The Problem
The National Medical Stockpile (NMS) is a strategic reserve of pharmaceuticals, vaccines, antidotes and personal protective equipment for use during a national response to a public health emergency.
As a system of national security significance, our client required industry leading expertise to security assess Australia’s NMS. We were engaged for this task.
Our client required the design, build and operation of the NMS system to be subject to an Australian Signals Directorate Independent Registered Assessor Program (IRAP) Assessment* against Australian Government standards and industry best practice.
The Approach
We clearly defined the scope, reviewed the system architecture, security artefacts and all applicable Information Security Manual (ISM) controls to determine if it was based on sound security principles. Some of this incorporated:
- Determining the implementation, appropriateness and effectiveness of ISM security controls specified in the System Security Plan Annex. Scope and any necessary clarifications and justifications regarding applicability were addressed;
- Reviewing the system architecture and determine whether appropriate policies, plans and procedures have been developed to protect NMS information processed, stored or communicated;
- Reviewing the aforementioned security artefacts to ensure they are complete, comprehensive and appropriate for the environment and context within which the NMS operates; and
- Reviewing the Security Risk Management Plan with particular focus on the risk register, controls and risk treatment plan.
We then assessed the operation and effectiveness of the implemented controls. Onsite inspections were undertaken to gain evidence in support of the statements made in the documentation. Evidence was also gathered through discussions with key personnel, demonstrations of functionality, observation and demonstration of specific configurations, general observations of work practices and the security environment. Throughout the assessment process, the implementation status of ISM controls are identified and contribute to the formulation of recommendations.
The Outcome
We provided an IRAP Assessment with recommendations to improve the governance, physical, personnel and ICT security of Australia’s NMS. Our report was detailed, provided structured implementation phases and was well received. We considered the NMS from and end-to-end perspective, and balanced the requirements to comply with Australian Government standards with the intrinsic and complex risks of operating the NMS.
With our mentoring and guidance, the client enhanced its internal security capability and was better placed to securely manage and operate Australia’s NMS through all phases of the systems lifecycle.
* www.cyber.gov.au/irap