These procedures relate to the Cyber security policy.

The Secretary:

• appoints appropriate senior executive officers and a governance committee to oversee and implement the department’s obligations under the NSW Cyber Security policy
• ensures the department implements and maintains an effective cyber security plan
• determines the department’s risk appetite (refer to the Enterprise risk management Toolkit) using the approved whole-of-government Internal Audit and Risk Management Policy, (refer to NSW Treasury’s Internal audit and risk management) defining how much and what type of risk the department is willing to take on to achieve its objectives.

The Audit and Risk Committee (ARC):

• governs key compliance activities.

The Cyber Security Working Group:

• is a consultative forum that contributes and consults on key compliance activities
• promotes a cyber-safe culture across the organisation, to ensure cyber security is understood as a shared responsibility
• promotes cyber safety practices and the importance of following the associated standards and procedures in all schools and education support settings.

System business owners and service owners:

• cooperate with the Cyber Security team during the preparation of the annual maturity report and other compliance activities as required
• with the assistance of asset support staff, develop and implement technical information security safeguards to manage identified risks.

The Chief Information Officer (CIO):

• oversees and implements the department’s Cyber security policy, sets the strategic direction for the Cyber Security team, establishes department cyber security programs and plans, and appropriately resources and supports department cyber security initiatives, including training and awareness and continual improvement initiatives
• supports the department’s cyber security plan
• allocates funding and resources to develop, implement, and maintain an Information Security Management System (ISMS)
• enables industry best practice for identifying assets, assessing risk and applying appropriate controls within the department’s scope
• determines the scope of CIO and Chief Operating Officer responsibilities for cyber security relating to assets such as information, building management systems and industrial automation and control systems
• ensures a secure-by-design approach for new initiatives and upgrades to department systems.

The Chief Data Officer:

• supports the department’s cyber security plan.

The Chief Information Security Officer (CISO):

• ensures compliance with the NSW Cyber Security policy and supports the department to implement and maintain an effective cyber security program and plan including via effective collaboration and governance forums
• ensures the Cyber Security team develops, implements, and maintains the plan
• submits a maturity report to Cyber Security NSW each year (by 31 October)
• approves the Information Security Management System (ISMS) and
  • allocates resources for its function and manages the budget and funding for the cyber security program
  • endorses or approves policies, procedures, practices and tools to ensure compliance with the NSW Cyber Security policy
  • assesses and provides recommendations on any exemptions to department cyber security policies and standards
  • ensures the ISMS achieves its intended outcomes
  • reports on the performance of the ISMS to the department’s executive
• develops a cyber security strategy, architecture and risk management process that incorporates these with the department’s current Enterprise risk management policy and framework
• reports cyber incidents to the department’s executive and Cyber Security NSW in alignment with
  • Cyber Security NSW severity definitions (refer to Cyber Security NSW glossary)
  • the department's Cyber Incident Response Plan.

The Chief Operating Officer (COO):

• supports the department’s cyber security plan.

The Director, Cyber Security Operations:

• coordinates the implementation and day-to-day operation of the Information Security Management System (ISMS) Framework and ensures the ISMS meets the required international standards
• develops and maintains cyber security standards, procedures and guidelines
• manages the life cycle of cyber security platforms including design, deployment, ongoing operation, and decommissioning
• ensures appropriate management of the availability, capacity and performance of cyber security hardware and applications
• provides input and support to regulatory compliance and assurance activities and manages any resultant remedial activity
• acts as a focal point within the department for all matters related to information management required to support cyber security
• escalate and report cyber incidents that involve information damage or loss to the Legal Services directorate
• measures the performance of the ISMS and reports to the CISO
• coordinates cyber security risk assessments across ISMS assets and third-party vendors that send or receive ISMS asset data, and ensures identified risks are managed to an acceptable level
• in accordance with the ITD Contract Management Framework, ensures third-party ICT service providers
  • understand and comply with the department’s cyber security requirements
  • operate within the department’s information security requirements (refer to ICT contract requirements) and participate in security and performance reviews as required
• manages and coordinates the response to cyber security incidents, changing threats, and vulnerabilities.

