Cyber Security Capability Framework & Mapping of ISM Roles - agimo

Introduction and BackgroundIn May 2010, Workplace Research Associates was engaged by the Australian GovernmentInformation Management Office (AGIMO) to assist in the mapping of Cyber SecurityCapabilities to the Australian Public Service Commission’s (APSC) ICT CapabilityFramework. Specifically, the aim of the project was to:• Map and validate the Department of Defence’s Development and CompetencyAssessment Framework (DeCAF) competencies to the security capability areasdefined in the Australian Public Service Commission’s ICT Capability Framework;• Map and validate the DeCAF competencies to the Chief Information Security Officer,IT Security Manager and IT Security Officer roles defined in the AustralianGovernment’s Information Security Manual (ISM);This report presents the Cyber Security Capability Framework, which is the outcome of thefirst of the aims above and the Mapped ISM Roles, which is the outcome of the second ofthe aims above.MethodologyThe methodology for the project included the following stages:Part 1 – Mapping of the DeCAF to the ICT Capability Framework:1. Initial meeting with AGIMO representatives to confirm the scope of the project andthe documents to be mapped;2. Review of the Department of Defence’s Development and Competency AssessmentFramework (DeCAF) and the Australian Public Service Commission’s ICT CapabilityFramework;3. Mapping of the DeCAF to the APSC’s ICT Capability Framework;4. A workshop to validate the initial mapping process and initial draft of the CyberSecurity Capability Framework;5. Review and redrafting of the Framework in line with the results of the workshop.Part 2 – Mapping of the ISM roles to the Cyber Security Capability Framework:1. Mapping of the Chief Information Security Officer, IT Security Advisor, IT SecurityManager and IT Security Officer roles to the Cyber Security Capability Framework.PART 1APSC ICT Capability FrameworkThe documents used to produce the Cyber Security Capability Framework included theAPSC’s ICT Capability Framework. This Framework has a two level structure with thefollowing main categories of capability:Produced for AGIMO by Workplace Research Associates Pty Ltd 2010 Page 3