About the policy

What needs to be done

The department provides standardised digital devices, operating systems and software to schools, department workplaces and staff.

1. Setup and security

1.1 Secure all department digital devices, services and information

1.1.1 Securing digital devices

All staff must:

• ensure that department digital devices are protected from compromise, loss and damage
• ensure security measures are appropriate to the setting. For example, school locations will require different security considerations to education support locations.
• lock any digital devices when leaving them unattended
• save any open files and close any applications when leaving a digital device unattended
• not give unauthorised persons access to areas where department devices or infrastructure is stored
• not share their login information or provide access to department devices and services through their login to any other person, including students
• conclude concurrent logins as soon as practicable
• store digital devices in a lockable container or other secured area both at home or at department locations
• cover laptop webcams and unplug desktop webcams when not in use
• not leave department digital devices in any unsecured location, including common areas and motor vehicles
• only access department digital devices using a department-provided login or identity
• not take any action to alter or diminish the security of any department digital device.

1.1.2 Securing digital services and information

All staff must:

• only access department digital services and information using a department-provided login or identity
• take reasonable steps to ensure unauthorised persons cannot access departmental information in any form
• not share their login information, or provide access to department services and information through their login to any other person, including students
• not take any action to alter or diminish the security of any department services or information
• practice good cyber hygiene (refer to 1.1.3 below, 'How to secure digital services and information').

1.1.3 How to secure digital services and information

Securing the department’s digital services and information is critical. Staff must practice good cyber hygiene and follow the guidelines outlined in these procedures.

1.1.4 Monitoring digital devices, services and information

The department monitors its digital systems to ensure the confidentiality, integrity and availability of business and education services in line with the Workplace Surveillance Act 2005 (NSW).The department reserves the right to inspect any digital device issued to staff while investigating breaches, incidents and allegations of misconduct. This data may be passed on to police or other investigative bodies. The department may also monitor personal devices used for work.

1.2 Secure personal devices used for work

Staff can choose to use personal digital devices for work under Bring Your Own Device (BYOD) programs. The department does not manage or support these devices.

1.2.1 Securing personal devices

Staff must:

• protect the device with a PIN (personal identification number) or password that complies with the department’s Password Standard (refer to Policies, strategies and standards) and ensure the device/s locks automatically
• protect the device using appropriate physical security measures (such as storing in a lockable container, ensuring the device is in a secure area not accessible by the public and not leaving devices in your car)
• only store the department’s information in the approved cloud storage platform, OneDrive
• allow the deployment of a digital certificate to enable network traffic decryption and inspection by the department
• comply with the responsibilities and security controls for use of BYOD specified below
• comply with all provisions of this policy and the department’s Cyber security policy and procedures.
• report the loss or theft of a personal device used to access or store department data to their manager and EDConnect (1300 32 32 32 option 5) as soon as practicable once the incident becomes known
• comply with ITD directives, within 24 hours if no other deadline is specified, to update system software or take actions (such as changing device settings) to ensure device security.

1.2.2 Remote wiping of personal devices

To protect the confidentiality, integrity and availability of its information, the department may remotely wipe department accounts from any personal device connected to or configured to use its services. Wiping these accounts will erase data such as department email and documents but may also erase any personal data associated with software licensed to the department (such as Microsoft Office 365). The department is not obliged to inform staff of its intention to wipe accounts from the device or provide any support in recovering lost personal data or functionality. Devices will not be remotely wiped without due diligence.

1.2.3 BYOD security requirements

The department requires staff to implement the following controls for any personal device that accesses the department’s digital services or information.

1.2.4 Mandated software and certificates

The department may deploy any monitoring or decryption software deemed necessary to maintain the security of its digital services and information. Staff consent to this deployment and monitoring when they opt in to access the department’s network, digital services or information from a personal device.

Staff must:

• allow the deployment of a digital certificate to enable network traffic decryption
• install any mandated mobile device management tool or other software on the department’s advice.

The department conducts all monitoring and decryption practices in accordance with relevant legal and regulatory requirements.

1.2.5 Monitoring of personal devices

Staff who choose to use personal devices under a bring your own device (BYOD) program, trade a limited amount of control over the device’s data in exchange for access to the department’s network and information assets. All monitoring is in accordance with the Workplace Surveillance Act 2005 (NSW).

The department may monitor staff members through mobile device management (MDM) software, or any other software deemed necessary.

The department, and any associated entity providing MDM software, will not collect the following information from personal devices unless permitted by law:

• keystroke activity
• photos
• texts composed or received in the built-in messaging application.

