Cyber Security Capability Framework & Mapping of ISM Roles - agimo

PART 2Australian Government Information Security ManualThe second part of the project was mapping of the Chief Information Security Officer, ITSecurity Manager and IT Security Officer roles from the Australian Government InformationSecurity Manual (ISM) to the competencies originally in the DeCAF, now embedded into theCyber Security Capability Framework.The ISM provides a framework that enables agencies to address both new and existingsecurity risks to systems. The manual sets down minimum requirements for informationsecurity and describes a number of roles within the security environment. These include thethree roles outlined for mapping:The target audience for this manual is information security practitioners within, or contractedto, an agency. This includes, but is not limited to:• security executives / chief information security officers (CISOs)• agency security advisors (ASAs)• information technology security advisors (ITSAs)• information technology security managers (ITSMs)• information technology security officers (ITSOs), and• infosec-registered assessors.The roles in the manual are described in terms of the context, risks and controls that shouldbe accounted for within the roles plus a rationale for appointing each of the roles.Mapping of the rolesAt the original workshop validating the DeCAF competencies mapped onto the APSC ICTCapabilities, workshop participants reported high consensus that the DeCAF documentdescribed competencies up to and including the EL2 level of classification. Therefore, theresultant Cyber Security Capability Framework did not extend to the SES level.Upon examination of the roles, it was noted that the Chief Information Security Officer roleshould be appointed at the Senior Executive Service level and is described as beingresponsible for co-ordination of security at a strategic level within the agency. Due to thehigh classification level of this role, it was decided that the role would not be mapped againstthe Capability Framework.The remaining three roles, the IT Security Advisor, the IT Security Manager and the ITSecurity Officer were mapped at the EL2 and EL1 levels. This process involved examinationof the responsibilities of each role as set out in the ISM and comparison of these with thosecompetencies previously mapped to the Cyber Security Capability Framework. Areas ofoverlap were noted and duplication avoided. Where new competencies were identifiedthese were included in the final mapping.As noted in Part 1, this document was then sent out for comment and feedback as part ofthe final consultation round of the Cyber Security Capability Framework. Feedback receivedwas incorporated into the final versions of the mapped roles which are presented below.Produced for AGIMO by Workplace Research Associates Pty Ltd 2010 Page 16