Policy Requirements
Information Asset Security policy requirements are as follows:
-
Comply with legislation and regulation
An entity must comply with any legislation relevant to its circumstances.
-
Align to guidelines and standards
All Commonwealth entities must comply with the Protective Security Policy Framework, as well as any other mandatory frameworks, policies, and standards.
-
Be Secure-by-Design
Entities should consider information asset security early. Threats should be considered from the outset to enable mitigations through thoughtful design, architecture, and security measures.
-
Apply a risk-based approach to information asset security
The assessment and management of risks associated with information assets should inform security decisions and investments.
-
Align operational and technological needs
Entities should implement information asset security measures and protocols that align to operational and technological requirements.
-
Select and implement appropriate information asset security controls
Entities should consider the correct classification of information to determine the level of protection each asset requires. Controls should be chosen based on the ability to mitigate identified risks to the information asset, ensuring that they protected against unauthorised access, disclosure, alteration, or destruction.
-
Adhere to reuse principles
Entities should give priority to the adoption of reuseable digital and ICT solutions, patterns, or knowledge, and, where necessary, design new solutions with a focus on future reuse.