Embed Size (px)
Citation preview
Physical Security Management Guidelines Physical security of ICT equipment, systems and
facilities
Approved 27 October 2011
Version 1.0
i
© Commonwealth of Australia 2011
All material presented in this publication is provided under a Creative Commons Attribution 3.0 Australia (http://creativecommons.org/licenses/by/3.0/au/deed.en ) licence.
For the avoidance of doubt, this means this licence only applies to material as set out in this document.
The details of the relevant licence conditions are available on the Creative Commons website (accessible using the links provided) as is the full legal code for the CC BY 3.0 AU licence (http://creativecommons.org/licenses/by/3.0/legalcode ).
Use of the Coat of Arms
The terms under which the Coat of Arms can be used are detailed on the It's an Honour (http://www.itsanhonour.gov.au/coat-arms/index.cfm) website.
Contact us
Inquiries regarding the licence and any use of this document are welcome at:
Business Law Branch Attorney-General’s Department 3-5 National Cct BARTON ACT 2600
Telephone: (02) 6141 6666
Document details
Security classification Unclassified
Dissemination limiting marking Publicly available
Date of security classification review July 2013
Authority Protective Security Policy Committee
Author
Protective Security Policy Section
Attorney-General’s Department
Document status
Approved by PSPC 27 October 2011
ii
Table of Contents
1. Introduction ............................................................................................................................... 1
1.1 Purpose ......................................................................................................................................... 1
1.2 Audience ....................................................................................................................................... 1
1.3 Scope ............................................................................................................................................. 1
1.3.1 Use of specific terms in these guidelines .............................................................................. 1
2. Background ................................................................................................................................ 3
2.1 Why were the guidelines developed? .......................................................................................... 3
2.2 Relationship to other documents ................................................................................................. 3
2.3 How are the guidelines structured? ............................................................................................. 4
3. Physical security of ICT equipment .............................................................................................. 5
3.1 Storage of ICT equipment when not in use .................................................................................. 5
3.2 Security of ICT equipment that cannot be kept in security containers or rooms when not in use ...................................................................................................................................................... 5
3.2.1 Equipment with solid state drives or hybrid hard drives ...................................................... 6
3.3 Auditing of ICT equipment ............................................................................................................ 6
3.3.1 Tamper evident seals ............................................................................................................ 6
4. Physical security of ICT system equipment .................................................................................. 7
4.1 Physical security of servers and network devices ......................................................................... 7
4.2 Network Infrastructure ................................................................................................................. 7
4.3 Deployable ICT systems ................................................................................................................ 8
4.4 ICT system gateway devices ......................................................................................................... 8
5. Physical security of ICT facilities .................................................................................................. 9
5.1 Accreditation of ICT facilities ........................................................................................................ 9
5.1.1 TOP SECRET or codeword information ICT facilities ............................................................. 9
5.2 Access control to ICT facilities and equipment within ICT facilities............................................ 11
5.2.1 Technical surveillance counter-measures ........................................................................... 11
5.3 Outsourced ICT facilities ............................................................................................................. 11
5.3.1 Gateway facilities ................................................................................................................ 11
5.3.2 Datacentres ......................................................................................................................... 12
6. Protection of information and ICT equipment against environmental or man-made threats ....... 13
6.1 Preservation of ICT equipment ................................................................................................... 13
6.1.1 Uninterruptable and auxiliary power supplies .................................................................... 13
6.2 Protection from environmental or man-made disasters ............................................................ 14
6.2.1 Flooding ............................................................................................................................... 14
6.2.2 Fire ....................................................................................................................................... 14
6.3 Backup ICT systems ..................................................................................................................... 14
iii
Amendments No. Location Amendment
1
1. Introduction
1.1 Purpose
The Australian Government physical security management guidelines–Physical security of ICT (information and communications technology) equipment, systems and facilities provide guidance to achieve a consistent approach to determining physical security controls for ICT equipment, systems and facilities holding Australian Government information.
1.2 Audience
These guidelines are intended for:
Australian Government security management staff
Australian Government ICT security management staff
contractors to the Australian Government providing physical security advice and services
providers of facilities for Australian Government ICT services and functions, and
any other body or person responsible for the security of Australian Government people, information or physical assets.
1.3 Scope
These guidelines relate to physical security measures of ICT equipment, systems and facilities within:
Australian Government agencies, or
other entities handling Australian Government official information.
