This Protocol establishes common procedures to ensure proper reporting of information security events within the NSW Government. The Protocol draws on the expertise of the Information Security Community of Practice to establish procedures that will minimise the impact of information security events and inform NSW Government emergency response and business continuity planning.
The NSW Government Digital Information Security Policy (DISP) requires agencies to:
report on information security events, incidents, near misses and weaknesses; hereby, referred to as “information security events and incidents”;
establish a collaborative approach to information security by sharing information security experience and knowledge.
The DISP requires all NSW Government agencies to disseminate information security events and incidents that pose a threat, through the Information Security Community of Practice in a time and manner appropriate to the nature and magnitude of the threat.
Purpose
The Protocol will raise and maintain visibility of threats to the security of NSW Government information assets and work to inform risk analysis and control mechanisms. It synchronises agency level incident management and provides guidance on whole-of-government collaboration.
A whole-of-government approach will enable the Information Security Community of Practice to capture lessons learned for the continuous improvement of the incident management system and to address future requirements of cyber security and cloud services. It also enables the Community to share knowledge and experience of information security events and incidents with other jurisdictions.
Protocol
The process for sharing information security events and incidents is outlined below. This process does not replace or supersede agency or cluster level incident management and reporting policies and processes. This Protocol is intended to provide additional guidance on how to appropriately share information on incidents and events more broadly across government.
1. Identify
Senior Responsible Officers (SROs) identify or are informed of the information security event or incident, including:
o events affecting GovDC services
o events affecting agency function and services provided by GovDC such as hosted applications, storage, web services or connectivity
o events that have cluster wide effects
o events that are communicated by Cyber Security related agencies such as the Australian Signals Directorate, OnSecure, AUSCERT, etc. that are concerned with public or private sector interests
o significant audit findings or other events that are related to state critical infrastructure such as transport, utilities, or emergency services.

Read less