Dealing with documents and information received
6 Dealing with documents and information received
The Public Interest Monitor and IBAC must develop written procedures for dealing with documents and information, including the creation and maintenance of the following—
an information security policy;
an access control policy;
procedures for monitoring access activities;
procedures for ensuring that documents and information are adequately protected;
a risk management policy for identifying, analysing and treating security risks to documents and information;
reporting, escalation and response procedures for information security events or identified weaknesses in information security that may affect documents and information;
a process of continual monitoring and improvement to mitigate and avoid information security incidents.
In this regulation—
information security event means an identified occurrence of an information system, service or network state indicating—
a possible breach of an information security policy; or
a failure of safeguards; or
a previously unknown situation that may be relevant to security;
information security incident means a single or a series of information security events that are likely to have compromised the security of information.
The statute text is free to read above. View Pro plans to unlock the case-law research tools for each provision.