In the absence of specific advice in these guidelines agencies should refer to SAI Global - AS/NZS ISO/IEC 27002:2006 Information Technology–Security techniques–Code of practice for information security management, Section 9 – Physical and environmental security.
Note: Where legislative requirements prescribe higher controls than those identified in these guidelines the legislative controls take precedence and are to be applied.
Agencies are to protect any information provided by another government in accordance with international agreements, see PSPF Governance Arrangements–4.10 International security agreements.
These guidelines include advice on the Australian Government’s expectations for the protection of Australian information by foreign governments.
1.3.1 Use of specific terms in these guidelines
In these guidelines the use of the terms:
‘need to’ refers to a legislative requirement that agencies must meet
‘are required to’ or ‘is required to’ refers to a control:
- to which agencies cannot give a policy exception, or
- used in other protective security documents that set controls.
2
‘are to’ or ‘is to’ are directions required to support compliance with the mandatory requirements of the physical security core policy, and
‘should’ refers to better practice, agencies are expected to apply better practice unless there is a reason based on their risk assessment to apply alternative controls.
For details on policy exceptions see the PSPF - Australian Government physical security management protocol (section 1.4).
The following terms are also used in these guidelines:
Aggregation—compilations of official information that may require a higher level of protection than their component parts. This is because the combination generates a greater value, and the consequence of compromise, loss of integrity, or unavailability creates an increase in the business impact level.
Availability—the ability of an agency to make information available to conduct its normal business within a predetermined maximum acceptable outage based on the criticality of the information, see Australian Standard HB 292-2006 A practitioner’s guide to business continuity management section 4.7 for further information.
ICT equipment—any device that can process, store or communicate electronic information—for example, computers, multifunction devices, landline and mobile phones, digital cameras, electronic storage media and other radio devices.
- ICT system equipment—a subset of ICT equipment that is used to maintain an ICT system— for example, servers, communications network devices such as PABX, gateways and network infrastructure such as cabling and patch panels—this equipment is normally continuously operational.
ICT facility—a building, a floor of a building or a designated space on the floor of a building used to house or process large quantities of data; for example, server and gateway rooms, datacentres, back up repositories, storage areas for ICT equipment, and communications and patch rooms.
ICT system— a related set of hardware and software used for the processing, storage or communication of information and the governance framework in which it operates.
Network infrastructure—the infrastructure used to carry information between workstations and servers or other network devices. For example: cabling, junction boxes, patch panels, fibre distribution panels and structured wiring enclosures.
Security container or room—Security Construction and Equipment Committee (SCEC) approved A, B or C class container or room, see PSPF - Australian Government physical security management guidelines–Security zones and risk mitigation control measures Section 5.13 and 5.14.
3
2. Background
2.1 Why were the guidelines developed?
The Australian Government physical security management guidelines–Physical security of ICT equipment, systems and facilities provide a consistent and structured approach to determining:
the level of control required to:
- meet the assessed risk
- give suitable protection to information
- provide assurance to other agencies for information sharing, and
the types of controls that are suitable.
The guidelines will:
establish consistent terminology for physical security of ICT equipment, systems and facilities holding Australian Government official information, and
give agencies a framework for the assurance needed to share information.
These guidelines recognise that the predominant risks to electronic information (whether held in ICT equipment, systems or facilities) are from:
external cyber attack—the minimum mandatory logical controls to counter cyber attacks are detailed in the ISM, and
trusted insiders—including, but not limited to disgruntled or inexperienced users, contractors, and administrators.
The theft or loss of ICT equipment is another risk to electronic information.
The controls identified in the ISM are used to mitigate threats to confidentiality, integrity and availability of information held on ICT equipment. Physical security measures also mitigate these risks by restricting access to people with a genuine need to know.
Agencies should develop procedures to minimise the risk of oversight of information on their ICT equipment.
2.2 Relationship to other documents
These guidelines support the implementation of the Protective Security Policy Framework (PSPF). They are part of a suite of documents that aid agencies to meet their physical security requirements. In particular, they support and should be read in conjunction with the:
PSPF - Australian Government physical security management protocol, in particular Section 8
PSPF - Australian Government physical security management guidelines–Security zones and risk mitigation control measures
PSPF - Australian Government protective Security governance guidelines–Business impact levels
PSPF - Australian Government information management protocol, and
Defence Signals Directorate (DSD) publication the Australian Government information security manual (ISM)
4
2.3 How are the guidelines structured?
These guidelines are broadly divided into the following sections:
physical security of:
- ICT equipment
- ICT systems
- ICT facilities, and
protection of information and ICT equipment from environmental or man-made threats.
