1. This policy describes how an agency’s accountable authority ^[1] can establish effective security governance to protect their agency’s people, information and assets. An effective governance structure ensures employees with the appropriate knowledge and position are empowered and resourced to maintain agency security.

^{[1] the person or group of persons responsible for, and with control over, the agency’s operations}

The accountable authority must establish the right security governance for the agency

2. To ensure an agency ^[2] establishes the right security governance, the accountable authority must:
   1. be responsible for protective security within the agency, including:
      1. putting in place protective security arrangements that implement the core and supporting requirements of the South Australian Protective Security Framework (SAPSF)
   2. determine and manage the agency’s security risks
   3. appoint an Agency Security Executive (ASE) to be responsible for directing protective security and empower them to make decisions about the agency’s security, including:
      1. appointing security advisers (ASAs and ITSAs) to advise on, and support delivery of, security outcomes, including sound information and communication technology (ICT) policies and procedures
   4. develop practices and procedures that deliver the security plan
   5. detect, respond, investigate and report security incidents
   6. be aware of and meet all security policy or legislative requirements
   7. provide and maintain security awareness training for all employees and service providers
   8. establish, maintain and monitor a central email address for all security matters across all protective security domains, including ICT.

^{[2]  This policy applies to all South Australian public sector agencies (as defined in section 3(1) of the Public Sector Act 2009) and to any other person or organisation that is generally subject to the direction of a Minister of the Crown; all of which are referred to in this policy as “Agencies”.}

3. The accountable authority for each agency is responsible to their portfolio Minister and the South Australian Government for their agency’s people, information and assets.
4. In establishing the protective security arrangements for an agency, the accountable authority must ensure:
   1. business continuity during security incidents, disruptions or emergencies
   2. the safety of employees to carry out the functions of government and those dealing with the agency (including visitors)
   3. the protection information and resources held within the agency.

5. The accountable authority of the agency must:
   1. implement the SAPSF core and supporting requirements
   2. appoint an Agency Security Executive (ASE) to be responsible for directing protective security and authorised to make security decisions, including the appointment of ASAs and ITSAs ^[3]
   3. ensure they have employees who hold the appropriate level of clearance to access security classified information, including themselves, where there is a need to share highly sensitive, or even security classified information of relevance to security with other agencies or entities
   4. ensure security awareness training is provided for all employees and service providers (including contractors) outlining their security responsibilities, including how to manage security risks
   5. embed effective security risk management processes
   6. approve the agency’s security plan for managing security risks
   7. ensure the security of the agency’s ICT systems is consistent with the requirements of SAPSF policy Robust ICT and cyber security and the South Australian Cyber Security Framework (PDF, 520.1 KB) (SACSF)
   8. promote and foster a positive security culture with defined expectations and priorities
   9. monitor the agency’s security maturity
   10. assess the agency’s security maturity in the annual security attestation
   11. approve citizenship and uncheckable background waivers for security clearance applications. ^[4]

^{[3] For smaller agencies, the accountable authority may decide to appoint themselves as ASE, and delegate the day-to-day functions of protective security to appointed security advisers}

^{[4]  For more information, see SAPSF policy Recruiting employees}

6. The accountable authority is responsible for putting in place protective security arrangements that implement the core and supporting requirements of the SAPSF, unless relevant circumstances prevent an agency from doing so.
7. Relevant circumstances may include:
   • circumstances outside of the agency’s control
   • where the cost or impact of implementing the requirement would prohibit the agency’s ability to perform its core function
   • where alternate arrangements are implemented that achieve the same or greater security outcomes that the core or supporting requirement
8. In such circumstances, the accountable authority of the agency must:
   1. identify and document the circumstances preventing the implementation of the core or supporting requirement(s)
   2. outline the alternative arrangements being implemented, including any justifications based upon the agency’s security maturity and risk tolerance
   3. outline actions planned to move toward achieving the requirements of the SAPSF and/or further reducing risk
   4. include a record of all decision-making in the agency’s annual security attestation.
9. Under section 12 of the Public Sector Act 2009, the accountable authority of all agencies must notify their responsible minister(s) of all significant issues affecting the agency. Any significant issues ^[5] affecting the agency in respect of implementation or application of the SAPSF must be included.
10. Deliberately disregarding implementing the SAPSF or its requirements is considered a security incident. For information on managing security incidents see SAPSF policy Annual security attestation.

