The Problem
A Federal Government Department was seeking a security classification assessment of its information assets to determine if its ICT environment was secured in accordance with the Protective Security Policy Framework (PSPF) and Information Security Manual.
The requirement was to provide Senior Executives with a qualitative and quantitative security classification assessment of its information holdings which would, in turn, inform its security investment planning for the long term. We were engaged for this task.
The Approach
We commenced the engagement by interviewing Senior Executives within each branch to gain a holistic understanding of the information received, created, handled, stored and transmitted. We then identified and interviewed lower-level stakeholders to gain a more operationally focused perspective and determine:
- The type and nature of the information assets;
- All data repositories (ICT and paper based);
- The consequence of compromise (including, but not limited to, safety, financial, economic, reputation, legal, service disruption/downtime, crime prevention, remediation costs and/or trust);
- Areas of information aggregation (the potential to, knowingly or unknowingly, increase the consequence of compromise of combined or larger volumes of information); and
- Opportunities for information inference (the potential to deduce sensitive information from non-sensitive data).
The PSPF Guidelines assist agencies to identify the confidentiality, integrity and availability requirements of its information assets. We leveraged this guide to identify, categorise and assess the departments information assets then recommend the appropriate security classification marking.
The Outcome
The deliverable provided Senior Executives with an independent security classification assessment of the departments information holdings. This was the foundational basis from which security investment decisions would be made. The report included discussion, rationale, applied logic, examples and percentage breakdown of information classification categories within each branch.
The report captured a holistic (enterprise wide) and detailed (branch specific) view of the security classification status of the departments information holdings. We provided several options for how the ICT environment should be security provisioned covering stakeholder engagement, gap analysation, implementation phases, pros/cons, return on investment and timeframe considerations.