5
3. Physical security of ICT equipment
The primary purpose of ICT equipment is to facilitate the processing storage and communication of agency information electronically.
ICT equipment that requires protection includes any device which can store information electronically, such as:
computers—desktop, laptop or tablet
photocopiers, multi function devices (MFDs) and printers
fax machines
mobile telephones
digital cameras
personal electronic devices, and
storage media–for example, portable hard drives, USB sticks, CDs, DVDs, RFID tags and systems.
The level of protection that should be given to ICT equipment is based on the higher of:
business impact level that would result from the compromise, loss of integrity or unavailability of the aggregate of electronic information held on the equipment, or
the loss/ unavailability of the ICT equipment itself.
See the PSPF - Australian Government protective security governance guidelines–Business impact levels.
3.1 Storage of ICT equipment when not in use
When ICT equipment is stored in dedicated Physical security of ICT facilities the physical security controls should meet those detailed in Table 1–Storage requirements for electronic information in ICT facilities.
Where ICT equipment is not stored in dedicated ICT facilities agencies should apply the physical security controls detailed in the PSPF - Australian Government physical security management guidelines–Security zones and risk mitigation control measures.
The physical security controls used are to meet either the requirements of Table 1 or the guidelines as appropriate, or exceed those required when justified by the agency security risk assessment.
Where agencies cannot meet the above requirement they are to seek advice from DSD on additional logical or technological solutions that may be available to lower the risks to electronic information when the equipment is not in use. (See below.)
3.2 Security of ICT equipment that cannot be kept in security containers or rooms when not in use
Agencies may not be able to secure some electronic equipment in security containers or rooms when not in use–for example, desktop computers, printers, MFDs.
In some circumstances agencies may be able to fit removable non-volatile media (hard-drives) that can then be secured in an appropriate security container when not in use.
6
In cases where the non-volatile media cannot be removed agencies should determine the Zone where the equipment can be kept based on the risks of obtaining information, and the sensitivity of the information attainable, from the equipment. Agencies should seek further advice from DSD on additional logical or technological solutions that may be available to lower the risks to electronic information.
Agencies should assess the risk when equipment cannot be secured when not in use, where its compromise could cause loss of integrity or availability of the information held by or accessible through that equipment. Where the business impact of the compromise, loss of integrity or unavailability of the information is very high or extreme, the equipment is to be stored in a Zone Three or above area unless additional logical controls are applied to lower the risks when not in use to a level acceptable to the agency.
Where the business impact of the compromise, loss of integrity or unavailability of the information is catastrophic, the equipment is to be stored in a Zone Five area unless additional logical controls are applied to lower the risks when not in use to a level acceptable to the information originator.
The logical controls described in the ISM do not constitute sanitisation and reclassification of ICT media. Therefore, the media retains its classification for the purposes of reuse, reclassification, declassification, sanitisation, destruction and disposal as specified in the ISM.
3.2.1 Equipment with solid state drives or hybrid hard drives
Solid state drives and hybrid hard drives cannot be made safe through normal wiping processes when switched off. Agencies wishing to use equipment fitted with solid state drives or hybrid hard drives should seek advice from DSD on other methods of securing these types of equipment–for example, encryption.
3.3 Auditing of ICT equipment
For asset control of ICT equipment, agencies should:
record the location and authorised custodian, and
periodically audit.
The period between audits should be based on the agency’s risk assessment with higher risk items audited on a more regular basis.
Agencies should, based on their risk assessment, consider visually inspecting ICT equipment as part of their asset control audit to ensure that non-approved devices have not been installed.
Agencies are to have procedures for employees to report the loss of ICT equipment.
3.3.1 Tamper evident seals
Agencies may seal access to ICT equipment using Security Construction and Equipment Committee (SCEC) approved tamper evident wafer seals suitable for application to hard surfaces. The use of seals may give a visual indication of unauthorised access into the equipment if the seals are removed or broken.
Agencies should refer to the SCEC Security Equipment Catalogue when selecting wafer seals.
7
4. Physical security of ICT system equipment
In addition to the ICT equipment mentioned in Section 3, ICT system equipment that needs physical security includes:
servers—including dedicated devices and laptops used as servers
other communications network devices—for example, PABX
the supporting network infrastructure—for example, cabling, patch panels, and
gateway devices—for example routers, network access devices.
