Our reference: FOI 23/24-0804
GPO Box 700
Canberra ACT 2601
1800 800 110
31 May 2024
ndis.gov.au
Shirley
By email: xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear Shirley
Freedom of Information request — Notification of Decision
Thank you for your correspondence of 19 January 2024, in which you requested access to
documents held by the National Disability Insurance Agency (NDIA), under the
Freedom of
Information Act 1982 (FOI Act).
The purpose of this letter is to provide you with a decision on your request.
Scope of your request
You have requested access to the following documents:
“''Please provide a copy of the NDIA Information Security Risk Management Policy and
Procedure. This includes the supporting Information Security Risk Management Plan.
That is, for clarity, the documents which scoped the NDIA’s information security risk
management (ISRM) requirements and the subsequent policies and procedures that
deliver, manage and ensure these actions and compliance are conducted.''
On 15 May 2024, we sought a scope revision from you and on 16 May 2024 you requested
further clarification of the proposed revision of scope. On 22 May 2024, we came back to
you with further details regarding what documents would be considered for the revised
scope. On 23 May 2024 you agreed to revise your scope to be for the following documents:
“• Security Risk Management Procedure
• Security Risk Management Policy”
Processing period The original due date for our access decision on your FOI request was 18 February 2024. I
sincerely apologise for the delay in releasing this decision to you. We have been
experiencing processing delays and were not able to provide you with our decision by the
due date. Consequently, your application was regarded as a deemed refusal under section
15AC of the FOI Act.
Decision on access to documents
I am authorised to make decisions under section 23(1) of the FOI Act. My decision on your
request and the reasons for my decision are set out below.
I have identified 2 documents that fall within the scope of your request. I have decided to
grant access to these 2 documents in full.
1
The documents were identified by conducting searches of NDIA’s systems, using all
reasonable search terms that could return documents relevant to your request, and
consulting with relevant NDIA staff who could be expected to be able to identify documents
within the scope of the request.
In reaching my decision, I took the following into account:
• your correspondence outlining the scope of your request
• the nature and content of the documents falling within the scope of your request
• the FOI Act
• the FOI Guidelines published under section 93A of the FOI Act
• consultation with relevant NDIA staff
• the NDIA’s operating environment and functions.
Release of documents
The documents for release, as referred to in the Schedule of Documents at
Attachment A,
are enclosed.
Rights of review
Your rights to seek a review of my decision, or lodge a complaint, are set out at
Attachment B.
Should you have any enquiries concerning this matter, please do not hesitate to contact me
by email at
xxx@xxxx.xxx.xx.
Yours sincerely
Karla Senior Freedom of Information Officer
Complaints Management & FOI Branch
General Counsel Division
2
Attachment A
Schedule of Documents for FOI 23/24-0804
Document
Page number
Description
Access Decision
number
Security Risk Management Procedure
FULL ACCESS
1
1-3
Date: 18 May 2021
Security Risk Management Policy
FULL ACCESS
2
4-7
Date: 18 May 2021
3
Attachment B
Your review rights
Review by the Office of the Australian Information Commissioner
The FOI Act also gives you the right to apply to the Office of the Australian Information
Commissioner (OAIC) to seek a review of this decision.
If you wish to have the decision reviewed by the OAIC, you may apply for the review, in
writing, or by using the online merits review form available on the OAIC’s website at
www.oaic.gov.au, within 60 days of receipt of this letter.
Applications for review can be lodged with the OAIC in the following ways:
Online:
www.oaic.gov.au
Post:
GPO Box 5218, Sydney NSW 2001
Email:
xxxxxxxxx@xxxx.xxx.xx
Phone:
1300 363 992 (local call charge)
Complaints to the Office of the Australian Information Commissioner or the
Commonwealth Ombudsman
You may complain to either the Commonwealth Ombudsman or the OAIC about actions
taken by the NDIA in relation to your request. The Ombudsman will consult with the OAIC
before investigating a complaint about the handling of an FOI request.
Your complaint to the OAIC can be directed to the contact details identified above. Your
complaint to the Ombudsman can be directed to:
Phone:
1300 362 072 (local call charge)
Email:
xxxxxxxxx@xxxxxxxxx.xxx.xx
Your complaint should be in writing and should set out the grounds on which it is considered
that the actions taken in relation to the request should be investigated.
4