^{[5] It is not considered a reportable significant issue if the alternative mitigations put in place provide the same (or exceed the level of) protection as the SAPSF requirement}

11. From time to time, there may be a need to share highly sensitive, or even security classified information with other agencies or entities. In such cases, the accountable authority is responsible for ensuring they have employees who hold the appropriate level of clearance to access security classified information, including themselves.
12. It is strongly recommended that the accountable authority of each agency obtain a security clearance to at least the level of Negative Vetting Level 1 (NV1). Any employees who are also connected in a workflow involving security classified information (including handling of documents, system administration, access privileges etc.) must also obtain a security clearance to the same level as the accountable authority.
13. It is also strongly recommended that all agency security personnel (ASE, ASA, ITSA etc.) also obtain security clearances to a level deemed appropriate by the accountable authority.
14. Information on obtaining security clearances can be found in SAPSF policy Recruiting employees.

15. Some agencies have additional protective security responsibilities under this policy. An agency will be designated a Lead Security Agency (LSA) where it is a:
    1. provider of government protective security policy or advice
    2. provider of shared-services arrangements.
16. Table 1 lists the LSAs for the South Australian Government

Table 1 - Lead Security Agencies in South Australia

Providing advice and support

17. A LSA provides other South Australian Government agencies with advice and/or services relating to government security. Timely and considered security support and advice is critical to ensuring the maintenance of protective security requirements across the public sector.
18. LSAs are required to provide advice and support which helps other agencies achieve and maintain an acceptable level of security, appropriate to their risks, in line with government-wide security policies, priorities and plans.
19. It is recommended that LSAs:
    1. implement appropriate oversight arrangements to coordinate security services provided to other agencies
    2. maintain the capability to provide timely and accurate security advice and services
    3. maintain regular contact with supported agencies to increase awareness and effectiveness of the LSAs role and capabilities
    4. schedule periodic review of the service arrangements and make procedural adjustments where necessary.
20. The accountable authority of an LSA must establish and agree upon clearly defined accountabilities, responsibilities and procedures for entering into partnerships or service provision arrangements with other agencies.

Supported agencies

21. Supported agencies are those that receive direct support or services from a LSA. It is recommended that the accountable authorities of both the LSA and the supported agency establish a formal agreement or arrangement that outlines the provision of services and the proscribed responsibilities of each party.
22. It is recommended that supported agencies notify any relevant LSAs of significant changes to protective security arrangements or agency risk profile.
23. Supported agencies should seek clarification if arrangements between the LSA and supported agency are unclear regarding agreed responsibilities during a significant or reoccurring security incident or event. This may include:
    1. who takes control and when
    2. who has authority under what circumstances
    3. to whom and when an incident is escalated
    4. communication lead during a significant or reoccurring incident or event.
24. The accountable authority of a supported agency remains responsible for the overall security of their agency. The accountable authority of a supported agency may outsource responsibility for specific security functions under shared-services or a partnership agreement, however, they should seek agreement from the accountable authority of a LSA.

25. Overall security risk management responsibility rests with the accountable authority. This means the accountable authority must:
    1. determine the agency’s tolerance for security risks
    2. apply a risk-based approach to manage the agency’s security risks
    3. consider any implications risk management decisions have on the security or operations of other agencies and share information where appropriate.
26. Determining agency risks mean identifying, assessing and prioritising risks to people, information and assets and should result in the effective risk-based application of mitigations or protections that minimise, monitor and control the likelihood and consequences of risks.
27. Further information about security risk management and security planning can be found in the SAPSF policy Security planning.

28. The accountable authority must appoint a South Australian Executive Service (SAES) (or equivalent) ASE to be responsible for directing all areas of security in the agency. The appointed ASE should be at a level appropriate to managing critical, security-related risks, incidents or emergencies within the agency.
29. The ASE should have sufficiently experience or training to perform the required security functions. The ASE must have a direct report to the accountable authority.
30. The ASE supports the accountable authority by providing strategic oversight of protective security to assist the continuous delivery of business operations, and by fostering a positive security culture through the application of policies and practices that embed security into agency operations.
31. The ASE must be empowered and resourced to make security related decisions including: 
    1. appointing security advisers (ASAs and ITSAs) within the agency
    2. agency protective security planning
    3. agency protective security practices and procedures
    4. investigating, responding to, and reporting on security incidents.

