ICT Information Management and Security

Policy

1 Purpose
To ensure that Information Security measures are in place, commensurate with their Information
Asset classification, to protect Information Assets, Information and Communication Technology
(ICT) Assets and Information Systems within the University ICT environment against
unauthorised use or accidental modification, loss or release; and assist the University mitigate
any damage or liability arising from the use of these Information Assets and Information
Systems for purposes contrary to the University's policies and relevant Regulatory Compliance
Instrument.

2 Scope
This policy applies to all Employees, Researchers, University Members and Students (hereafter
referred to as 'users') who have access to the University's Information Assets and related
Information Systems.

3 Policy Statement
The University is committed to the management of risks associated with ICT Assets and
Information Systems and the reduction of ICT security incidents. This policy provides the
governance framework for Information management and security within the University and
defines the University policy in all aspects of Information Security as stipulated under the
relevant Information standards.

This policy aligns with:

Higher Education Standards Framework (Threshold Standards) 2021: Standard 7.3

Information Management

4 Principles
4.1 Internal governance
Information Security governance arrangements are established and endorsed by the University
ICT Strategy Board and assisted by other relevant University committees. The implementation,
maintenance and control of operational Information Security is the responsibility of ICT
Services. The ICT Cyber Security Committee is responsible for monitoring and recommending
Information Security strategy, controls and associated operational security matters.

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
All Information System users are responsible for familiarising themselves with this policy and
related policies and procedures, as appropriate to their role within the University. Effective
communication of this ICT Information Management and Security Policy, and all associated
policies and procedures, form part of this ongoing commitment to Information Security
governance and is critical to ensuring that ICT Assets and Information Assets are protected
from unauthorised use, accidental modification, loss or release.

In the event of a cyber breach such as, but not limited to, malware, computer hacking,
ransomware, or denial of service attack, the Chief Digital Information Officer is authorised to
implement a range of measures, including removal of individual access to the network and
removal of ICT Assets and ICT Systems from the network to minimise the risk of loss or misuse
of Information Assets.

4.2 External party governance

The Chief Digital Information Officer is delegated with ensuring that appropriate arrangements
are established and documented to ensure that third party ICT service level agreements,
operational level agreements, hosting agreements or similar contracts clearly articulate the level
of security required and are regularly monitored.

4.3 Information Security and Cyber Security

Information Security activities, including Cyber Security awareness, are concerned with the
protection of Information from unauthorised use or accidental modification, loss or release.
Information Security is based on the following five elements:

Confidentiality - ensuring that Information is only accessible to those with authorised

access

Integrity - safeguarding the accuracy and completeness of Information and processing

methods

Availability - ensuring that authorised users have access to Information when required

Compliant Use - ensuring that the University meets all Regulatory Compliance
Instruments and contractual obligations

Responsible Use - ensuring that appropriate controls are in place so that users have
access to accurate, relevant and timely Information but that users of the University's ICT
resources do not adversely affect other users or other Information Systems.

4.4 Policy, planning and governance

The University recognises the importance of, and demonstrates a commitment to, maintaining a
robust University Information Security environment. The University at a minimum will

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
reasonably:

1. develop and implement an Information Security policy (this policy)

2. develop and implement an Information Security Plan, ensuring alignment with the
University business planning, general security plan and risk assessment findings

3. establish and document Information Security internal governance arrangements

(including roles and responsibilities) to implement, maintain and control operational
Information Security within the University. Relevant information shall be provided as
needed including provision of timely and relevant information to the University's senior
executive and Council regarding Information Security matters

4. establish, document and regularly monitor Information Security external governance

arrangements to ensure that third party service level agreements and operational level
agreements clearly articulate the level of security required.

4.5 Recordkeeping and Information Privacy

For the purposes of the University's records management System and Information
management, the University is required to comply with multiple Regulatory Compliance
Instruments, including but not limited to:

Information Privacy Act 2009

Public Records Act 2023

Records Governance Policy

Queensland Information Standard 18: Security.

