GOVERNANCE, RISK AND COMPLIANCE

In response to the increasing prevalence of cyberattacks, the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) recently developed a set of strategies to help organisations mitigate common attack vectors. These strategies are known as the Essential Eight. The Essential Eight is divided into three main objectives, which are then further divided into eight strategies. If your organization finds itself in the category of maturity level one or two, then ITSEC can certainly help you mature your cybersecurity to the point where you can achieve a level three maturity in your cybersecurity posture.

The Australian Government Information Security Manual (ISM) is a comprehensive guide that provides cybersecurity guidance for Australian government agencies. It is published by the Australian Cyber Security Centre (ACSC) and serves as a framework to protect government information and systems from cyber threats.

The ISM outlines a range of security controls and practices that government agencies should implement to ensure the confidentiality, integrity, and availability of sensitive information. It covers various areas such as risk management, personnel security, physical security, network security, and incident response.

The Information Security Registered Assessors Program (IRAP) is an initiative by the Australian Signals Directorate (ASD) to provide independent security assessment services. The program aims to help government agencies and organisations assess and certify the security of their information and communication technology (ICT) systems against the requirements specified in the ISM.

By participating in the IRAP program and obtaining certification, organisations demonstrate their commitment to implementing robust cybersecurity practices and protecting sensitive information. It helps build trust among government agencies and other stakeholders, as well as enhances the overall cybersecurity posture of the organization.

Both the ISM and the IRAP program play crucial roles in strengthening cybersecurity within the Australian government and supporting the protection of sensitive information and critical infrastructure from cyber threats.

ISO 27001 is a popular & well-accepted security standard & certification to implement & showcase an organization’s security posture. The objective of the standard is to “provide requirements for establishing, implementing, maintaining and continuously improving an Information Security Management System (ISMS)”. The independent certification to the standard is recognised around the world as an indication that your organisation is aligned with information security best practices.

APRA CPS 234 is a prudential standard established by the Australian Prudential Regulation Authority (APRA) that focuses on information security for regulated entities in the financial services industry. It sets out requirements for organizations to protect their information assets from cyber threats, including establishing a robust information security framework, implementing appropriate controls, and ensuring effective incident management and response. CPS 234 aims to enhance the resilience and security of critical information assets and promote the stability of the financial system by mitigating the risks associated with cyber-attacks and data breaches.

NIST Cybersecurity Framework is a voluntary framework that consists of customisable standards, guidelines, and best practices to manage cybersecurity-related risk. The main purpose of NIST CSF is “Improving Critical Infrastructure Cybersecurity,” The Cybersecurity Framework’s prioritised, flexible and cost-effective approach helps promote the protection and resilience of critical infrastructure.