The Cyber Security team:

• develops, implements, and maintains the department’s cyber security plan
• prepares the maturity report for Cyber Security NSW each year
• develops, maintains, and implements mandatory cyber security training for all employees, regardless of their role or level of access, to gain the appropriate knowledge to protect sensitive information and mitigate potential risks
• provides access to mandatory cyber security training to increase awareness
• encourages the reporting of cyber security risks by all staff
• shares information about using department devices, systems, and information properly and securely
• establishes and enforces appropriate access controls and security screening procedures for individuals granted access to department devices, systems, and information
• in collaboration with relevant executive staff and service owners of ISMS assets –implements the Information Security Management System (ISMS) and develops an ISMS Framework, with operational and administrative support, advice and governance from the Director, Cyber Security Operations
• when ICT projects are initiated
  • reviews the project and its compliance against relevant security standards
  • reviews design and architecture documentation
• develops, maintains, reviews and completes performance analysis of the Cyber Incident Response Plan as part of continual improvement.

The Audit directorate:

• conducts systematic and periodic checks to ensure the effective implementation and operation of the ISMS against the framework.

The Chief Risk Office:

• ensures cyber risk frameworks align with the Enterprise Risk Management Framework (refer to Policy and framework) and are applied when assessing cyber security risks and setting the department’s risk appetite.

The Manager, IT Audit, Assurance and Risk:

• coordinates internal audit programs for cyber security
• coordinates updates to the Enterprise Risk Register.

Asset support staff:

• work in collaboration with the Cyber Security team to ensure the department’s information security management practices are continuously improved in line with NSW Government requirements
• monitor and respond to cyber security incidents and events
• report cyber security incidents to the Cyber Security team.

All principals and managers:

• ensure staff remain compliant with mandatory training requirements and monitor completion through their SCOUT Compliance reports
• ensure the Cyber security policy and applicable policies, standards and procedures are effectively communicated and implemented throughout all schools and education support areas
• identify and report cyber threats
• communicate information security matters to technology support staff and information users
• collaborate with ITD staff to manage security requirements for their systems.

All staff (including contingent workers and third-party contractors):

• contribute to the department’s cyber security culture by exercising a duty of care to protect the department’s system and information, participating in mandatory cyber security training and reporting all known or suspected cyber security risks
• complete annual mandatory training (refer to Professional learning [staff only]. Training is available through the department’s professional learning platform)
• comply with the Cyber security policy and other applicable policies, standards and procedures for using department devices, systems, and information properly and securely
• use digital devices provided by the department for official purposes only and exercise a duty of care to protect the department’s digital systems and information
• apply the same duty of care when using a personal device to access department systems and information. Additional actions as required under the Digital devices and online services – staff use policy ensure these devices remain secure
• report any known or suspected cyber security risks to the appropriate risk and control owners within schools and business units through the department’s Cyber Incident Response Plan
• cooperate with relevant Cyber Security and Chief Risk Office staff to manage identified risks in line with the department’s risk appetite
• be aware of and have access to the department’s Enterprise risk management policy and framework to support risk-informed decision-making
• when initiating ICT projects or activities where department data is being transmitted or received, consult the Cyber Security team throughout the project’s lifecycle
• when initiating or managing projects, initiatives or activities with an AI component, engage the AI Review Service and AI Executive Leadership Group (ELG) for review and approval before proceeding
• when managing student data, obtain parental or carer consent for the use of online applications where appropriate, as outlined in this procedure
• consider whether a data breach has occurred when reporting an incident or event. Any data breach has additional reporting requirements in line with the Data breach response plan
• comply with the department’s Cyber security standards (refer to Policies, strategies and standards) to manage the security of assets such as staff and student health, personal and other sensitive information.

Any company with a current ProcureIT, Core&, ICTA or MICTA contract, or any other current contract signed with the department:

• annually completes their in-house cyber awareness training
• incorporates information security requirements into new and continuing procurement of information and communications technology (ICT) and digital goods and services contracts. This includes ensuring that contract requirements are complied with.

The NSW Cyber Security policy guides the requirements for the department’s roles and responsibilities for cyber security. For a full list of assigned responsibilities, refer to Policies, strategies and standards, the Cyber Security Responsibilities (PDF 198 KB) matrix.

The Secretary must appoint:

• the Chief Information Officer who must oversee and implement the department’s Cyber Security policy, set the strategic direction for the Cyber Security team, establish department cyber security programs and plans, and appropriately resource and support department cyber security initiatives, including training and awareness and continual improvement initiatives
• the Chief Information Security Officer who must ensure compliance with the NSW Cyber Security policy and support the department to implement and maintain an effective cyber security program and plan including via effective collaboration and governance forums
• a governance committee, the Audit and Risk Committee, which governs key compliance activities
• a consultative forum, the Cyber Security Working Group, which contributes and consults on key compliance activities.