Responsibilities of the ASE

32. The ASE of the agency must:
    1. support the accountable authority to ensure the safety of all people (including contractors, visitors and clients), information and assets
    2. report directly to the accountable authority on security, including security incidents or matters
    3. appoint sufficient security personnel (including but not limited to ASAs and ITSAs) to perform the security functions of the agency and oversee performance of their security responsibilities (see Appointing security advisers).
    4. set the strategic direction for protective security planning and risk management (see SAPSF policy Security planning)
    5. embed security procedures that achieve the security outcomes of the SAPSF, consistent with all legislative and other policy requirements
    6. manage the agency’s response to security-related incidents or matters in accordance with agency security procedures
    7. embed security monitoring mechanisms across the agency to support investigating, responding and reporting on security incidents
    8. foster a positive security culture where employees are aware of and understand their security responsibilities and are empowered to manage security risks
    9. establish security performance measures to help determine effectiveness of security arrangements, identify new risks, counter risks above the agency’s tolerance and improved security maturity (see SAPSF policy Security monitoring)
    10. managing and disseminating security related information across the agency, including sharing threat-related information with staff when required
    11. oversee preparation of the agency’s SAPSF annual security attestation for approval by the accountable authority.

Security governance committee

33. It is recommended that the ASE establish and oversee (as chair) a security governance committee comprising relevant security personnel from within the agency. ^[6]
34. A security governance committee provides support to the accountable authority and ASE by:
    • providing a cohesive and coordinated approach to risk and security
    • fostering a positive security culture
    • contributing to longer-term agency security planning
    • monitoring existing security plans and identifying and managing risks
    • considering and reviewing the outcomes of security incidents and investigations
    • facilitating information sharing for security improvements.

^{[6] The ASE may determine that a security oversight committee is not required in line with the size and function of the agency}

35. The ASE is responsible for appointing security advisers (ASA and ITSA) for the agency. The ASE must appoint enough security advisers to account for the security requirements of the agency across the four protective security domains: governance, information (including ICT), personnel and physical. There is no maximum number of security advisers that can be appointed.
36. In making these decisions, the ASE must:
    1. consider the scope and responsibilities delegated to each position within the context of the agency’s risk environment and tolerance, size and function
    2. consider the appropriate arrangements for managing the responsibilities of all security advisers
    3. consider appointing security advisers at a level that requires only broad direction in terms of delivering objectives or the requirements of the SAPSF
    4. ensure delegations allow security advisers to undertake specific actions in line with the policies of the agency, or to review previous actions or decisions taken of relevance to security
    5. consider the appropriate competencies, experience, specialist skills or qualifications required to undertake the protective security requirements of the agency.

Agency Security Advisers

37. The ASE must appoint at least one ASA for the agency. An ASE may determine it is appropriate to appoint additional ASAs to functions, depending on the size and function of the agency. It is recommended any additional advisers are designated ‘Deputy ASA’.
38. An ASE may determine it is appropriate to delegate security functions to an ASA across multiple security domains, or to appoint multiple ASAs to functions within the same domain.
39. If the agency performs a diverse function, or has responsibilities across a diverse range of locations or operational environments, it may be more appropriate for the ASE to appoint security advisers at each location. ^[7]
40. The suggested security functions of ASAs are listed in Table 2 according to the four security domains.

Table 2 - Suggested functions of ASAs

Information Technology Security Advisers

41. The ASE must appoint at least one ITSA for the agency. An ASE may determine it is appropriate to appoint additional ITSAs to functions, depending on the size and function of the agency. It is recommended any additional advisers are designated ‘Deputy ITSA’.
42. If the agency performs a diverse function, or has responsibilities across a diverse range of locations or operational environments, it may be appropriate for the ASE to appoint ITSAs at each location.
43. The suggested security functions of ITSAs are listed in Table 3. Guideline 5 of the SACSF provides additional guidance on the roles and responsibilities of ITSAs.

Table 3 - Suggested functions of ITSAs

^{[7] If an agency’s arrangements result in the security adviser not reporting directly to the ASE, the ASE must maintain visibility of performance and outcomes of security responsibilities}

^{[8]Such as the Premier’s Circular PC012 Information Privacy Principles (IPPS) Instructions, on access to, disclosure or use of, personal information collected or received}

^{[9] Such as the SACSF and Premier’s Circular PC012 Information Privacy Principles (IPPS) Instructions (PDF, 643.3 KB)}

44. All agencies are required to have a security plan which establishes the strategic direction and sets the expectations for efficient and effective security management practices for the agency (for more information see SAPSF policy Security planning).
45. The ASE is responsible for establishing the strategic direction, allocating resources in line with the strategy and improving the security maturity of the agency.
46. Planning must incorporate developing practices and procedures that identify, manage and mitigate security risks and which enable the agency to continue to deliver effective and efficient government services.
47. Effective practices and procedures are those that are embedded into day-to-day operations, are well understood by all employees and demonstrated by senior management. Effective practices and procedures are also those which assist to identify changes to the risk environment, and can be updated accordingly.
48. Security practices and procedures must be designed to deliver the agency’s security plan which can in turn be useful in determining the agency’s security maturity and overall implementation of the SAPSF.