1.3 Procure digital devices and services

When approving the purchase or procurement of digital devices or services, staff must ensure the device or service:

• best meets the business unit’s specific needs
• is cost effective
• represents an ethical and efficient use of department resources
• satisfies the department’s ICT contract requirements (see the Cyber security policy).

2. Acceptable use

The department provides staff with digital devices and services to enable them to perform their duties. This section outlines acceptable and unacceptable uses of digital devices and services.

Staff must:

• use department digital devices, services and information responsibly and comply with relevant NSW legislation
• use department digital devices, services and information economically and efficiently
• appropriately secure any digital device, service or information used for work purposes (includes personal devices)
• use department digital devices primarily for work purposes.

The department monitors the use of its digital devices, services and information for breaches of this policy and relevant legislation.

2.1 Use department resources economically and efficiently

Use of department-provided digital devices and services must always be economical, efficient and responsible.

Staff must:

• limit the duration of any time-charged communication, including internet sessions and any other data-intensive services
• not use department digital devices or services for income-generating activities
• cancel or handover any unused licences charged to your business unit.

The department reserves the right to adjust staff mobile data plans to ensure the most economic use of the department’s resources.

Approval to use personal mobile devices for department business purposes, and subsequent reimbursement of costs, should be limited to occasional or extraordinary circumstances. Any reimbursement must be reasonable, justified and not exceed the total cost of the mobile bill.

2.2 Comply with copyright and privacy requirements

The department’s information is subject to privacy and copyright legislation.

Staff must:

• not copy or transmit any material in electronic or physical form that is protected by copyright, except as the law authorises or permits. Refer to Legal Services for more information about copyright
• not disclose, access or use any department controlled personally identifiable information in a manner inconsistent with state and federal privacy legislation and regulatory frameworks. Refer to Information and Privacy Commission NSW for more information
• label and handle official, sensitive and other confidential information in accordance with the NSW Government Information Classification, Labelling and Handling Guidelines
• ensure that personal information is not stored, transmitted or used in department services to enable the separation of business monitored information from personal information. If staff do use department devices or services for this purpose, the department cannot be held responsible for the collection of this data.

2.3 Exercise good judgment when using department devices for personal use

The department acknowledges that staff may occasionally need to use its digital devices and online services for personal reasons.

Staff must:

• only do so in a manner that is infrequent, brief, involves minimal cost and does not interfere with the performance of work, impact on the department’s service delivery, or create an exposure for the department to viruses, legal liability or reputational damage
• accept that the devices are department property and therefore usage will be monitored
• not engage in any unlawful, unacceptable, inappropriate or uneconomical activities.

Staff suspected of abusing their use of department-owned digital devices and online services may be subject to investigation and could face disciplinary action.

2.4 Examples of unacceptable use

Any use of the department’s digital devices or services that could be considered controversial or offensive, or that could potentially damage the department’s reputation or financial position, is unacceptable. The intentional unacceptable use of department digital devices or services may result in disciplinary action. These standards apply whenever departmental equipment (including BYOD) or communication lines are used.

3. Leaving the department

Staff may be provided with a digital device for work-related purposes during their employment with the department. These devices remain the property of the department and must be returned in situations where:

• staff separate from the department
• staff are terminated
• staff take extended leave, including secondments longer than 3 months.

In these circumstances, staff must:

• remove any personal information from the device
• not copy or document department information in any way
• cancel or transfer any software subscriptions paid for by the business unit
• return any department-owned laptops to their principal (for school staff) or to EDConnect (for education support staff)
• notify the ITD telephony team (via EDConnect) of any mobile phone/data services that will no longer be required. Department-owned mobile phones are to be retained by the business unit.

The department will disable access to departmental digital devices, services and information on separation or termination of employment, subject to department policy:

• casual staff – 15 months from last casual pay period
• temporary staff – 12 weeks from disengagement
• permanent staff – 12 weeks after separation.

4. Taking or accessing department digital devices, services and information from overseas

4.1 Apply for or approve overseas travel

Taking and accessing department digital devices, services and information from overseas presents a significant cyber security risk to the department. In line with NSW Government requirements, there are various processes that must be followed before department staff can access digital services and information overseas. This section details the actions for staff, managers, principals, the Cyber Security team, the Chief Information Security Officer (CISO) and deputy secretaries (or equivalent executives).

4.1.1 Applying to access department devices, services or information from overseas

Staff planning to travel overseas must:

• apply for approval if they would like to take or access department digital devices, services or information while overseas. Staff must apply for access at least 28 days before departure to allow time for approval
• only apply for a maximum duration of 180 days access at a time. If a longer time is required, they must submit a new application.