The cyber security plan consists of the:

• Cyber Security Strategy (PDF 3.3 MB) (refer to Policies, strategies and standards)
• Cyber Uplift Program Plan.

The plan is based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and aligns with the NSW Cyber Security Policy and the Australian Cyber Security Centre’s Essential Eight. The plan must:

• be integrated with business continuity procedures
• include consideration of threats, risks and vulnerabilities that impact the protection of the department’s digital systems and information within the department’s cyber security risk tolerance
• outline the department’s goals, initiatives and general approach to uplift cyber security capabilities and build resilience across the department.

The Cyber Security team prepares the report using the template provided by Cyber Security NSW, which must provide assurance of the department’s compliance with the NSW Cyber Security policy, including:

• evidence of its maturity against all mandatory requirements in the NSW Cyber Security Policy and the Australian Cyber Security Centre’s (ACSC) Essential Eight for the previous financial year
• a list of cyber security risks with a residual rating of high or extreme and a list of the department’s ‘crown jewels’
• an attestation on cyber security signed off by the Secretary.

Service owners, as well as other relevant stakeholders across the department, must cooperate with the Cyber Security team throughout this process.

The Chief Information Officer (CIO) must allocate funding and resources to develop, implement and maintain an Information Security Management System (ISMS) that:

• aligns with the requirements in the NSW Cyber Security policy and the Australian Cyber Security Centre’s Essential Eight
• maintains compliance and certification with the following international standards:
  • ISO/IEC 27001 – ISMS Requirements – for establishing, implementing, maintaining, and continuously improving our information security management systems
  • ISO/IEC 27002 – ISMS Controls – for implementing the necessary controls, policies, and procedures to mitigate risks and safeguard sensitive information
• enables industry best practice for identifying assets, assessing risk and applying appropriate controls within the department’s scope.

The CIO also needs to:

• determine the scope of CIO and Chief Operating Officer responsibilities for cyber security relating to assets such as information, building management systems and industrial automation and control systems
• ensure a secure-by-design approach for new initiatives and upgrades to department systems.

The Cyber Security team must implement the ISMS and develop an ISMS framework in collaboration with the Director, Cyber Security Operations. The director must also:

• develop and maintain cyber security procedures and guidelines
• manage the life cycle of cyber security platforms including design, deployment, ongoing operation, and decommissioning
• ensure appropriate management of the availability, capacity and performance of cyber security hardware and applications
• provide input and support to regulatory compliance and assurance activities and manage any resultant remedial activity
• act as a focal point within the department for all matters related to information management required to support cyber security
• escalate and report cyber incidents that involve information damage or loss to the Legal Services directorate
• measure the performance of the ISMS and report to the Chief Information Security Officer (CISO).

The CISO is responsible for approving the ISMS and must also:

• allocate resources for its function and manage the budget and funding for the cyber security program
• endorse or approve policies, procedures, practices and tools to ensure compliance with the NSW Cyber Security Policy
• assess and provide recommendations on any exemptions to department cyber security policies and standards
• ensure the ISMS achieves its intended outcomes
• report on the performance of the ISMS to the department’s executive.

All staff must comply with the department’s Cyber security standards (refer to Policies, strategies and standards for all the information staff need to comply) to manage the security of assets such as staff and student health, personal and other sensitive information.

The current list of standards is:

• API Security Standard
• Cryptography Standard
• Data Centre Physical Security Standard
• Data Masking and De-Identification Standard
• Identity and Access Management Standard
• Logging and Monitoring Standard
• Network Security Standard
• Operating System Security Standard
• Patch Management Standard
• Password Standard
• Privileged Access Management Standard
• Remote Access Standard
• Secure Coding Standard
• Vulnerability Management Standard.

The department operates a threat driven, risk informed approach to managing cyber security risks. At an enterprise governance level:

• the Secretary, in consultation with the Chief Risk Officer, must determine the department’s risk appetite (refer to Toolkit) using the approved whole-of-government Internal Audit and Risk Management Policy (refer to NSW Treasury’s Internal audit and risk management), defining how much and what type of risk the department is willing to take on to achieve its objectives
• the Chief Information Security Officer (CISO) must develop a cyber security strategy, architecture and risk management process that incorporates these with the department’s current Enterprise risk management policy and framework (refer to Policy and framework).

