DPC/G4.39Government guideline on cyber security

ISMF Guideline 39Regular, periodic and independent reviewsBACKGROUND

SA Government business undertakings are reliant on Information and Communications Technology (ICT). Periodic and regular ongoing reviews are an essential facet of providing business assurance and confirming adherence to relevant obligations and requirements. This guideline supports implementation of ISMF Policy Statement 39.

Reviews include but are not limited to the following aspects:

External legislative, statutory or regulatory requirements pertaining to information security that are mandated by law and therefore must be complied with by agencies and third parties (such as suppliers) to avoid facing serious consequences1

Industry standards and practices that are established by standards or industry bodies, such as the International Organization for Standardization (ISO), and selected for adoption. The ISO 31000 risk management and ISO 27000 information technology security management standards are relevant examples in the cyber security context

Internal policies, standards, procedures and contractual obligations for security of ICT, such as specific security controls mandated by or within the organisation.

Cyber security compliance describes the goal that agencies aspire to achieve in their efforts to ensure that own and third-party personnel are aware of and take steps to comply with relevant cyber security obligations and requirements.

It also sets the expectation that the policies and practices for maintaining compliance are clearly defined, implemented and enforced. This is fundamental to effective and accountable corporate governance of ICT. Compliance reviews assure that the relevant security obligations and requirements are being met. Periodic reviews are concerned with examining to what degree the organisation is able to demonstrate conformance, e.g. through self or third party assessments. Such reviews also constitute a foundation of achieving continual improvement and optimisation of resources in an organisation.

1 Agencies contemplating outsourcing arrangements in any form should also consult ISMF Guideline 38 to familiarise themselves with the legislative and regulatory requirements relevant to conducting South Australian Government business with ICT.

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 2 of 13

ISMF Guideline 39

GUIDANCE

Agencies are responsible for developing and implementing procedures to ensure security compliance in accordance with the requirements of the:

Protective Security Management Framework (PSMF)

Information Security Management Framework (ISMF)

This guideline assists Business Owners and Responsible Parties (as defined in the ISMF) in developing their practices and procedures for undertaking regular reviews of their information security posture to ensure ongoing compliance to applicable security obligations and requirements.

PRE-REQUISITE DOCUMENTS

The ISMF should be read in conjunction with this guideline. Implementing the guidance in this document may assist in meeting various requirements contained in the following ISMF Policy Statements:

ISMF Policy Statement 39 (Security policies, standards and technical reviews)

ISMF Policy Statement 16 (External (third party) service delivery management)

ISMF Policy Statement 38 (Compliance with legal requirements).

ISMF Policy Statement 3 (Information security policy)

ISMF Policy Statement 15 (Operational procedures and responsibilities)

SECURITY POLICY COMPLIANCE AND REVIEWS

An ongoing program of regular activities should be undertaken to assess the suitability and effectiveness of the Agency’s information security policy posture. It provides the basis for:

ensuring the efficacy of its overall information security position

verifying conformance to legal, regulatory and policy requirements that affect information security

ensuring that agencies are able to respond to the latest threat environment (e.g. newly emerged security threats and changed business requirements)

identifying any agency non-compliance and addressing it through mitigation and education actions

ensuring proper information security maintenance

improving the effectiveness of the ISMS.

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 3 of 13

ISMF Guideline 39

This section provides guidance on important aspects of information security reviews.

Table 1 Security policy compliance and review guidance

Applicability Guidance References

All Policy review

Business Owners should demonstrate ongoing support for information security by commitment to reviewing the agency’s ISMS policy and/or Information Security Policy2 on a periodic basis to ensure it continues to support delivery of the organisation’s objectives.

ISMF Standard 3

Compliance review

Business Owners should instigate a review of compliance with legal and regulatory requirements that affect information security at least annually, or sooner when new or updated legislation or regulatory requirements come into effect.

