The Problem
The Whole of Australian Government (WoAG) Travel Arrangements (the Arrangements) are coordinated procurements designed to streamline processes when booking and paying for official travel, aggregate purchasing power, promote simplicity, efficiency and reduce travel-related costs across the WoAG.
As a WoAG initiative, protecting the third-party provided ICT systems used to deliver the Arrangements is critical. Our client required security expertise to engage directly with the provider to develop the suite of security artefacts in preparation for a subsequent Australian Signals Directorate (ASD) Independent Registered Assessor Program (IRAP) Assessment.* We were engaged for this task.
The Approach
We commenced the engagement by interviewing key stakeholders in order to:
- Establish the context (business, organisational, strategic, tactical, system, security and risk perspectives);
- Define the scope (system architecture & boundaries, roles and responsibilities, Information Security Manual (ISM) control applicability, assumptions and constraints); and
- Gain an understanding of what could be leveraged from an ICT, physical and governance perspective and the extent to which that could occur (if at all).
With the above clearly defined and understood, we developed the required security artefacts in accordance with Australian Government security standards (Protective Security Policy Framework, ISM and ASD guidelines). Given that the system was to be subject to an IRAP Assessment, we understood how critical it was to ensure alignment, consistency, linkages and traceability between the suite of artefacts, particularly as it pertains to ISM control statements. This approach requires significant attention to detail, cross checking and quality assurance as key pillars to achieve an accurate outcome.
The Outcome
We worked closely with the third-party provider to gain the necessary information and develop an IRAP-ready suite of security artefacts. We developed a clear representation of the security risk posed by the use of the system which incorporated the important relationship with, and traceability between, ISM controls and system specific risk. More generally, we delivered the following artefacts:
- System Security Plan – Annex;
- Information Security Policy;
- Security and Risk Management Plan;
- System Security Plan;
- Security Incident Detection and Response Plan; and
- Security Standard Operating Procedures.
We presented our deliverables in the form of individually printed and bound reports. The success of this engagement resulted in us being invited back to update the security suite years later and, additionally, we were recommended to other areas with the department to provide our security consulting services. We were subsequently invited back, and completed, engagements on advertising, recruitment, payroll, human resource management, payment and other WoAG systems.
* www.cyber.gov.au/irap.