The Problem
A high-profile Federal Government department required the development of the entire suite of security documentation artefacts in order to guide all staff in their security requirements and obligations and fulfil their Australian National Audit Office (ANAO) commitments. This included foundation and fundamental frameworks, policy, plans, procedures and security & awareness training. We were engaged to communicate, co-operate and collaborate with various staff throughout the entire department and provide a wide range of security advice and assistance in the development of the security documentation suite.
The Approach
We initially identified the key information assets that required protection, clearly defined the scope of work and created a project plan. This provided the client with a high level of assurance and visibility that effort was expended wisely and value for money was obtained.
We worked with the client to identify and prioritise assignments and ensured that our effort was focused and on the highest areas of risk.
The Outcome
The result involved creating frameworks, policy, plans and procedures used to identify, prioritise and mitigate enterprise-wide risks. Our deliverables were used to uplift the departments security posture, set the security culture, direction and address the mandatory requirements of the Protective Security Policy Framework, Information Security Manual and ANAO findings.
We provided ongoing security advice, assistance and managed the delivery of various security artifacts in accordance with the project plan. Our deliverables were on time, on budget and quality assured. We delivered the following:
- Agency Security Framework;
- Agency Security Management Plan;
- Protective Security Risk Review – Addendum;
- ICT Enterprise Security and Risk Management Plan;
- Information Security Awareness & Training Package (plan and presentation);
- Information Security Policy;
- Security Incident Detection and Response Plan;
- Vulnerability Management Plan;
- Data Handling and Classification – Standard Operating Procedure;
- Emergency Response – Standard Operating Procedure;
- Security Manager/Administrator/User/Officer – Standard Operating Procedure;
- Sanitisation, Destruction & Disposal of Information Assets – Standard Operating Procedure;
- Security Accreditation Framework;
- System Security Plan – Annex; and
- ICT Enterprise System Security Plan.
We presented our deliverables to the Chief Information Officer in the form of a bound booklet. We were originally contracted for a four month period but was subsequently extended twice due to the successful nature of the engagement.