DECS Policy – ICT Security

Cofidentiallity ; Integrity ; Availability

Policy Guidelines :
1. ICT Logical Security
Access to information and business processes must be controlled on
the basis of business and security requirements, and is subject to the
DECS Information Management Policy – Privacy and Confidentiality.

1.1 Information Aset Classification

Must be classifies to indicate their importance in terms of three
security objective.
1.2 Access Control and Management
Users must only be supplied with the level of access required to
perform their work duties. Users must not attempt to gain access
beyond their given access privileges.

• No user shall bypass any security controls without the approval of

the Principal or Preschool Director (for schools and preschools) or the
ICT Security Team Leader (for other
sites).
1.3 System and Application Software Security
Must be maintained over operating systems and utilities, systems
software, and application systems and associated information in all ICT
environments.

1.4 Event Logging

Must be activated to assist in possible investigations and to allow access
control monitoring. Log data must be appropriately
protected, managed and retained.
• Logs must be regularly reviewed at a frequency consistent with the risk
of infection and the classification of
1.5 Security Requirements Analysis and Specification
All applicable statutory, regulatory and contractual requirements must be
defined and documented for each information system, including the
specific controls and responsibilities to meet these requirements.

1.6 User Identification

(User-ID) The use of shared group user-ids will only be used in special
circumstances, and only after approval from the Principal or Preschool
Director (for schools and preschools) or ICT Security Team Leader (for
other sites).
1.7 Password
Passwords must not be words found in a dictionary, or based on
anything somebody else could easily guess or obtain using person-
related information (e.g. names, telephone numbers of dates of birth).

1.8 Data Encryption

Provide security for confidential or sensitive information

1.9 Information Transport, Storage and Trasmission

To ensure there is no unauthorised disclosure or damage.
1.10 Mobile Computing
Controls for mobile computing are to be based on the classification of
information assets at risk. Refer to the DECS Standard – Mobile
Communication Devices Security.

1.11 Access Administration

Access reports will be regularly produced to facilitate compliance to
security requirements and internal control procedures.
1.12 Acceptable Use Policies
According to the Code of Conduct published by Commissioner for Public
Employment. Acceptable use policies must be in place for all users,
including staff and students.
• terms and conditions of use of DECS ICT facilities, and of online
behaviour and access privileges, and consequences of non-compliance.

1.13 Segregation Of Duties

Where appropriate, conflicting duties must be segregated to reduce the
risk of accidental or deliberate system misuse, damage or fraud.