49. Effective management of security incidents reduces the consequences from threats, behaviours or events while reducing the likelihood that they will re-occur.
50. Agencies must implement practices and procedures to detect, respond, investigate and report security incidents. Furthermore, information gathered following a security incident will help to determine the effectiveness of existing agency protective security arrangements, assess agency security maturity and culture, and highlight any vulnerabilities.
51. A security incident is defined as:
    1. an action, whether deliberate, reckless, negligent or accidental that fails to meet protective security requirements or agency practices and procedures that results, or may result, in compromise to official information or resources
    2. an approach, from anybody seeking unauthorised access to official information or resources
    3. an observable occurrence or event ^[11] that can harm South Australian Government people, information or assets.
52. A significant security incident is a deliberate, negligent or reckless action that leads, or could lead, to compromise of official information or resources. Table 4 provides some examples of significant security incidents.

Table 4 – Security incidents

Detecting security incidents

53. Early detection of a security incident and timely response is critical to reducing the consequences from that incident. Establishing mechanisms to enable possible or actual security incidents to be communicated to agency security management in a timely manner is essential to effective security risk management.
54. Agencies must ensure that all employees understand when and how to report potential incidents or concerns. It is recommended that security incident reporting be included in agency security awareness training.
55. While reporting is a common means of detecting security incidents, it is recommended that ASEs consider other security monitoring measures to assist in identifying potential or actual security incidents.

Responding to security incidents

56. All agencies must establish procedures for managing security incidents. Incident management procedures should be consistent, appropriate and fair and be applicable to any security incident that may arise.
57. Table 5 provides some recommended elements to consider in developing incident management procedures.

Table 5 – Recommended incident management procedures

Investigating security incidents

58. ASEs must determine when a security incident is significant enough to warrant an investigation. Security incidents can be actual or suspected, and an investigation may be required to resolve an existing breach or vulnerability and reduce the impact or consequences. Investigations may also provide useful information for future risk assessments or reviews and will help to validate existing protective security arrangements within the agency.
59. A security investigation:
    1. is a formal process examining the cause and extent of the security incident that has, or could have, caused harm to individuals, the or another agency or the state or national interest
    2. gathers evidence that may be admissible for any subsequent action (criminal, civil penalty, civil, disciplinary or administrative sanctions)
    3. prevents re-occurrence of the incident by implementing improvements to the agency’s systems or procedures
    4. protects the interest of the South Australian Government and the rights of the affected individuals.
60. The ASE is responsible for ensuring the agency has procedures in place to conduct security investigations, when required. It is recommended that those procedures cover:
    1. terms of reference and the investigation plan (authorised by the accountable authority or ASE)
    2. responsibilities of the investigator, approving officer and other relevant parties
    3. qualifications and/or training required for investigators
    4. procedural fairness and standards of ethical behaviour to ensure impartiality and the absence of any conflicts-of-interest
    5. actions for handling complaints or allegations (including anonymous or public interest disclosure reports) ^[12]
    6. case management procedures to ensure compliance with the agency’s procedures
    7. procedures for undertaking operational practices (such as interviews of affected persons)
    8. points of referral, escalation or approval, including keeping the ASE notified of progress
    9. points of escalation to law enforcement or the Australian Security Intelligence Organisation (ASIO)
    10. findings and recommendations
    11. final report requirements.
61. The ASE is responsible for assessing the requirement for a formal security investigation. In assessing the incident, they must consider:
    1. the seriousness or complexity of the incident
    2. the possible outcomes of the investigation (administrative, disciplinary, civil or criminal)
    3. if the incident requires referral to another agency or authority
    4. the resources required to conduct the investigation
    5. who will conduct the investigation and what support they need
    6. the investigation process and timeframes
    7. the authorisation needed to undertake the investigation
    8. the decision-makers and subsequent reporting obligations
62. It is recommended that, where possible, agencies apply the Australian Government Investigations Standards (AGIS) to maintain a minimum quality standard within investigations.
63. When investigating, the principles of procedural fairness should be applied, such that any individuals being investigated or whose interests could be adversely affected, should be informed of the case against them and given the opportunity to be heard by an unbiased decision-maker. Procedural fairness should also be applied to any actions taken as a result of the investigation, as well as when considering the security integrity of current or future investigations by the, or another agency.