The University will meet its data retention obligations under the Telecommunications
(Interception and Access) Amendment (Data Retention) Act 2015 (section 187) recognising that
the University will rely on the 'immediate circle' exclusion for any relevant services provided only
to persons who are 'inherently connected to the functions of the University'.

4.6 Information Asset management

The University has developed the Information Asset and Security Classification Procedure
which establishes the process for classifying and handling University Information Assets based
on their level of sensitivity, value and criticality to the University.

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
4.7 People Portfolio management
The University will implement measures to minimise the risk of loss or misuse of Information
Assets by ensuring that Security Safeguards are incorporated into University People Portfolio
management, including the development of supporting policies and processes. The University at
a minimum will reasonably:

1. implement induction and ongoing training and security awareness programs to ensure
that all Employees are aware of and acknowledge this policy and related policies and
procedures on Information Security and security responsibilities

2. document and assign security roles and responsibilities where Employees have access
to security classified Information or perform specific security related roles, and ensure
that security requirements are addressed in recruitment and selection and in job
descriptions

3. develop and implement procedures for the separation of Employees from, or relocation
within, the University.

4.8 Physical and environmental management

The University will apply measures to ensure that the level of physical controls implemented will
minimise or remove the risk of equipment or Information being rendered inoperable or
inaccessible, or being accessed, used or removed without authorisation. The University at a
minimum will reasonably ensure that:

1. building and entry controls for areas used in the processing and storage of security
classified ICT Information are established and maintained, consistent with the
Information Asset and Security Classification Procedure

2. all ICT Assets that store or process Information are located in Secure Areas with control
mechanisms in place to restrict access to authorised personnel only

3. Policies, procedures and processes are implemented to monitor and protect the use
and/or maintenance of Information Assets and mobile ICT Assets away from University
premises

4. Policies, procedures and processes are implemented for the secure disposal or reuse of
ICT Assets, commensurate with the Information Asset's security classification level.

4.9 Communications and operations management

The University will ensure that operational procedures and controls are documented and
implemented to ensure that all Information Assets and ICT Assets are managed securely and

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
consistently, in accordance with the level of required security. The University at a minimum will
reasonably ensure that:

1. operational change control procedures and release management control procedures are
implemented to ensure that changes to Information processing facilities or Systems are
appropriately approved and managed

2. System capacity is regularly monitored to ensure risks of System overload or failure,

which could lead to a security breach, are avoided

3. adequate controls are defined and implemented to mitigate the impact of threats and
vulnerabilities to the network, including the prevention, detection, removal and reporting
of attacks of malicious code on all ICT Assets

4. Systems maintenance processes and procedures, including operator and audit/ fault
logs, media handling procedures, Information backup procedures and archiving, will be
implemented

5. methods for exchanging Information within the University, outside the University, through
online services, and/or with third parties, will be consistent with the Queensland
Government Information Security Classification Framework (QGISCF) and the Network
Transmission Security Assurance Framework (NTSAF) and University policies and
procedures

6. confidentiality requirements or non-disclosure agreements reflecting the need for

protecting Information are to be undertaken in accordance with the University's
Intellectual Property Policy and subordinate Procedures and identified and reviewed
regularly

7. each Employee must use the University authorised and supplied communications
methods, including electronic mail, when transacting official University business

8. the Student Communication Policy and related policies and procedures cover Handling
Personal Student Information Policy and Procedure, Student Communication Procedure,
Use of Electronic Mail Procedure establish the framework for all electronic
communications with Students.