ISMF Standard 127

Non-compliance

Non-compliance in findings should be addressed by the Responsible Party through:

Identifying the underlying issue

Assessing required actions to prevent recurrence of non-compliance

Establishing and implementing suitable actions for issue rectification

Reviewing the action effectiveness

Documenting and maintaining the review findings and actions, e.g. as input into independent reviews or audits

ISMF Standard 128

Compliance documentation

Compliance checks and reviews may require specialised software3 to carry out and document these checks. These tools require adequate protection to safeguard the integrity and access of their data.

ISMF Standard 134

Procedure and Guideline reviews

Responsible Parties should initiate at least annual reviews of all security procedures and guidance to establish that they are formulated and carried out in accordance with the relevant security policies and standards.

ISMF Standard 47

Exemption review

Responsible Parties should undertake at least annual reviews of all dispensations from security compliance requirements.

ISM, Reviewing non-compliance

Review schedule and process ISM, section 2 Depending on the agency context, the information policies may be specified in a single document, a top-level information security policy with a supporting operational policy, or a top-level policy with multiple operational policies covering different control areas3 Examples of security, risk and compliance management software tools include the Lumension Compliance and IT Risk Management , QSEC or the CURA Information Security Risk Management tool suites.

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 4 of 13

ISMF Guideline 39

Applicability Guidance References

Reviews may be event or change driven. Unless changes in risks and the agency’s operating environment, business or system dictate earlier reviews, security reviews should be undertaken at least annually, and according to a defined review process.

All security reviews may be captured in a regular review schedule.

Documentation maintenance

Review expertise

Responsible Parties should identify needs for internal and external specialist information security advice in conducting and coordinating information security reviews. Having information security reviews conducted by parties that are independent of the review target should be considered.

The SA Government’s Cyber Security Services Portal4 may be used to engage independent review services.

ISMF Standard 11

[SP] Sensitive: Personal

Responsible Parties should consider seeking further advice and guidance from the Privacy Committee of South Australia if non-compliance findings indicate a possible or actual breach of personal information.

ISMF Standard 9

4 Refer to section Additional information for further details on the Cyber Security Services Portal.

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 5 of 13

ISMF Guideline 39

SECURITY IMPLEMENTATION COMPLIANCE AND REVIEWS

Having a set of organisational security policies, standards and procedures is often considered the same as implementing them which may not be the case. New services, customer expectations and operating conditions will be a constant source of change which may lead to ineffectiveness of existing security controls.

Compliance evaluations address the process of checking that controls and practices are actually implemented and working as expected. This section provides guidance for security-relevant processes for reviewing the agency’s compliance with its own internal policies as well as those imposed externally.

Table 2 – Security implementation and compliance review guidance

Applicability Guidance References

All Implementation assurance

Business Owners should support Responsible Parties in undertaking assurance activities to the extent to which security procedures are carried out correctly, and security standards are implemented. This may be achieved through random checks or regular reviews that provide proof of the level to which the standards and policies are known, enforced and effective.

These activities may include:

risk-based annual reviews of how information assets comply with relevant Agency and whole-of-government security implementation standards and controls

formal review processes for the adherence to technical security implementation standards and controls prior to releasing new or changed information systems into the operating environment

ISMF Standards 16, 39, 47, 133, 134

Expertise

Organisation and co-ordination of technical compliance reviews should be performed by experienced and trusted system engineers and demonstrably qualified personnel, such as Agency Security Advisers and IT Security Advisers.

ISMF Standard 134

Non-compliance

The Responsible Party may be required to report certain non-compliance findings, especially if the non-compliance results in a Notifiable Incident5.

ISMF Standard 140 - Notifiable Incidents

ISMF Standard 9

ISMF Guideline 12a

5 refer to ISMF Standard 140 – Notifiable Incidents for SA Government requirements to investigate and report cyber security incidents

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 6 of 13

ISMF Guideline 39

Applicability Guidance References

Review priorities

A risk-based approach should be applied to the formal process of security implementation review activities. It should take into account such factors as the classification of the information asset being protected, and security standards and controls which address critical security issues or well-known implementation weaknesses.

