The Problem
Our client is one of Australia’s largest employment service providers who provides employment services under the Federal Government’s Workforce Australia (WA) program. The program is the government’s way to get more Australians into work by connecting job seekers with employers and is delivered by a network of WA providers in locations across Australia.
As part of the program our client receives, manages and transmits job seeker related information that is sensitive and personnel in nature. We were engagement to undertake an Australian Signals Directorate Independent Registered Assessor Program (IRAP) Assessment* to determine if the ICT environment was designed, built and managed in accordance with Australian Government standards and industry best practice.
The Approach
We clearly defined the scope, reviewed the system architecture, security artefacts all applicable Information Security Manual (ISM) controls to determine if it was based on sound security principles. Some of this incorporated:
- Determining the implementation, appropriateness and effectiveness of ISM security controls specified in the System Security Plan Annex. Scope and any necessary clarifications and justifications regarding applicability were addressed;
- Reviewing the system architecture and determine whether appropriate policies, plans and procedures have been developed to protect WA information processed, stored or communicated;
- Reviewing the aforementioned security artefacts to ensure they are complete, comprehensive and appropriate for the environment and context within which the WA system operates; and
- Reviewing the Security Risk Management Plan with particular focus on the risk register, controls and risk treatment plan.
We then assessed the operation and effectiveness of the implemented controls. Onsite inspections were undertaken to gain evidence in support of the statements made in the documentation. Evidence was also gathered through discussions with key personnel, demonstrations of functionality, observation and demonstration of specific configurations, general observations of work practices and the security environment. Throughout the assessment process, the implementation status of ISM controls are identified and contribute to the formulation of recommendations.
The Outcome
We sampled over a dozen offices in every state and territory, worked closely with the Chief Information Officer and assessed all security pillars across the entire enterprise – governance, physical, personnel and cyber security. This was as complex engagement that required careful planning, attention to detail and numerous interviews.
We delivered a sensible, pragmatic and business-oriented security assessment that was digestible to non-technical senior Executives and provided a sound baseline for future improvements. The success of this engagement resulted in us being invited back over several years for subsequent reassessment activities.
* www.cyber.gov.au/irap