4.10 Access management and passwords

The University will put in place control mechanisms based on business requirements,
assessed/accepted risks, Information classification and Regulatory Compliance Obligations for
controlling access to all Information Assets and ICT Assets. The University at a minimum will
reasonably ensure that:

1. access will be provided to users for the purpose of carrying out work, study or other

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 activities as agreed with the University

2. access will be granted on the 'least privilege' principle in which each user is granted the
most restricted set of privileges needed for the performance of the relevant tasks

3. authentication requirements, including on-line transactions and services, must be

appropriate for the security classification of the Information

4. access to the University network and Information Systems requires specific authorisation
and each user must be assigned an individually unique personal identification code and
secure means of authentication

5. access to shared ICT Assets in teaching and research laboratories may be subject to
shared access management rules as agreed by the University

6. policies and/or procedures for user registration, authentication management, access

rights and privileges are defined, documented and implemented for all ICT Assets

7. 'restricted access' and 'authorised use only' warnings must be displayed upon access to
all Systems which have this capability

8. access to all emails, documents, University network, and Information Systems will be
terminated upon departure from the University.

There is an obligation on Employees who are studying University Courses, who also have a
level of administration access to related University Systems, to contact the Course Coordinator
for the Course/s the Employee is studying to alert them to this fact. This also applies to
Employees with relationships to Students studying University Courses resulting in a perceived,
potential or actual conflict of interest, as identified in the Conflict of Interest Procedure. During
the course of their study, the Employee is not permitted to access the relevant Course
environments, or applicable Systems, using their administrator access.

The University requires users to keep user-level passwords confidential and change these
immediately if they suspect that their password has been comprised.

A Clear Desk and Clear Screen is required to reduce the risk of unauthorised access or damage
to Information Assets and ICT Assets.

4.11 System acquisition, development and maintenance

The University will apply measures to ensure that during System acquisition, development and
maintenance, Security Safeguards will be established and will be commensurate with the
security classifications of the Information contained within, or passing across, Information
Systems, network infrastructure and applications. The University at a minimum will reasonably
ensure that:

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 1. security requirements are addressed in the specifications, analysis and/or design
phases and internal and/or external audit are consulted when implementing new or
significant changes to financial or critical business Information Systems

2. Security Safeguards are established during all stages of System development, as well
as when new Systems are implemented and maintained in the operational environment

3. appropriate change control, acceptance and System testing, planning and migration
control measures are carried out when upgrading or installing software in the operational
environment

4. a patch management program for operating Systems, firmware and applications of all
ICT Assets is implemented to maintain vendor support, increase stability and reduce the
likelihood of threats being exploited.

4.12 Incident management

The University will ensure the effective management of and response to Information Security
incidents to maintain secure operations within the University. The University at a minimum will
reasonably:

1. establish and maintain an Information Security incident and response register and
record all incidents

2. ensure all Information Security incidents are reported and escalated (where applicable)
through appropriate management channels and/or authorities

3. ensure that incidents are investigated and apply formal disciplinary processes

4. ensure responsibilities and procedures for the timely reporting of security events and
incidents, including breaches, threats and security weaknesses, are communicated to all
University Members.

4.13 Business continuity management

The University will ensure that a managed process, including documented plans, is in place to
enable Information and ICT Assets to be restored or recovered in the event of a disaster or
major security failure. The University at a minimum will reasonably:

1. establish plans and processes to assess the risk and impact of the loss of Information
and ICT Assets on University business in the event of a disaster or security failure and
develop methods for reducing known risks to University Information and ICT Assets

2. ensure business continuity Information and ICT Asset disaster recovery plans are

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 maintained and tested to ensure Systems and Information are available and consistent
with agency business and service level requirements.

University Members should also refer to the Business Continuity Policy and Crisis Management
Policy.

4.14 Compliance management

The University will implement practices to ensure compliance with, and appropriate
management of, all Regulatory Compliance Instruments relating to Information Security. The
University at a minimum will reasonably ensure that:

1. all Information Security policies, procedures and processes, including contracts with ICT
third parties, are reviewed for compliance on a regular basis

2. all reporting obligations relating to ICT Security are complied with and managed
appropriately

3. all reasonable steps are taken to monitor, review and audit University Information
Security compliance, including the engagement of internal and/or external auditors and
specialist organisations where required.

University Members should also refer to the Policy Framework.