Reporting security incidents

64. In some instances, a security incident must be reported to another agency or authority, depending on the nature and severity of the incident. Table 6 outlines the obligations to report particular security incidents, and to whom they must be reported. Non-reporting of an incident is considered a security incident.

Table 6 – External reporting obligations

^{10 Removed reference}

^{11  E.g. natural disaster, terrorist attacks etc.}

^{12  See the Public Interest Disclosure Act 2018 for more information.}

^{13  As defined in the Australian Security Intelligence Organisation Act 1979 (Cth)}

^{14  ASIO will assist agencies to conduct an initial assessment of any potential compromise and will either recommend the agency continue with its own investigation and advise of the outcome, or take over the investigation in close consultation with the agency}

65. The policies of the SAPSF have been developed to ensure consistency with other South Australian security policy and in accordance with relevant state and federal legislation. If the agency identifies any conflict between the requirements of the SAPSF or other relevant security policy or legislation, agencies must notify the SAPSF team.
66. Agencies must comply with all relevant security policy or legislative requirements in undertaking the requirements of the SAPSF.
67. Agencies are required to be aware of any agency-specific legislation that must be applied in carrying out official duties, and the requirements of the SAPSF do not override any legislative requirements or any other security policy requirements.

68. Security awareness training is a critical component of building an agency’s security culture and overall security maturity.
69. Agencies must provide security awareness training to all employees upon commencement in the agency, and annually thereafter (via a security awareness refresher training), which outlines their agency-specific obligations and their responsibilities under the SAPSF. ASEs must determine the appropriate delivery method that ensures consistency across their agency for all employees, while ensuring all specific training or awareness requirements are met.
70. Employees in high-risk positions, positions of trust, security incident investigators or security clearance holders must be provided with specific security awareness training targeted to the scope and nature of their position.
71. Agency security plans should identify the most relevant areas of agency security that need to be addressed in the security awareness training.
72. Effective security awareness training is most effective when it:
    1. informs and regularly reminds employees of their individual and collective security responsibilities and how to raise issues or concerns
    2. ensures employees with specific security duties receive appropriate and up-to-date training
    3. briefs security cleared personnel on their access privileges and prohibitions attached to their security clearance level, either before being issued or during the renewal cycle
    4. fulfils requirements for security clearance holders

Content of security awareness training

73. Table 7 provides the recommended content for security awareness training.

Table 7 – Recommended content for security awareness training

Security awareness refresher training

74. ASEs must determine what form (e.g. in person, online), scope of coverage and content is required for the annual security training to meet the security needs of the agency, and the minimum requirements of the SAPSF.
75. The annual refresher training should consider the current threat or risk environment for the agency, the goals and objectives of agency security plans and any inadequacies of previous trainings or recurring security incidents.
76. The Security SA Teams site is a platform to share and repurpose resource material in relation to security in SA Government including governance, personnel security, information security, physical security and cyber security.
77. The site is jointly managed by Office for Cyber Security and Security, Emergency and Recovery Management in DPC. It is recommended that only ASEs, ASAs, ITSAs or staff with security responsibilities are given access to this site. In order to gain access to the site, approval must be provided from your ASE, ASA or ITSA to officeforcybersecurity@sa.gov.au or SAPSF@sa.gov.au.

Strengthening security awareness

78. Agencies may implement other measures to strengthen the security awareness of employees, including:
    1. security campaigns that address ongoing agency security needs
    2. security instructions and reminders via electronic bulletins or publications, such as visual displays or posters
    3. incorporating protective security competencies into employee selection processes or performance management programs
    4. drills and exercises.

^{[15] See Public Interest Disclosure Act 2018}

^{[16] It is recommended that any case studies are redacted to maintain appropriate confidentialities.}

79. To prevent agency security from becoming siloed, a monitored, generic security email address must be established for agency security-related matters, which can be monitored by ASEs, security advisers and other security personnel as required. This enables a greater flow of security related information within the agency while also creating a central contact in the agency for external communications with other agencies.
80. It is recommended that the agency’s security email address:
    1. take the form (or similar):
       1. [agencyname].security@sa.gov.au, or
       2. [agencyname].ASE@sa.gov.au
    2. be monitored by appropriate security personnel in the agency, including the ASE and security advisers
    3. provided to the SAPSF team and other relevant agencies to facilitate collaboration and communication
81. If an agency is unable to create a generic email address for security-related matters and relies on an individual’s email address, it is recommended that that email address be transferred to or monitored by other staff during extended periods of absence.
82. Agencies may establish multiple security-related email addresses if appropriate to control the flow of specific information, however, the main agency security address will be used for all SAPSF-related correspondence.

Change Log