Department of Finance drafts cyber security clauses

Clauses will define service providers’ responsibilities when managing cyber security risks

Comments

The Australian Department of Finance is inviting feedback from the IT industry about draft cyber security clauses.

Department of Finance assistant secretary, Mundi Tomlinson, wrote in a that the cyber security clauses are designed to:

Define service provider’s and contractor’s responsibilities in order to manage cyber security risks
Provide clear contract arrangements for safeguarding government data
Increase the visibility of cyber security incidents

. The draft clause says the contractor must do all things that a “reasonable and prudent entity” would do to ensure that customer data is protected at all times from unauthorised access or use by a third party.

If a data breach occurs, the contractor must notify the customer in writing. It must also contact the Australian Cyber Security Centre, or other cyber security organisation such as AusCERT, as required by the customer.

The contractor would also need to obtain evidence about how the customer’s IT system was compromised and provide this to the customer on request.

Finally, the contractor will implement mitigation strategies to reduce the impact of future cyber security incidents.

According to Tomlinson, the cyber security clauses will be included in the Department of Finance’s SourceIT model contracts.

“The Commonwealth needs to have a way of managing cyber security risks that acknowledges the role of suppliers and subcontractors. These model clauses outline the Australian government’s preferred position,” Tomlinson said in a statement.

People can leave a comment on Tomlinson’s or email ICTprocurement@finance.gov.au The deadline for replies is 19 September, 2014.

Follow Hamish Barwick on Twitter: @HamishBarwick

Follow CIO Australia on Twitter and Like us on Facebook… Twitter: @CIO_Australia, Facebook: CIO Australia, or take part in the CIO conversation on LinkedIn: CIO Australia