• ^{It is a known and effective tool to use people (including contractors) with access to an agency’s information or resources to obtain that information for purposes not in the interests of the agency, South Australian or the nation more broadly}
• ^{Australia, and South Australia more specifically, is an attractive target for exploitation given its prominent role in the Asia-Pacific region, its strong diplomatic ties with other nations and its resource, energy, defence and cyber sectors particularly}
• ^{Compromise of an agency’s information or resources could be used to gain economic, diplomatic or political advantage against South Australia or Australia (e.g. intellectual property, financial records, ICT system design). Personal information can also be used for malicious activities through social engineering}
• ^{State-sponsored actors (e.g. foreign intelligence services) work on behalf of foreign government or entities to intentionally infiltrate, compromise, steal or manipulate information which can have a detrimental impact on state and national security and commercial sectors (e.g. resources, financial, telecommunications)}
• ^{Technical capabilities are becoming more sophisticated and easier to use. The potential high gains to be made from targeting vulnerable sectors or systems may increase the risk of insider threat to agencies}

• ^{Agencies may engage multiple contractors, or a contractor may engage multiple subcontractors as part of the supply chain. The more parties are subject to any procurement or service provision, the greater or more complex the risk becomes}
• ^{It is recommended to:}
  • ^{consider the security risks of each contracted provider independently and holistically}
  • ^{reduce vulnerabilities and ensure security continuity to manage risks along the entire supply chain}

• ^{Arrangements where resources are made or held outside of Australia (by the contractor or a subcontractor) may have additional risks. For example, services located offshore are subject to laws of those countries and may be subject to lawful and covert collection}

• ^{Tolerance (legal and law enforcement effectiveness) and acceptance of corruption and crime can be vastly different in other countries}
• ^{Foreign enterprises may be owned, influenced or funded by foreign governments}
• ^{A lack of visibility into the contractor’s or services providers’ corporate structure, funding or use of non-reciprocating safe harbours}
• ^{Extrajudicial behaviours of foreign governments may give rise to further risks that need consideration. The lack of the rule of law may lead to attempts to misappropriate information or assets (including by organised crime)}

• ^{Information or assets may be subject to the laws of multiple jurisdictions. This might occur when:}
  • ^{Foreign laws apply to a contractor due to it being located offshore (sometimes in multiple locations)}
  • ^{Foreign laws have extra-territorial application to a contractor located in Australia}
  • ^{Goods or services transit through a third-party foreign jurisdiction}
• ^{Most foreign jurisdictions have legislative powers that allow access to assets, communications and stored information for purposes of law enforcement and national security. In some circumstances, international law enforcement or national security agencies can access information held overseas or in Australia}
• ^{Contractors should provide assurances that any information they handle will align to the agency’s risk tolerances and be managed securely}

^{Governance arrangements include provision for agencies to:}

• ^{amend (or terminate) a contract where issues of security concern arise (e.g. change of ownership to a non-approved entity, suspected or actual security breaches)}
• ^{monitor ongoing contracts through all levels of subcontractors and supply chains}
• ^{manage changes to the provision of goods or services}
• ^{terminate the contract where the contractor fails or refuses to comply with the security terms and conditions, or mitigate security incidents}

^{That require the primary contractor to:}

• ^{notify of actual or suspected security incidents (particularly those involving security cleared personnel) and follow the directions of the agency in relation to investigations and outcomes (including other affected agencies or entities) (see the South Australian Protective Security Policy Framework (SAPSF) policy Security governance for more detail on reporting security incidents)}
• ^{take reasonable steps to prevent, detect and respond to fraud and corruption}
• ^{implement security measures to identify, manage, monitor and review security risks to the information or assets provided by the agency, including protecting them from compromise at all times}
• ^{periodically review security measures under the contract to ensure the arrangements are current and address the risks, threat, vulnerabilities or criticalities}
• ^{be responsible for managing and monitoring the protective security compliance of its subcontractors and supply chain arrangements, including regular security awareness training}

• ^{Information  handling controls and storage arrangements for sensitive and security classified information must be consistent with the requirements of the SAPSF}
• ^{Contractors must   be able to demonstrate they are capable of handling or storing the agency’s information securely}
• ^{Ensure   information assets remain the property of the South Australian Government,   (including being returned and/or deleted upon completion or termination of the contract) and must only be used for the purposes outlines in the contract}
• ^{No service requiring access to official information, including security classified information, can be subcontracted without the approval of the agency}
• ^{Address any legal rights that a third-party may have over the contractor that could allow access to the agency’s information}
• ^{Ensure that the requirements of SACSF Ruling 2 Government information in outsourced and offshore ICT arrangements are applied when considering outsourced arrangements where government information may be stored or processed offshore}
• ^{Ensure the contractor notifies the agency if they discover or suspect that sensitive or security classified information has been, or will be, transferred overseas   without approval from the agency in writing}
• ^{Ensure  information removal from data centres where ownership of contractor is transferred to a foreign entity}
• ^{Contractors must notify notify Cyber Security in the Office of the Chief Information Officer for actual or suspected cyber  threats or attacks as per PC042 – Cyber Security Incident Management}

^{Office of the Chief Information Officer} 

^{Department of the Premier and Cabinet}

^{E: watchdesk@sa.gov.au}

^{P: 1300 244 168}

• ^{Contracted personnel should meet the requirements of SAPSF policy Recruiting employees, including identity, eligibility and suitability requirements}
• ^{Security clearance requirements must be applied to contractors as the agency would to its employees. The agency is responsible for managing any security clearance throughout the term of the contract}
• ^{Any contractors without the correct security clearances must not be given unescorted access to areas where security classified information is handled or stored or access/administrator rights to systems which hold or process security classified information}
• ^{It is recommended to have all contractors sign confidentiality or non-disclosure agreements if they will be accessing official government information}
• ^{The contractor must seek written approval from the agency to share the agency’s information to any third parties}
• ^{Provisions for revoking physical and ICT access when personnel from the contractor exit the company or role}
• ^{Reminding departing personnel of their ongoing security obligations}

• ^{Physical security measures must be consistent with the requirements of the SAPSF for all sites or locations where South Australian or Australian Government}
• ^{Contractors must be able to demonstrate they have the appropriate physical protections to protect information, or assets holding information (including ICT assets)}

^{Table 2 – Recommended terms and conditions updated:}

^{Reference to SACSF Ruling 2 regarding outsourcing and offshoring of ICT arrangement added}