Common issues include:

Access control - the effectiveness of the access control policy to meet business and security requirements for access to information assets. It may include assessing physical and user access rights, especially related to events at which significant changes in user privileges or work situations occurred

Confidentiality - the level to which confidentiality requirements or non-disclosure agreements reflect the organization’s needs for the protection of information

Usage monitoring - procedures for monitoring the use of information processing facilities

Patching - verification that the appropriate patches are applied to operating system, device and application software

System changes - when operating systems are changed, agencies should review relevant business critical applications to ensure there is no adverse impact on agency operations or security.

ISMF Standards 23, 36, 54, 76, 80, 117

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 7 of 13

ISMF Guideline 39

THIRD PARTY AND OUTSOURCED SERVICE DELIVERY

Embracing third party service delivery offerings reduces direct control of an organisation’s security controls and architecture. This requires defining, implementing and maintaining appropriate measures to ensure that defined information security and service delivery agreements are upheld.

Table 3 - Third party and outsourced service delivery guidance

Applicability Guidance References

All Service delivery risk management

Business Owners should identify and manage specific risks associated with outsourcing arrangements for processing facilities and/or service delivery agreements. Typical risk considerations should include:

Third party compliance - Upholding of relevant compliance obligations for information processing and storage that may be provided by third parties

Legal jurisdiction - The legal context with regard to statutory and legislative powers that the third party, their facilities and the data may be subject to, such as international operations and off-shore data being subject to multiple legal jurisdictions

ISMF Standard 51

Outsourcing

Agencies contemplating outsourcing arrangements in any form should consult ISMF Guideline 6 (Cyber security in procurement activities) to familiarise themselves with fundamental cyber security considerations in procurement activities.

ISMF Standard 16

Service delivery expectations

Business Owners should formally agree and document third party service expectations and commitments with regards to meeting relevant cyber security requirements, obligations and service delivery levels, e.g. via Service Contracts based on Service Level Agreements [SLAs] and Operational Level Agreements (OLAs).

The extent of agreements should include service delivery expectations for maintaining service security and continuity during any necessary service transitions or interruptions.

ISMF Standards 51 and 139

Service delivery compliance monitoring and review

Responsible Parties should supervise and monitor outsourced service delivery, and demonstrate how agreed service delivery expectations are being met.

Monitoring and review activities should include:

Compliance monitoring and assessment - Establishing a formal program of compliance assurance, including periodic assessments of the supplier’s conformance at key service delivery checkpoints or milestones

ISMF Standard 51

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 8 of 13

ISMF Guideline 39

Applicability Guidance References

Performance reviews – Undertaking periodic supplier performance reviews according to the criteria and tolerances defined within the relevant Service Contract. Independent reviews, advice and/or certification may also provide an increased level of assurance.

Service change and improvement management

Responsible Parties should establish defined management processes for undertaking any changes to security-related service delivery aspects, such as agreed cyber security policies, procedures and controls. They should be able to ensure that changes affecting information security are not undertaken without due consideration, appropriate authorisation and in line with the criticality of service-related business processes and systems.

Responsible Parties should demonstrate a commitment to continual improvement by integrating the lessons from third-party service delivery feedback, monitoring and review activities, including:

Non-compliance findings – to highlighting weak areas that should be addressed

Exemption reviews – to derive insights from the exemptions process about any necessary changes to cyber security controls and practices that may improve the service delivery security posture.

ISMF Standard 51

DEVELOPMENT OF AN ASSURANCE PLAN

Assurance undertakings benefit from a well-planned approach which is appropriate for serving the assurance objectives within the resource constraints. Assurance planning provides the foundation for identifying necessary information required for regular assurance activities. It is used to determine appropriate activities, work assignment scheduling and coordination, and specification of suitable work documents.

Risk-based IT assurance planning is a best practice approach, which is supported by a number of assurance frameworks and methodologies. The following section summarises two recognised assurance frameworks which include guidance for assurance planning activities.