Access will only be granted where necessary to satisfy business requirements and will generally not be granted for personal leave.

The provisions under this section do not:

• apply to third-party service providers and vendors engaged under a Third-Party Agreement contract
• contain provisions related to seeking or endorsing official travel, excursions or teacher exchange applications
• cover work health and safety, insurance, physical security or any other matters related to working for the department while overseas.

4.1.2 Official travel, approved excursions and teacher exchange programs

Staff travelling on official business, approved excursions or approved department teacher exchange programs (refer to Scholarships and programs) must first have their travel approved under the appropriate policy or program:

• Travel on official business policy
• Excursions policy
• Teacher exchange programs (refer to Scholarships and programs)

Where travel has been approved under one of the above policies, approval to take or use department devices, services and information from overseas will only be required from the CISO. Staff will be required to provide evidence that travel has been approved under one of the above policies as part of their request.

4.1.3 Transitional arrangements

The provisions of this policy will be enforced from its implementation. Any staff member currently working from overseas, or who has an arrangement to do so in the future, must have their access to department devices, services and information reviewed by the Cyber Security team.

All managers, principals and other staff responsible for managing and approving travel or flexible working arrangements must notify the Cyber Security team (CyberSupport@det.nsw.edu.au) of any staff within their business unit who have working from overseas arrangements in place.

Staff who have arrangements to travel overseas and who plan to access department devices, services and information must complete an international access request per this policy and email CyberSupport@det.nsw.edu.au to ensure the request is managed efficiently.

The Cyber Security team will also work with Human Resources teams to review and document all current approved requests during the transitional period.

4.1.4 Considerations for endorsing and approving officers

Endorsing and approving officers must consider:

• the purpose of the travel
• the duration of the travel (requests have a maximum duration of 180 days)
• the locations of travel and transit
• the business need and associated risk of the travel
• whether the request form is complete, accurate and true.

In assessing applications, endorsing and approving officers should pay particular attention to:

• whether the work could be completed before travel, or handed over to a colleague
• the minimum application, software, information or device requirements to complete the work
• whether travel constraints, such as time zone differences, will have an effect on the achievement of work goals
• the risk to the department’s information security that the requested access poses (see below)
• any other constraints to work practices deemed relevant.

Requests must not be approved to take or access department digital devices, services or information to or from any overseas location determined to be high risk (non-Five Eyes [refer to 4.3 High-risk countries]) unless no other reasonable business solution exists.

Additional information from an applicant may be requested before endorsing or approving a request.

4.1.5 Application and approval guidelines

The following guidelines apply to staff, managers, principals, the Cyber Security team, the CISO and Deputy Secretary.

4.2 Additional cyber security risk mitigation

The Cyber Security team will outline any additional risk mitigation strategies that staff may need to complete before departure. Any additional requirements will be implemented on a case-by-case basis.

If assistance is needed to complete these steps, contact CyberSupport@det.nsw.edu.au.

4.3 Low- and high-risk countries

The Five Eyes partnership is an intelligence alliance comprising Australia, Canada, New Zealand, the United Kingdom and the United States. Each of the Five Eyes countries conducts interception, collection, acquisition, analysis and decryption activities, sharing all intelligence information obtained with the others by default.

For travel within Five Eyes countries:

• risk is considered low
• department devices may be approved to be taken to these countries
• generally, no restrictions on digital services or information will be enforced.

For transit or travel within non-Five Eyes countries:

• risk is considered higher and subject to more rigorous risk management
• standard department devices must not be taken or accessed
• ‘clean’ devices (see below) may be taken and accessed where approved
• personal devices may be used to access department digital services and information only where approved. Digital service and information access will be limited to Microsoft Office 365 applications access via the web browser.

4.4 Clean devices for travelling

It is recommended that staff travelling on official business to high-risk locations use a special ‘clean’ device for travel. Clean devices have never been connected to a NSW Government IT network and never will be. Clean devices will be arranged by the Cyber Security team for loan as part of risk mitigation.

On return from overseas travel, staff must:

• return all clean devices to ICT support staff for inspection and wiping
• report any suspected compromise of the ‘clean’ device or other suspicious behaviour to EDConnect.

See Telephony for more information on purchasing mobile devices or data services.

4.5 Appealing a decision

If the request is rejected, staff must not access department digital devices, services or information from overseas. If the CISO rejected the request, staff may submit a formal appeal by:

• contacting the relevant executive director and presenting a case for review
• attaching the Risk Assessment Summary document provided by Cyber Security.

If appeals are rejected, they must not be resubmitted. If appeals are approved, they will be subject to any additional risk mitigation controls deemed necessary.

