FOI 23/24-0804
OFFICIAL
3.1 Risk management framework
Security risks must be managed consistent with the agency’s Risk Management
Framework. Every site will develop a Site Security Plan which takes into
consideration the functions and location of the site.
The Risk Management Framework is a set of components that provide the
foundations and organisational arrangements for designing, implementing,
monitoring, reviewing and continually improving risk management processes
throughout the Agency.
Risk Branch and the Risk Committee oversee the agency’s risk management. The
CSO has a seat on the Risk Committee and will raise security risks as appropriate.
Protective and Cyber Security Branch, through this Procedure, is responsible for
whole of agency security risks. Site security specific risks (e.g. for participant contact
facilities) are addressed through Site Security Plans. Process or portfolio specific
security risks are addressed by the appropriate authority.
3.2 Security risk management
Security risk management will follow this methodology to analyse agency wide risks.
Security risk assessments
Security risk assessments are structured and comprehensive processes to identify,
analyse and evaluate security risks and determine practical steps to minimise the
risks.
The Agency Security Adviser (ASA), on behalf of the CSO, conducts 6-monthly
security risk assessments in the NDIA using the Risk Management Guide.
The ASA will identify and categorise whole of agency security risks to a; Low,
Medium, High or Critical risk rating.
Low risks will be addressed through business as usual activities.
Medium, High and Critical risks require additional risk treatments.
Security risk treatments
Security risk treatments are the considered, coordinated and efficient actions and
resources required to mitigate or lessen the likelihood or negative consequences of
risks.
The Risk Management Framework has established the Risk Action Plan for risk
treatments. Risks are put through the Risk Action Plan which has three categories of
information for each risk: Identify, Assess and Manage.
Medium, High and Critical risks will be analysed. Controls will be implemented and
accountability assigned to address the risks.
OFFICIAL
Page 2 of 7
FOI 23/24-0804
OFFICIAL
Risk Committee
The CSO will report on risks in the Risk Action Plan to the Risk Committee.
The Agency Security Adviser and Protective and Cyber Security Branch will develop
reporting tools, data and other resources to enable the CSO to report on Medium,
High and Critical risks to the Risk Committee.
4. Policy
This procedure is authorised by the current version of the Security Risk Management
Policy (‘the Policy’).
The Procedure should be read in conjunction with the Risk Management Framework
and Agency Security Plan.
OFFICIAL
Page 3 of 7
FOI 23/24-0804
OFFICIAL
4. Policy application
A security risk is something that could result in the compromise, loss, unavailability
or damage to information or assets, or cause harm to people or Agency/Scheme
reputation. Security risk is the effect of uncertainty on objectives and is often
measured in terms of its likelihood and consequences. The causes are generally
people, systems, processes, procedures, crime, attacks or natural events. An:
effect is a deviation from the expected and may be positive or negative
objective has different aspects such as financial, health and safety and
environmental goals, and can apply at multiple levels such as strategic,
organisation-wide, project, product and process levels.
4.1 Security goals and strategic objectives
The NDIA’s security goals are to:
1.
establish protective security management in the NDIA,
2.
implement controls to meet the requirements of the PSPF, and
3.
develop a positive risk culture.
4.2 Threats, risks and vulnerabilities
The primary security threats, risks and vulnerabilities faced by the Agency are:
Threats, including
o Aggression toward NDIA personnel and assets
o Hostile actors attempting to access information
Risks, including
o Compromise of information
o Physical harm to NDIA and partner personnel
o Loss or damage to assets and information
o Reputational damage to the NDIA and/or NDIS
Vulnerabilities, including
o Multiple sites of varying security levels
o Work conducted in and out of offices
o Shared ICT infrastructure with Services Australia
o Face-to-face contact with members of the public
o Service Providers and other third party delivery of the NDIS
4.3 Tolerance to security risks
The Agency’s risk tolerance is given in the Risk Appetite Statement, which is
approved by the Board.
The Board has set our appetite for risk as conservative. In practice, this means we
must closely monitor and regularly review how we are managing the risks we face.
The CSO has applied this interpretation and tolerance to security risks. Accordingly,
security risks will be monitored and reviewed so that our operations are properly
designed and conducted to ensure there is no undue risk to the Agency, its assets,
information or people.
OFFICIAL
Page 5 of 7
FOI 23/24-0804
OFFICIAL
4.4 Capability to manage security risks
The Security Risk Management Procedure describes how the Agency manages risks
across all areas of security (governance, information, personnel and physical) to
determine sources of threat and risk (and potential events) that could affect
government or entity business.
The Procedure includes:
security risk assessments, which are structured and comprehensive
processes to identify, analyse and evaluate security risks and determine
practical steps to minimise the risks, and
security risk treatments, which are the considered, coordinated and efficient
actions and resources required to mitigate or lessen the likelihood or negative
consequences of risks.
4.5 Strategies to implement security risk management
The success of security risk management depends on the effectiveness of security
planning and how well arrangements are supported by the entity's senior leadership
and integrated into business processes.
The NDIA will implement security risk management through a risk based approach to
all security policies.
Protective and Cyber Security Branch will foster a culture where risk management is
an important and valued aspect of decision-making, where risk management
processes are understood and applied appropriately; and where personnel can be
confident in managing and taking risks, within defined parameters, in order to
achieve objectives.
Business areas are responsible for a lot of the day-to-day security risk management.
Protective and Cyber Security will work with them to build their capability and provide
support as required.
4. Procedure
This policy is supported by the current version of the Security Risk Management
Procedure (‘the Procedure’) and the procedures referred to therein.
The Procedure should be read in conjunction with the Risk Management Framework
and Agency Security Plan.
5. Key principles
The following key principles underpin the NDIA’s approach to security risk
management:
The CSO is the owner for all security risks in the NDIA, and is accountable to
the CEO and Board.
Security risks will be managed consistent with the Risk Appetite Statement,
Risk Management Framework and relevant legislation.
Security risks may impact on all of the Agency’s strategic risks.
OFFICIAL
Page 6 of 7
FOI 23/24-0804
OFFICIAL
Security risks will be considered relative to the five consequences (Participant
outcomes, Scheme sustainability, Market, Our Agency Staff and Partners in
the Community, and Public confidence & trust) described in the Risk
Assessment Criteria.
Security risk management will be addressed using the Agency Risk
Management Cycle.
Protective and Cyber Security Branch is responsible for the delivery of a
secure Agency. The Branch will work closely with different business areas to
address security risks.
6. Mandatory Requirements
Protective and Cyber Security Branch will follow this Policy, and the associated
Procedure, at all times when delivering protective security for the Agency.
The approach to security risk management will be consistent with the Agency’s
broader approach to risk management.
Each business area is responsible for delivering day-to-day security risk
management in their operations and sites. Protective and Cyber Security Branch will
support the development of security conscious business practices.
7. Relevant legislation
This Policy is supported by Commonwealth legislation including:
Public Governance, Performance and Accountability Act 2013
National Disability Insurance Scheme Act 2013
National Disability Insurance Scheme – Risk Management Rules 2013
Other
Protective Security Policy Framework
Information Security Manual
OFFICIAL
Page 7 of 7
