from a Senior Executive Service (SES) (or equivalent) or higher? may indicate a higher level of risk or delegation required. Document positions or delegations required for the approval. Continue to question 3 Continue to Questions 3 3 External interaction Does the business process, interaction or approval involve or require approval from an external provider or entity outside the Australian Government? Approval required by an external provider or an entity outside the Australian Government may indicate a higher of risk and require additional controls to be used. A higher risk rating applies. Document the details of approvals involving interactions outside the Australian Government. Continue to Question 4 ‘No’ indicates a lower level of risk. Continue to Question 4 4 External scrutiny Does the business process, interaction or approval involve, or is it likely to involve a high level of public or media scrutiny, relate to issues that are politically, commercially or personally sensitive, or likely to be the subject of litigation or an external audit? Approvals matching these criteria indicate a higher level of risk and require additional controls to be used. If the of external scrutiny is unknown, or is considered high enough to warrant additional controls, a ‘Yes’ response should be recorded. A higher risk rating applies. Document the details of likely external scrutiny, sensitivities, litigations or audits. Continue to Question 5 ‘No’ indicates a lower level of risk. Continue to Question 5 5 Security Does the business process, interaction or approval involve significant security related matters? Approvals or supporting business processes involving significant security issues, such as those relating to national security, indicate a higher level of risk and require additional controls to be used. If the extent of the security-related issues is unknown, or is considered high enough to warrant additional controls, a ‘Yes’ response should be recorded. A higher risk rating applies. Document all details of any significant security related risks. Continue to Phase 2: Approval requirements If you have answered ‘No’ to all 1 questions, continue to Q2 Phase 3: Approval implementation. Alternatively you may also choose to complete Phase 2 for additional assurance. If you have answered ‘Yes’ to one or more 1 questions, continue to Phase 2 - Approval requirements.
Module 1: Stakeholder identification and agreement This module helps identify stakeholders involved in the approval process and ensures that all parties agree to complete the approval digitally. Note: The questions represented in this module are consistent with the requirements of the Electronic Transactions Act 1999. However, you should also consider your agency’s specific operating circumstances and requirements before implementing a digital approval process. Refer to the for an overview of this module. Module 1 - Stakeholder identification and agreement Instructions Beginning with Module 1, address each question and follow the recommended action based on your response. Question Considerations Y/N For ‘Yes’ responses For ‘No’ responses 1 Existing procedures Are there existing procedures documenting the business process and approval requirements? Existing business procedures can help inform your responses throughout the assessment process. Refer to business procedures when completing the assessment. After determining an appropriate digital approval method, document any specific requirements in the applicable business procedures. Continue to Q2. Continue to Q2. 2 Delegations Are there specific approval delegations that apply to the business process? Consider any agency-specific or internal delegation requirements that may apply. Approval delegations include: legal delegations financial delegations, such as Accountable Authority Refer to and document the applicable approval delegation for any specific requirements to be incorporated into the digital approval. Continue to Q3.
Module 2: Security and access This module considers the level of security and access needed for the digital approval process based on the security classification of the information or data, its value and the risks associated with it. Note: Your agency’s own internal policies and procedures, consistent with the Australian Government’s Information Security Manual and Protective Security Policy Framework should also be used in conjunction with the following questions to determine appropriate controls for the approval process. to the Module 2: Security and access Question Considerations Y/N For ‘Yes’ responses For ’No’ responses 1 Role-based access control Does the requestor or approver need to be in a specific position to carry out an approval action? Consider the applicable access or approval authorities for the position responsible for undertaking the approval. Does it require a certain position in a workflow, as it has the financial delegation to approve. Identify and document position details and controls required to out approvals. Continue to Q2. Continue to Q2. 2 Privacy Does the approval involve classified, sensitive or personal information or data that requires protection? Consider any potential issues for inappropriate disclosure of security-classified or sensitive information. The Australian Privacy Principles outline how to handle, use and manage personal information. You must be able to ensure the approval process meets the requirements of the Australian Privacy Principles and any agency-specific requirements (including compliance with Australian Government policy). Continue to Q3.
