Cabinet has agreed measures to appropriately protect the Government's electronic information holdings and information systems. Premier's Circular 2001-46 (available from the NSW Premier's Department web site, outlines these measures. The key elements are information security policies and plans for all agencies. They also include the Department of Information Technology and Management establishing arrangements to enable agencies' progress to be monitored.

All agencies, including Government Trading Enterprises, are to report to the Department of Information Technology and Management. Reporting is to be quarterly until December 2002, then annually until December 2004 when it will be reviewed.

The monitoring mechanism is an on-line survey form that requires agencies to select from the options provided or look-up information that should be documented in their IT security policies and plans. The first survey, as at 31 October 2001, will be used to establish a baseline against which progress can be assessed.

 The Department of Information Technology and Management is to be responsible, through the Minister for Information Technology, for reporting to the Cabinet Standing Committee on Information Technology on agency and overall government progress.

Bob Carr
Premier

_____________________________________________________________

Related to C2001-46 , superseded by M2007-04
_____________________________________________________________

Attachment

ELECTRONIC INFORMATION SECURITY (EIS) PROGRAM MONITORING

The Department of Information Technology and Management (DITM) through the Office of Information Technology (OIT) will be responsible for establishing and managing EIS program reporting, including reporting to the Cabinet Standing Committee on Information Technology, on agency and overall government progress.

All agencies are to complete an initial EIS survey, as at 31 October 2001, by 23 November 2001. Subsequent survey timescales are detailed below. The survey form is on-line at the OIT website (www.oit.nsw.gov.au/secdb). The first step is for the officer completing the survey to register with the facility on behalf of the agency she or he represents.

The survey form includes explanatory information and definitions and requires users to select from the options provided or look-up information that should be documented in their agency's IT security policies and plans, there are no open questions. Hard copies are not required by DITM but the survey can be printed if required for agencies' internal processes. Comments are invited in the survey and OIT plans to provide a private and anonymous feedback facility whereby an agency will be able to assess themselves relative to other unidentifiable agencies.

The survey requires the contact details of the officer nominated to have responsibility for IT Security in accordance with Premier's Circular 2001-46. This officer will be the liaison person between the agency and OIT for the monitoring program and any other EIS purposes.

All agencies are to complete on-line surveys in accordance with the timescales in the following table:

Survey As At Submitted By
______________________________________________________________
 
1 31 October 2001 23 November 2001
2 31 January 2002 10 February 2002
3 30 April 2002 10 May 2002
4 31 July 2002 10 August 2002
5 31 October 2002 10 November 2002
6 31 October 2003 10 November 2003
7 31 October 2004 10 November 2004
______________________________________________________________ 

For further information on actions to be undertaken in relation to EIS, please contact Nigel Evans, Manager Electronic Commerce, phone 9236 7718 or email ([email protected] ).