To effectively manage cyber risk, all staff must:

• report identified cyber security risks to the appropriate risk and control owners within schools and business units (this may be to a manager, principal, or other delegated staff member – refer to Reporting a security incident for more information)
• cooperate with relevant Cyber Security and Chief Risk Office staff to manage identified risks
• be aware of and have access to the department’s Enterprise risk management policy and framework (refer to Policy and framework) to support risk-informed decision-making.

All principals and managers who own and control risk, including business owners and service owners, must (in line with the Enterprise risk management policy and framework [refer to Policy and framework]:

• identify cyber threats and rate the likelihood and consequences should those threats be realised
• communicate information security matters to technology support staff and information users
• collaborate with ITD staff to manage security requirements for their systems.

The Director, Cyber Security Operations must coordinate cyber security risk assessments across ISMS assets and third-party vendors that send or receive ISMS asset data, and ensure identified risks are managed to an acceptable level.

As part of this, service owners, with the assistance of asset support staff, must develop and implement technical information security safeguards to manage identified risks.

The Chief Risk Office must:

• ensure cyber risk frameworks align with the Enterprise Risk Framework and are applied when assessing cyber security risks and setting the department’s risk appetite

The Manager, IT Audit, Assurance and Risk must:

• coordinate internal audit programs for cyber security
• coordinate updates to the Enterprise Risk Register.

Table 1 Consent needed by online application

The Chief Information Security Officer (CISO) must report cyber incidents to the department’s executive and Cyber Security NSW in alignment with:

• severity definitions (refer to Cyber Security NSW glossary)
• the department's Cyber Incident Response Plan.

The Cyber Security team must develop, maintain, review and complete performance analysis of the Cyber Incident Response Plan as part of continual improvement.

The department's Cyber Incident Response Plan:

• complies with the NSW Cyber Security policy
• describes the processes, responsibilities, and tools used by incident response staff, executive staff and other relevant risk management branches for responding to cyber incidents beyond business as usual events in the department
• integrates with the department’s Major Incident Management Process and the NSW Government Cyber Incident Response Plan
• is exercised annually in line with NSW Cyber Security policy requirements by simulating cyber incident scenarios to test its effectiveness as well as the coordination of operational and executive response.

The Director, Cyber Security Operations must manage and coordinate the response to cyber security incidents, changing threats, and vulnerabilities.

A cyber security incident is defined as any event that threatens or has compromised, the security of the department’s digital devices or services. Refer to Reporting a security incident for more information about what you may need to report and how.

All staff must also:

• cooperate with the Cyber Security team to investigate, analyse and respond to cyber incidents
• consider whether a data breach has occurred when reporting an incident or event. Any data breach has additional reporting requirements in line with the Data breach response plan.

Asset support staff must monitor and respond to cyber security incidents and events.

• An in-depth list of governance roles and responsibilities has been developed to align with the NSW Cyber Security Policy. For more information, refer to Policies, strategies and standards, the Cyber Security Responsibilities (PDF 198 KB) matrix.
• All staff must additionally comply with the department’s Cyber security standards to manage the security of assets such as staff and student health, personal and other sensitive information. These standards are aligned with industry best-practice and the department’s cyber risk profile.
• Cyber Security Strategy (refer to Policies, strategies and standards)
• National Institute of Standards and Technology (NIST) Cybersecurity Framework
• Essential Eight
• Mandatory cyber security training (refer to Professional learning)
• ICT contract requirements
• AssessedIT
• Information Security Management System (ISMS)
• ISO/IEC 27001 – ISMS Requirements
• ISO/IEC 27002 – ISMS Controls
• Technology cyber security assessment
• Online Learning Tools Marketplace
• Administration Marketplace Panel for Schools
• Online software applications and parental consent
• Incident severity definitions (refer to Cyber Security NSW glossary)
• Reporting a security incident
• Data breach response plan

The Cyber security policy is guided and supported by the following:

NSW Cyber Security policy

NSW State Records Act 1998

NSW Privacy and Personal Information Protection Act 1998

NSW Health Records and Information Privacy Act 2002

NSW Workplace Surveillance Act 2005

NSW Government Information Classification, Labelling and Handling Guidelines

Code of conduct policy

Enterprise data policy

Business continuity management policy

Privacy Management Plan (PDF 643 KB)

Privacy Code of Practice (PDF 361 KB)

Digital devices, services and information – staff use policy

Payment Card Industry Data Security Standard

Cyber Security Strategy (refer to Policies, strategies and standards)

Enterprise Risk Management Framework (PDF 1235 KB)

Cyber Security Standards (refer to Policies, strategies and standards)