4.1 Physical security of servers and network devices
Servers and network devices are to be located in security rooms/containers. The level of room/container used should be determined by the business impact of the compromise, loss of integrity or unavailability of the aggregated information accessible from the servers and network devices.
Agencies should keep servers and communication network devices in dedicated Physical security of ICT facilities.
Agencies are required to apply the controls identified in the PSPF - Australian Government physical security management guidelines–Security zones and risk mitigation control measures to protect the information on the servers and network devices not held in dedicated ICT facilities.
4.2 Network Infrastructure
Agency information is communicated through network infrastructure.
Where DSD approved encryption is applied the requirements for physical security of network infrastructure can be lowered. Agencies should protect network infrastructure using a mixture of physical security measures and encryption.
Agencies are to use Security Zones suitable for the highest business impact of the compromise, loss of integrity or unavailability of information being communicated over the network infrastructure. As it may not be possible to secure all network infrastructure in security containers/rooms agencies are also to meet any system encryption requirements in the ISM.
Agencies should determine the level of container required for patch panels, fibre distribution panels and structured wiring enclosures based on:
the business impact of the information passing over the connections, and
any other controls in place to protect the information.
Panels should at a minimum be in locked containers/rooms to prevent tampering.
Agencies lose control of their information when it is communicated over unsecured public network infrastructure or over infrastructure in unsecured areas as they can have no assurance of the physical security of the infrastructure or logical security of the information.
Agencies are required to use the encryption standards identified in the ISM for information transmitted over public network infrastructure when the compromise, loss of integrity or
8
unavailability of the information would have a business impact of high or above. The encryption will sufficiently protect the information to allow it to be transmitted on an unclassified network. Encryption is normally applied at an agency gateway.
Agencies are also required to apply the encryption standards identified in the ISM to protect information on their network infrastructure in unsecured areas.
4.3 Deployable ICT systems
Agencies may have difficulty in applying suitable physical security measures when using deployable ICT systems, particularly if deployed into high risk environments. Agencies that use deployable systems are required to seek advice from DSD on suitable logical controls to help mitigate any risks they identify.
4.4 ICT system gateway devices
In addition to the logical controls required in the ISM, agencies are to use physical security measures for their ICT system gateway devices to mitigate the higher business impact from:
the loss of the devices, or
the compromise of the aggregated information arising from physical access to the devices. Agencies using shared gateways are to apply controls to the gateway appropriate to the highest level of information passing through the gateway.
Agencies are to prevent unauthorised access to gateway devices. It is recommended that these devices be located in dedicated Physical security of ICT facilities.
9
5. Physical security of ICT facilities
Agencies may use dedicated ICT facilities to house ICT systems, components of their ICT Systems or ICT equipment. These facilities include, but are not limited to:
server and gateway rooms
datacentres
backup repositories
storage areas for ICT equipment that hold official information, and
communications and patch rooms.
Agencies should pay particular attention to the security of any access points to an ICT facility—for example, cabling and ducting.
5.1 Accreditation of ICT facilities
ICT facilities are required to be within accredited Security Zones, as detailed in the PSPF - Australian Government physical security management guidelines–Security zones and risk mitigation control measures, appropriate for the aggregation of the information held.
Also agencies should house ICT facilities in Security Zones dedicated to these ICT facilities, separate to other agency functions.
Where an agency outsources its ICT facilities, or uses shared facilities, the agency is required to ensure their information is held in a Security Zone appropriate for the aggregation of information, see Outsourced ICT facilities.
Containers used to house ICT equipment in an ICT facility may be at a lower level when the ICT facility is a separate Security Zone within an existing Security Zone that is suitable for the aggregation of the information held. See Table 1–Storage requirements for electronic information in ICT facilities.
5.1.1 TOP SECRET or codeword information ICT facilities
All TOP SECRET or codeword information ICT facilities are to be in a separate Zone Five within a Zone Five work area, both of which are to be certified by ASIO-T4. TOP SECRET ICT facilities are to have either a separate zone on the agency EACS and SCEC approved Type 1 SAS, or have their own SCEC approved Type 1 SAS. In addition agencies are required to have DSD to certify all TOP SECRET ICT systems.
