Cyber Security Capability Framework & Mapping of ISM Roles - agimo

INFORMATION TECHNOLOGY SECURITY OFFICEROverview of the roleStaff in this role work report directly to the Information Technology Security Manager (ITSM). The ITSO role may be combined with that of the ITSM in small agencies.Agencies may also chose to have this role performed by existing system administrators with an additional reporting chain to an ITSM for the information security aspects oftheir role. Agencies may also choose to have the responsibilities of an ITSO undertaken externally as part of outsourcing of their ICT services.ITSOs should not have additional responsibilities beyond those needed to fulfil the role and the role should be undertaken by personnel with an appropriate level of authoritybased on the size of the agency or their area of responsibility within an agency. Where an ITSO is appointed by the agency, it would be expected that this position would beas an Executive Level 1 officer.ITSOs must be cleared for access to all information processed by the agency’s systems and able to be briefed into any compartmented information on the agency’ssystems.Required capabilitiesService DeliverySupports System Security1. Reviews information systems for actual or potential breaches in security andensures that all identified breaches in security are promptly and thoroughlyinvestigated.2. Ensures that security records are accurate and complete including certificationdocumentation.3. Validates and authorises user and access administration on systems inaccordance with the defined policies, standards and procedures of the agency.4. Ensures patches are applied and removes known system weaknesses inaccordance with information security policies and standards.Delivers Service Excellence1. Develops and manages customer service performance requirements forinformation security2. Assists operational staff to locate and repair information security problems andfailures.Leads and Develops People1. Provides direction to system developers regarding correction of security problems identifiedduring testing.2. Provides on the job training and coaching for team members.Supports Shared Purpose and Direction1. Drafts and maintains the policy, standards, procedures and documentation for security.2. Interprets security policy and contributes to development of standards and guidelines thatcomply with this.3. Monitors contract performance and reviews deliverables and contract requirements related toorganisational information technology security and privacy.4. Communicates with system owners and personnel to increase their awareness of applicableinformation security policies and standards.Produced for AGIMO by Workplace Research Associates Pty Ltd 2010 Page 19