Control Objectives for Information and Related Technology (COBIT)

COBIT, and many of its supporting products, provides supporting guidance for IT assurance activities. It outlines a number of fundamental principles for understanding assurance and related techniques and contributory activities, and includes guidance on steps that comprise typical IT assurance engagements, including the approach to assurance planning.

Assurance planning covers the establishment of the range of activities that comprise the area of IT assurance responsibility. It is typically based on a high-level structure that classifies and relates concerned entities, including the IT processes and activities, functions, structures and resources

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 9 of 13

ISMF Guideline 39

as well as risks and controls which collectively contribute to the achievement of cyber security objectives. The objective of assurance planning is to create a viable and comprehensive cyber security assurance plan (usually annual) that combines the audit, compliance and vulnerability assurance concerns with an appropriate IT control framework.

COBIT also highlights the importance to obtain executive level approval for the plan and communication throughout the organisation in order to clearly set out the objectives, authority, and responsibilities for conducting any assurance assignments.

Further information is available in the ISACA publications COBIT 5 for Assurance and the IT Assurance Guide: Using COBIT.

Sherwood Applied Business Security Architecture (SABSA)SABSA is a framework and methodology that includes developing risk-driven enterprise information assurance architectures. It’s Assurance Framework and related components offer:

principles and practice of assurance management

an approach to planning the implementation and management of assurance programmes based on best-practice methods, standards and tools

a practical risk-based approach to assuring business processes and systems through monitoring, measuring, benchmarking, testing and continuous improvement

The assurance planning guidance provided through the SABSA framework extends to the planning and development of information assurance and information risk management strategies and programs, which apply risk management techniques and methods. It also covers the implementation and management aspects of risk-based information security reviews and assurance audits. Further information on this approach is available via the SABSA web site.

Outline of an assurance planThe following outline captures suggested components of an assurance plan that can guide assurance undertakings in a well-planned approach for serving the assurance objectives and scope within the given assurance environment and constraints:6

Context - Engagement nature, engagement-specific issues and assurance principles that underpin the assurance undertaking

Subject - High level objectives, scope (including any concerned organizational or functional units and processes) and assurance criteria used as a reference.

Approach – The extent of assurance methods and procedures used to complete the engagement, such as the risk-based approach used or the extent to which sampling is needed to obtain sufficient evidence and the design of the sampling plan, if applicable. It may also include compliance considerations with applicable laws, professional auditing standards and any other reference documents, and any specific measures to be taken to address the effect of uncertainty on achieving the assurance objectives.

Assurance Activity Roadmap – the assurance activities to be undertaken, including their locations, dates, expected time and duration as well as resource requirements for the assurance engagement such as the assurance roles and responsibilities, including guides and observers.

Reporting – documentation, reporting and other assurance deliverable requirements

6 It is consistent with the provisions of ISO 19011:2011 Guidelines for auditing management systems

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 10 of 13

ISMF Guideline 39

ADDITIONAL INFORMATION

Cyber Security Self-assessmentCyber security self-assessment is a tool available to evaluate the current status and efficacy of an organisation’s cyber security resources, including policies, staff, processes, practices and controls. It can be a precursor to more formal assessments, e.g. audits, which can identify strengths, gaps and/or risks to help improve the information security posture.

Questionnaire-based self-assessment may be adopted as a suitable good practice approach. The National Institute of Standards and Technology’s Security Self-Assessment Guide for Information Technology Systems7 or the Canadian Government’s Cyber Security Self-Assessment Guidance8 provide reference guidance for using a questionnaire-based self-assessment approach which could be tailored to address the requirements of the South Australian information security context.

BenchmarkingEvaluation by comparison against the standards of peer organisations is another opportunity for assessing an organisation’s security posture. It facilitates integration of applied learnings and findings from like organisations, such as cluster agencies within the South Australian Government, or comparable agencies in other Australian jurisdictions. Since peer organisations are likely to face common cyber security issues, they can quickly identify each other’s strengths and weaknesses. This may assist in reducing any security exposures through improvement suggestions that are highly relevant to the peer organisation.