Document the details of information or data that requires extra protection. Continue to Q3 3 Security classification Does the approval process involve information or data subject to security classification or dissemination limiting markers (DLM)? Ensure the use of security classifications and DLMs meet the requirements of the Protective Security Policy Framework (PSPF) and Information Security Manual . The Australian Government security classifications are: Unofficial Official Official: Sensitive Protected Secret Top Secret. From 1 October 2018 classifications changed to listed above however, entities have an extended period to implement the new classifications until October 2020. See the PSPF website for more information. Refer to your agency’s security policy and procedures for specific guidance, or speak with your ICT security advisor. Document details of information or data subject security classification or DLMs. Continue to Module 3: Business requirements. Continue to Module 3: Business requirements.
information or data for as long as required. may include establishing a process where the approval and associated information or data is either manually or automatically captured in a compliant information management system. Continue to Q2. Question Considerations Y/N For ‘Yes’ responses For ‘No’ responses 2 Encryption Will the approval and associated information or data be encrypted? Encryption should only be used on a limited where required, for example with sensitive or high-risk processes, or as required by legislation. Encryption will typically take at a system level. You should speak with your ICT security advisor or system administrator if you are unsure if the approval and supporting information or data is or will be encrypted in the system. If encryption is used, you must be able to maintain access to the information or data for as long as needed, including being able to decrypt at a later point. Metadata can verify the encryption and decryption process. Ensure the policy and procedures for decryption are documented and accessible. Ensure encrypted information or data is accessible to those who require it by implementing appropriate procedures and controls for data recovery in line with the Information Security Manual information on cryptography. Continue to Q3. Continue to Q3.
3 Multiple sources of information If the approval process involves multiple sources of information or data, can the approval request, final approval and the information or data subject to approval, be clearly linked? For accountability purposes, information from multiple sources, systems or locations supporting the approval should be linked or able to be related together. Ensure all information supporting the approval can be linked throughout the approval process and document any relevant file references. Continue to Q4. You may need to manually link or relate information or data supporting the approval, for example by documenting all related file references with the approval request. Continue to Q4. Question Considerations Y/N For ‘Yes’ responses For ‘No’ responses 4 Access to authoritative information Will all relevant stakeholders have access to the authoritative version of the information or data subject to approval? The authoritative version of the information subject to the approval must be available and readily identifiable to support accountable and effective decision making. Document the details of the authoritative version and any relevant file references. Continue to Q5. Confirm and document how access to the authoritative version of the information can be made available to applicable stakeholders. Continue to Q5. 5 Event logging and auditing Can the system or location where the approval is being made track actions and events on the approval and associated information or data? All actions and changes to an approval and associated information should be recorded by the system’s audit logs and be available to support accountability and authenticity. Document what functionality the system or location has to track actions and events related to the approval and associated information or data. Continue to Q6. Identify the of event logging and auditing functionality required. For a lower risk process managed outside of a system with information management functionality, consider available mitigations. Continue to Q6.
6 Disposal requirements Can you apply current disposal practices to the approval and associated information or data when required? Disposal functionality should be applied based on business requirements, system functionality and the applicable records authority issued by the National Archives. See the National Archives’ advice on compliant destruction of Australian Government records for further information. disposal action/s in accordance with business and agency requirements, and the applicable records authority issued by the National Archives. Document disposal practices and the relevant disposal authority. Continue to Phase 3: Approval implementation. Define an appropriate method for applying disposal practices to the approval and associated information between the business and information management areas. Continue to Phase 3: Approval implementation. Phase 3 - Approval method selection Phase 3 will help you determine and implement the most appropriate digital approval method. Refer to the for an overview of this module. Phase 3 - Approval method selection Instructions Approval method selection Address the question/s to confirm the most appropriate digital approval method. Question Considerations Y/N For ‘Yes’ responses For ‘No’ responses 1 Approval functionality If you completed Phase 2, did you provide a ‘yes’ response to any of questions 1 to 4 in Phase 2, Module 3: Business requirements? The applicable questions in Phase 2, Module 3: Business requirements addressed: approval revocation multiple approvers reporting functionality notification functionality Action tracking is recommended if additional workflow functionality is not required. See Approval method overview below for further information. Continue to Q2.