(1) This Policy is effective from 4 October 2023. (2) This Policy documents the University's information and communications technology (ICT) security measures and outlines the framework to manage University information security and protect University assets and resources. (3) This Policy applies to students, staff and associates and where not already covered, to ICT facilities, services and materials owned, managed or leased by the University or as applicable by commercial or legal arrangement, including Bring your own device (BYOD). (4) The Chief Information and Digital Officer will ensure that sufficient and proportionate controls are implemented to adequately protect the University’s ICT facilities, services and materials and all data and information held electronically is protected from corruption, loss, unauthorised access and disclosure and unacceptable use. (5) An ICT Security Assessment must be conducted by Digital Services for any ICT facilities, services and materials involving external parties. A reassessment will be required regularly or if changes to the existing service alters the information security risk. (6) All ICT facilities, services and materials connected to or running on the Deakin University network will have an ICT facilities, services and materials owner accountable for ensuring appropriate security, in compliance with University policies and procedures. (7) Access to University ICT facilities and assets or information is controlled and monitored based upon job-related function and need-to-know criteria. ICT users will have access only to the ICT facilities, services and materials required to carry out activities that relate to the duties of their role. (8) The Chief Digital Officer will maintain a schedule that defines the ICT facilities, services and materials’ backup levels, and backups are regularly tested for restoration. (9) The Chief Information and Digital Officer will ensure that automatically generated logs of system, application and ICT user activity, and audit trails of changes to data, are kept to ensure proper management, risk assessment and security of ICT facilities, services and materials. (10) The Chief Information and Digital Officer or nominee may monitor and audit ICT user activity on the Deakin University network, in accordance with the Information and Communications Technology Acceptable Use procedure. (11) ICT system business owners, in consultation with Digital Services, must regularly assess the risk of unauthorised use, disclosure to unauthorised individuals, modification, or destruction of University information, assets, and resources and develop mitigation strategies. (12) The Chief Information and Digital Officer will designate a representative to receive and act on notifications of alleged breaches of security of ICT facilities, services and materials. (13) The Chief Information and Digital Officer will maintain the capability and document appropriate plans to respond to Critical IT Security Incidents (Cyber Incidents). Incidents which are categorised as Cyber Incidents will be managed via an agreed process which takes into consideration the unique requirements for privacy, confidentiality and legality. (14) The Chief Information and Digital Officer and their direct reports will ensure that students, staff and associates and other third parties are aware of and adhere to applicable University ICT policies, procedures and work instructions. (15) Any staff member or associate who becomes aware of any loss, compromise, or possible compromise of information, or any other incident which has ICT security implications, shall immediately inform the Digital Services Service Desk. (16) The Chief Information and Digital Officer or nominee will ensure security reviews of any new key ICT systems are conducted before implementation or implementing significant changes to an existing key system. The Chief Information and Digital Officer or nominee will ensure that key ICT systems are periodically reviewed. (17) Any exemption to this Policy must be approved by the Chief Information and Digital Officer. Exemption requests must set out the rationale, duration that the exemption is required and risks and any mitigating controls. The Chief Information and Digital Officer may approve the request for a set period or deny the request. (18) The Cyber Security Director is responsible for the regular review of exemptions and may: (19) There is no attendant Procedure. (20) For the purpose of this Policy:Information and Communications Technology Security policy
Section 1 - Preamble
Section 2 - Purpose
Section 3 - Scope
Section 4 - Policy
Top of PageSection 5 - Procedure
Section 6 - Definitions
View Current
This is the current version of this document. To view historic versions, click the link in the document's navigation bar.