10
Table 1–Storage requirements for electronic information in ICT facilities
The physical security containers/rooms required for holding ICT equipment can sometimes be lowered according to the following table when ICT facilities are located in an additional Security Zone within the work area Security Zone. Zone One is not to be used for ICT facilities with an aggregation of information with a business impact level of high or above. The table below details the impact of applying the ‘Security-in-Depth’ principle and provides the revised physical security standard required.
Business impact level of aggregations of electronic information
Security Zone of the agency’s work area
Security container or room
1 ordinarily
required
Additional Security Zone within work area for ICT facility
Security container or room
1 required for ICT
equipment
Catastrophic business impact level
Zone Five (Must be certified by ASIO-T4)
Class B Zone Five (Must be certified by ASIO-T4)
Class C
Extreme business impact level
Zone Four Class C Zone Four or above Lockable commercial cabinets
Zone Two Class C
Zone Three Class B Zone Four or above Lockable commercial cabinets
Zone Three Class C
Zone Two Class B
Very high business impact level
Zone Four Class C recommended
Zone Two or above Lockable commercial cabinets
Zone Three Class C Zone Three or above
Lockable commercial cabinets
Zone Two Class C
Zone Two Class B Zone Four or above Lockable commercial cabinets
Zone Three Class C
Zone Two Class B
High business impact level Zone Three or above
Lockable commercial cabinets
No additional zone required
Lockable commercial cabinets
Zone Two Class C Zone Three or above
Lockable commercial cabinets
Zone Two Class C
Medium business impact level or below
Zone Two Lockable commercial cabinets
No additional zone required
Lockable commercial cabinets
Zone One Class C Zone Two or above Lockable commercial cabinets
Note: 1. Lockable commercial cabinets should be used within security rooms to give additional access control to individual pieces of equipment.
11
5.2 Access control to ICT facilities and equipment within ICT facilities
Agencies are to control access to ICT facilities in accordance with the PSPF - Australian Government physical security guidelines–Security Zones and risk mitigation measures, Section 5.5—Access control and Section 5.7—Visitor control.
Access to agency ICT facilities holding information, the compromise, loss of integrity or unavailability of which has a lower than catastrophic business impact level should be controlled by:
a dedicated section of the security alarm system (SAS), or electronic access control system (EACS) where used, or
a person provided with a list of people with a ‘need to know’ or ‘need to go’ into the ICT facility. Agencies are to keep ICT facilities, and security containers within ICT facilities holding ICT equipment, secured when the facilities are not occupied.
Agencies may, if warranted by their risk assessment, use ‘no-lone-zones’ or ‘dual authentification’ as an additional control for ICT facilities.
5.2.1 Technical surveillance counter-measures
Agencies are to have a Technical Surveillance Counter Measures (TSCM) inspection undertaken for all TOP SECRET and Codeword ICT facilities where regular TS discussions are held within the facility.
A TSCM inspection may also be required to provide a high level of assurance that hardware and cabling infrastructure within an ICT facility has not been compromised.
Where an agency does not regularly require its ICT facilities to handle TOP SECRET information, the requirement for a TSCM inspection, and the interval between inspections, should be based on the agency’s risk assessment, see the PSPF - Australian Government physical security guidelines–Security Zones and risk mitigation measures, Section 5.15.4—Technical surveillance counter measures and audio security.
Agency security advisers should seek further advice from ASIO-T4 - [email protected].
5.3 Outsourced ICT facilities
Agencies are to ensure that outsourced ICT facilities meet any controls identified in these guidelines for the protection of the aggregation of information held in the facilities. Information on the inclusion of security requirements in contracts for outsourced functions is available in the PSPF - Australian Government governance guidelines–Security in outsourced services and functions.
5.3.1 Gateway facilities
ASIO-T4 will certify the physical security measures in DSD certified commercial gateway facilities intended for use by multiple Australian Government agencies as listed in the AGIMO Internet Gateway Reduction Program before being used operationally.
Agencies are to seek ASIO-T4 advice on the certification requirements of the physical security measures of any other commercial gateway facilities holding Australian Government official information where the compromise of the confidentiality, loss of integrity or unavailability of the information will have a catastrophic business impact level before being used operationally.
12
Gateway devices are to be given protection commensurate with the business impact of the compromise of the aggregate of the information protected by the devices.
5.3.2 Datacentres
Agencies are to seek ASIO-T4 advice on the certification requirements of the physical security measures of commercial datacentres holding Australian Government official information where the compromise of the confidentiality, loss of integrity or unavailability of the information will have a catastrophic business impact level before being used operationally.
