy Independent Privacy Impact Assessment (PIA) – see for further information. Demonstrated compliance with all National Privacy Principles (NPPs), the Information Privacy Principles (IPP’s) as applicable and all Australian Privacy
Storage and electronic transmission of personal information Use an encryption product that implements a DACA as per ISM requirements practical, cryptographic products must provide a means of data recovery Use an encryption product that implements a DACP to communicate sensitive information over public network infrastructure – see for further information Use an Evaluation Assurance Level (EAL) 2 encryption product from DSD’s Evaluated Products List (EPL) that has completed a DCE – see for further information. Data centres used to store personal information must be located in Australia. Physical security Demonstrate an appropriate physical security environment for the protection of business assets and processes Documented Physical Security Policy as part of overall SRMP Compliance with the PSPF Physical Security Protocol at Physical security arrangements certified by Gatekeeper Authorised Physical Security Evaluator – see Personnel Security Compliance with PERSEC 1 in the PSPF (self assessment). Documented Personnel Security Management Plan including: verification of qualifications, police records check, referee checks, identity verification. Vetting of personnel and contractors in Positions of Trust in accordance with AS4811-2006: Employment Screening including appropriate personnel security aftercare arrangements PCI-DSS requirements for storage of payment card data Not allowed Not allowed Completion of the Attestation of Compliance with the Payment Card Industry Data Security Standard (PCI DSS).by a Qualified Security Assessor (QSA). Authentication Requirements National e-Authentication Framework (NeAF) Levels of Assurance – Identity/Attributes Minimal assurance Low assurance Moderate assurance High assurance 1 Level 2 Level 3 Level 4
Minimal confidence in the identity assertion / credential. Low confidence in the identity assertion / credential. Moderate confidence in the identity assertion / credential. High confidence in the identity assertion / credential. Important Achieving LoA 4 Assurance requires completion of the requirements for LOA1 – LoA 3. Note Given the sensitivity of the personal information collected and stored, Providers of authentication services at LOA 2 and above must satisfy the security and privacy requirements for mailbox/data vault Providers (above) to a minimum of LOA 3. REQUIREMENT LOA 1 LOA 2 LOA 3 LOA 4 Identity Proofing (Providers to demonstrate completion of NeAF assessment [reflected in Identity and Credential Policies] and implementation of provisions of ISO/IEC 29115) Ensure that each applicant‘s identity record is unique within the service‘s community of subjects and uniquely associable with tokens and/or credentials issued to that identity Accept a of identity Accept of evidence. Accept pseudonyms – self asserted, socially validated Perform all identity proofing strictly in accordance with its published Identity Proofing Policy Applicant provides name, DOB, address, email/phone (to be verified with issuing institutions as appropriate) Maintain appropriate Identity and Verification Records in accordance with the Archives Act Optional ID proofing: Known customer (see Gatekeeper EOI Policy and identity Known. Customers) 3rd party verification (authorised referee) Electronic verification where possible (DVS or other authorised data verification service provider – see below) of presented documents with the specified issuing authority to corroborate date of birth, current address of record, and other personal information. The Primary document must be a Government issued credential with a biometric GSEF processes may be considered on a risk basis Optional ID Proofing: Customer Only face-to-face identity proofing. GSEF processes apply Applicant presents: secondary Government Picture ID (not the same as the primary document) or credential issued by a regulated financial institution OR two items confirming name, and address or email address, such as: utility bill, professional license or membership, or other evidence of equivalent standing (see Gatekeeper EOI Policy) All presented credentials and information are where possible electronically verified with relevant issuing authority REQUIREMENT LOA 1 LOA 2 LOA 3 LOA 4 attestation 2007.
Credentials Account for the following system threats and apply appropriate controls: the introduction of malicious code; compromised authentication arising from insider action; out-of-band attacks by other users and system operators (e.g., the ubiquitous shoulder-surfing); spoofing of system elements/applications malfeasance on the part of subscribers and subjects. Single factor authentication solutions acceptable Published Credential Policy and Practices Statement approved by internal Policy Management Authority Strong passwords as per ISM Non-PKI authentication protocols required Cryptographic technology deployed through a Public Key Infrastructure – “soft” certificates Cryptographic technology deployed through a Public Key Infrastructure deployed on hardware tokens protected by password or biometric controls
Privacy Demonstrated compliance with all National Privacy Principles (NPPs), the Information Privacy Principles (IPP’s) as applicable and all Australian Privacy Principles (APP’s) should the 2012 Amendment Bill become law. Amendment of subscriber personal information requires either: (i) re-proving their identity, as in the initial registration process, or (ii) by using their credentials to authenticate their revision. Successful amendment of personal information should result in of the credential. Key Management Documented Key Management Plan (KMP) assessed by commercial IRAP assessor (see Gatekeeper PKI Framework for details of KMP requirements). Full Gatekeeper accreditation Gatekeeper High Assurance accreditation. Specifications for hardware tokens from EPL REQUIREMENT LOA 1 LOA 2 LOA 3 LOA 4
Consequence Severity Consequence rating Insignificant Moderate Major Severe Risk to any party’s personal safety No risk No risk No risk Any risk to personal safety Threaten life directly Release of personally or commercially sensitive data to third parties without consent No impact Would have little impact Measurable impact, breach of regulations or commitment to confidentiality Release of information have a significant impact Would have severe consequences to a person, agency or business Financial loss to any client of the service provider or third party No loss Minimal Minor Significant Substantial Financial loss to Agency / service provider No loss Minimal < 2% of monthly agency budget Minor 2% to < 5% of monthly agency budget Significant 5% to < 10% of monthly agency budget Substantial ≥ 10% of monthly agency budget Impact on government finances or economic and commercial interests No impact No impact Cause financial loss or loss of earning potential Work significantly against Substantial Damage Damage to any party’s standing or reputation No damage No damage Minor: damage Limited long-term damage Substantial long-term damage The second step involves mapping the likelihood of these occurring in order to determine overall risk levels and from there the required assurance level can be determined. NeAF Indicative assurance level requirements based upon likelihood and consequences Consequences Likelihood Insignificant Minor Moderate Major Severe Almost certain Nil Low Moderate High High Likely Nil Low Moderate High High Possible Nil Minimal Low Moderate High Unlikely Nil Minimal Low Moderate Moderate Rare Nil Minimal Low Moderate Moderate term
AL 2 Change of address of record by a beneficiary Moderate organizational criteria Moderate criteria – Attestation of Govt ID Single factor; prove control of token through authentication protocol AL 3 Access to an online brokerage account Stringent organizational criteria Stringent criteria – stronger and verification of records Multi-factor auth: cryptographic protocol; “soft”, “hard”, or “OTP” tokens AL 4 Dispensation of a controlled drug or $1M bank wire Stringent organizational criteria More stringent criteria – stronger attestation and verification Multi-factor auth w/ hard tokens only; crypto protocol w/ keys bound to auth process Source: Attachment 3 HMG Information Assurance Maturity Model CRITERIA L1 Initial L2 Established L3 Business Enabling L4 Quantitatively Managed L5 Optimised Leadership and Governance. R/A/G R/A/G R/A/G R/A/G R/A/G Training, Education and Awareness R/A/G R/A/G R/A/G R/A/G R/A/G Information Risk Management R/A/G R/A/G R/A/G R/A/G R/A/G Through-Life IA Measures R/A/G R/A/G R/A/G R/A/G R/A/G Assured Information Sharing R/A/G R/A/G R/A/G R/A/G R/A/G Compliance R/A/G R/A/G R/A/G R/A/G R/A/G