The Appeal template (refer to Accessing digital systems while overseas)provides further direction.

4.5.1 Evaluating requests for review

When an appeal is escalated, the reviewer must:

• review the request rationale in light of the Risk Assessment Summary decision
• endorse or reject the appeal request.

If a reviewer endorses the appeal, they must:

• raise the appeal with the relevant Deputy Secretary (or equivalent) via a briefing, email or minuted meeting
• notify the Cyber Security team (CyberSupport@det.nsw.edu.au) that the appeal has been escalated to the Deputy Secretary (or equivalent) and include the team in all related correspondence.

4.5.2 Endorsement of an appeal

Deputy secretaries (or equivalent) who have had an endorsed appeal request escalated to them must:

• review the original request and any new evidence or information provided as part of the appeal
• consult the Cyber Security team for additional information or clarification if required.

If a Deputy Secretary (or equivalent) chooses to overturn the CISO’s original decision, they must notify the Cyber Security team (CyberSupport@det.nsw.edu.au) so the decision can be updated on the central register.

4.6 Variations to itineraries, locations and/or dates

If there are changes or cancellations to the submitted itinerary, staff must:

• contact their delegated approvers as soon as possible
• submit a travel itinerary variation request or resubmit a new application (see below).

Variations to travel locations:

• changes before initial approval – staff must withdraw their request in SAP and resubmit a new request (including re-obtaining written endorsement)
• changes before departure but after obtaining approval from the Deputy Secretary – contact CyberSupport@det.nsw.edu.au for further information.

Variations to travel dates:

Changes to travel dates before or after obtaining approval, require staff to

• notify their principal or manager of changes
• notify CyberSupport@det.nsw.edu.au and provide the approval reference number and new dates
• submit a new travel request if the changes to dates put the travel period over 180 days.

4.7 Approvals for staff already overseas

Staff must not take department devices overseas before obtaining approval from the Deputy Secretary or equivalent. Access to department devices while already overseas therefore cannot be granted.

If staff are contacted directly by their principal or manager to advise or action a business-critical assignment while overseas, access may be granted in exceptional circumstances. In these cases:

• the onus of submitting a request for access is on the requesting principal or manager
• access will be restricted to Microsoft Office 365 applications used explicitly via the web browser.

Requesting principals or managers should contact the Cyber Security team at CyberSupport@det.nsw.edu.au.

4.8 Overseas travel checklist

4.8.1 Before travelling overseas

Before travelling overseas, staff must take a number of precautionary measures to safeguard department devices, services and information.

4.8.2 Using department devices, services and information overseas

While working overseas, staff must comply with this policy, as well as the following department policies:

• Code of conduct policy
• Cyber security policy
• Excursions policy (as required)
• Travel on Official Business policy and guidelines (as required)
• Work health and safety (WHS) policy.

4.9 Reporting emergencies

Staff must report any loss, theft, potential compromise or unusual behaviour of devices during overseas travel to EDConnect (1300 32 32 32). EDConnect can be contacted Monday-Friday from 7:30am-6pm AEST.

4.10 Mandatory and discretionary requirements

There are a number of mandatory requirements for staff while they are working from overseas. These are outlined below, along with discretionary considerations.

4.11 Responsible use of digital devices, services and information

Staff using the department’s digital devices, services and information overseas must do so appropriately and in accordance with local and Australian law.

4.12 International roaming

The department’s standard mobile contracts incur high usage charges when used overseas. If you are taking an approved department mobile device overseas for use, use the international roaming option infrequently and economically. If you will require extended use of international roaming, contact the Mobile Devices team (mobilecomms@det.nsw.edu.au) for advice, additional information or assistance with mobile devices or contracts before travelling overseas.

4.13 Arriving back in Australia

On returning to the country, staff must:

• return all clean devices to ICT support staff for inspection and wiping
• confirm that passwords for any digital service used or accessed while overseas have been changed
• hand over any suspicious gifts or compromised devices to ICT support staff for examination
• report any suspected compromise of a device or other suspicious behaviour to EDConnect.

Record-keeping requirements

Refer to Functional Retention and Disposal Authority: FA387 (PDF 106 KB) for information on retaining and disposing of records.

Staff members need to preserve relevant business communications and ensure they comply with the department’s Records Management Program when deleting any electronic business communication.

Business communications, including email and other forms of messaging sent electronically become official records, subject to the State Records Act 1998 and the department’s Records Management Program. Electronic records are subject to the same standards of record keeping that apply to paper records.

Supporting tools, resources and related information

Policy contact