Agencies using datacentres are to assess the aggregation of all official information that is held in the datacentre. Agencies employing a shared datacentre arrangement are to liaise with all other agencies using the same datacentre to assess the business impact of the loss of integrity or unavailability of the aggregate of the combined information before being used operationally.
Data storage devices are to be given protection commensurate with the business impact of the compromise of the aggregate of the information stored on the devices.
Datacentres are selected not only for their ability to provide security of information, but also for their ability to provide continuous availability to information. ANSI/TIA-942 Telecommunications Infrastructure Standard for Data Centers provides four tiers of availability in datacentres. Datacentres that comply with the Standard are available more than 99% of the time.
13
6. Protection of information and ICT equipment against environmental or man-made threats
Some information held on ICT systems will be required by agencies to enable a return to normal service after an incident. Agencies should determine the availability requirements for their information as part of their disaster recovery and business continuity plans. The impact of the information not being available will influence the measures taken to protect ICT equipment against environmental and man-made threats.
For further information see:
PSPF – Governance – Business continuity management, and
SAI Global - HB 292-2006 A practitioner’s guide to business continuity management, section 4.7.
6.1 Preservation of ICT equipment
ICT equipment may require a controlled atmosphere to ensure the integrity of the information held on the equipment. ICT equipment holding information may also require a controlled environment to prevent failure of the equipment and potential loss of information. This may include, but not limited to, controlling:
temperature
humidity
air quality—for example smoke and dust
water, or
light.
Agencies should apply controls to meet any ICT equipment manufacturer’s identified requirements.
Advice on preserving electronic information for the future is available from the National Archives of Australia.
6.1.1 Uninterruptable and auxiliary power supplies
Agencies may lose information if ICT systems are unexpectedly shutdown. An uninterruptable power supply (UPS) will allow the agency to turn off systems in a controlled manner or provide power until power to the ICT system is restored.
Any UPS used by an agency should provide at least enough power to allow:
the controlled shutdown of ICT systems, or
the startup of an auxiliary power supply.
ICT equipment also needs protection from power surges (relatively lengthy increases in voltage), power sags and spikes (short very large increases in voltage). Most UPS also give some protection from surges and sags.
As most environmental systems rely on mains electricity an auxiliary power supply may assist in maintaining environmental controls. Auxiliary power supplies should be maintained in accordance with the manufacturer’s directions.
14
6.2 Protection from environmental or man-made disasters
Agencies should identify any threats from environmental or man-made disasters to their ICT equipment in their security risk assessment. As ICT systems may be more sensitive to environmental factors additional risk mitigation measures, over and above those used to protect people and physical assets from harm, may be needed.
6.2.1 Flooding
Water is one of the major threats to any system that uses electricity, including ICT systems. Agencies should site server rooms so that they are protected from flooding. Flooding may be from external sources—for example swollen rivers, or internal sources—for example burst pipes. Agencies considering locating server rooms in basements should assess the risk of flooding from external or internal sources.
6.2.2 Fire
Agencies should also protect ICT equipment from fire. ICT equipment can be damaged either through direct exposure to flames, or the effects of smoke (poor air quality) and increases in temperature in the general environment.
An additional concern to ICT equipment during building fires is the potential for flooding during fire fighting operations. An agency may be able to use alternatives to water-based sprinkler systems, such as CO2 or other gaseous agents, in critical ICT facilities. An agency’s decision to use alternatives should be based on the agency’s own risk assessment.
6.3 Backup ICT systems
Backup ICT systems can provide an agency with a recover point if their primary ICT systems fail, which can form part of an agency’s business continuity and disaster recovery plans. Any backup systems should be, as far as possible, fully independent of the supporting infrastructure used for the primary system so that in case of a failure of the primary ICT system the secondary ICT system does not also fail.
Backup ICT systems should be regularly tested to ensure their continued operation.
Agencies may use off-site or commercial backup facilities. Agencies should consider dual redundancy—that is using two backup facilities, for business critical information and ICT systems.
Agencies are required to ensure any commercial ICT facilities they use meet all the security requirements of the PSPF and ISM to protect Australian Government information. An agency that uses a commercial back up facility should consider the aggregation of information held in the facility, not just the agency’s information, when determining the levels of physical and logical security needed at the facility.
Information on the inclusion of security requirements in contracts for outsourced functions is available in the PSPF - Australian Government governance guidelines–Security in outsourced functions.