Internal AuditIn addition to self-assessment, internal audit provides independent and objective assurance that assists in improving an organisation’s security posture. It provides a systematic, disciplined and impartial approach to evaluating and improving the effectiveness of cyber security management, control, and governance processes by delivering unbiased and evidence-based analysis insights and recommendations.

Independent review via the Cyber Security Services Portal The Cyber Security Services Portal is an open portal of qualified and suitably screened private sector organisations that can provide external cyber security services to SA Government, including independent assessment and review. It is operates as a dedicated portal under the broader eProjects panel of the Government of South Australia.

The portal provides a mechanism for agencies to efficiently procure cyber security services from a panel of industry providers and practitioners. Portal suppliers have been pre-qualified to determine that they are capable and adequately qualified to assist agencies in meeting their responsibilities and obligations for ICT/cyber security as described in both the PSMF and ISMF. A secondary objective of the portal is to assist agencies in the implementation of an Information Security Management System [ISMS] and to ensure that the capability and maturity of our suppliers is in alignment (‘lock step’) with the capability and maturity expectations placed on agencies in all matters pertaining to cyber security.

7 Security Self-Assessment Guide for Information Technology Systems, National Institute of Standards and Technology (NIST) or the Cyber Security Self-Assessment Guidance8 Cyber Security Self-Assessment Guidance, Government of Canada

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 11 of 13

ISMF Guideline 39

Further good practice guidanceAdditional good practice guidance and further resources are available from cyber security industry, standards or other authoritative bodies, such as the:

Information Systems Audit and Control Association (ISACA)

Corporate Executive Board’s Information Risk Executive Council (IREC)

Australian Computer Emergency Response Team (AusCERT)

International Information Systems Security Certification Consortium (ISC²)

Australian Computer Society (ACS)

This guideline is good practice applied to the protective security policy position and operating characteristics of the Government of South Australia at the time of writing. The individual requirements and operational characteristics of agencies will have direct bearing on what procedures and protocols are implemented and used for SA Government business.

Government guideline on cyber securityRegular, periodic and independent reviews v1.2

Page 12 of 13

ISMF Guideline 39

REFERENCES, LINKS & ADDITIONAL INFORMATION

1. DPC/F4.1 Government of South Australia Information Security Management Framework [ISMF]

2. PC030 Government of South Australia Protective Security Management Framework [PSMF]

3. Australian Government Protective Security Policy Framework [PSPF]

4. Australian Government Information Security Manual

5. ISO/IEC 38500:2008, Corporate governance of information technology, International Organization for Standardization / International Electro-technical Commission

6. AS 8000-2003 Corporate governance - Good governance principles, Standards Australia International

7. AS 3806-2006 Compliance Programs, Standards Australia International

8. ISO 19011:2011 Guidelines for auditing management systems, International Organization for Standardization/ International Electro-technical Commission

9. Security Self-Assessment Guide for Information Technology Systems , (NIST)

10. Cyber Security Self-Assessment Guidance , Government of Canada

11. IT Assurance Guide: Using COBIT , IT Governance Institute

12. COBIT 5 for Assurance , ISACA

13. Enterprise Security Architecture - SABSA White Paper , SABSA institute

14. ITAF™: A Professional Practices Framework for IS Audit/ Assurance, 2nd Edition , ISACA

Document Control

ID DPC/G4.39Version 1.2Classification/DLM PUBLIC-I1-A1Compliance DiscretionaryOriginal authorisation date March 2014Last approval date September 2017Review date September 2018

Licence

With the exception of the Government of South Australia brand, logos and any images, this work is licensed under a Creative Commons Attribution (CC BY) 4.0 Licence . To attribute this material, cite the Department of the Premier and Cabinet, Government of South Australia, 2017.

ISMF Guideline 39