4.15 Penalties and discipline

Conduct in contravention of this policy may constitute a criminal offence under relevant State
and Commonwealth legislation, resulting in legal prosecution. Where the violation is considered
a criminal offence, the police (Federal and State) will be informed. Where applicable, the
Director (Workplace Relations and Operations) will also be advised.

This will be irrespective of whether the violation is internal (e.g. unauthorised access to
Information), external (e.g. unauthorised remote access to the University network by a non-
University Employee or Student), or where assistance is provided by a University Employee or
Student to provide unauthorised access to the University network.

4.16 Other considerations

The University will make no warranty, explicit or implied, regarding the ICT services offered, nor
their fitness for any particular purpose. Similarly, no responsibility can be accepted by the
University or its Employees, for any damage arising directly or indirectly from the use of these
services.

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
The responsibility for protecting ICT resources and services is shared with all users who use
these services. The University will make all reasonable efforts to protect University Members
from possible ICT and computer-related dangers but cannot always protect University Members
from all potential threats. The University cannot guarantee to protect an individual against
exposure to material that may be offensive to them. University Members will be warned that
they may traverse or receive material that they find offensive.

5 References
Australian Government. (2015). Telecommunications (Interception and Access) Amendment
(Data Retention) Act 2015. Canberra, Australia: Australian Government Retrieved October 13,
2016 from [Link]

Queensland Government Chief Information Office. Data Encryption Standard. Retrieved

January 2024, from [Link]
technology/qgea-policies-standards-and-guidelines/data-encryption-standard

Queensland Government Chief Information Office. Queensland Government Authentication

Framework (QGAF). Retrieved January 2024, from [Link]
nd-communication-technology/qgea-policies-standards-and-guidelines/queensland-government-
authentication-framework-qgaf

Queensland Government Chief Information Office. Queensland Government Enterprise

Architecture Framework 2.0. Retrieved January 2024, from
[Link]
[Link]

Queensland Government Chief Information Office. Information Security Classification

Framework (QGISCF). Retrieved January 2024, from [Link]
and-communication-technology/qgea-policies-standards-and-guidelines/information-security-
classification-framework-qgiscf

6 Schedules
This policy must be read in conjunction with its subordinate schedules as provided in the table
below.

7 Policy Information

Accountable Officer Chief Operating Officer and Chief Financial Officer

Responsible Officer Chief Operating Officer and Chief Financial Officer

Policy Type Executive Policy

Policy Suite Cloud Computing Use Inherent Risk Schedule

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 Data Breach Response Plan Schedule

Engagement of Cloud Computing Services Procedure

Information Asset and Security Classification Procedure

Information Asset and Security Classification Schedule

Subordinate Data Breach Response Plan Schedule

Schedules

Approved Date 2/1/2026

Effective Date 2/1/2026

Review Date 14/12/2028

Relevant Legislation ISO/IEC 27000:2016 - Information technology - Security techniques -

Information security management systems - Overview and vocabulary

ISO/IEC 27001:2022 - Information security, cybersecurity and privacy

protection - Information security management systems -
Requirements

ISO/IEC 27002:2022 - Information security, cybersecurity and privacy

protection - Information security controls

ISO/IEC 27005:2022 - Information security, cybersecurity and privacy

protection - Guidance on managing information security risks

Electronic Transactions (Queensland) Act 2001

Information Privacy Act 2009

Information Security Manual - ISM (Australian Government)

Metadata Management Principles

Public Records Act 2023

Public Sector Ethics Act 1994

Queensland Government Information Security Classification

Framework (QGISCF)

Procurement and Disposal of ICT Products and Services (IS13)

Policy (Queensland Government)

Information Security Policy (IS18:2018) (Queensland Government)

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 General Retention and Disposal Schedule (GRDS) (Queensland
Government)

Information Asset Custodianship Policy (IS44) (Queensland

Government)

Records Governance Policy

Right to Information Act 2009

Telecommunications (Interception and Access) Amendment (Data

Retention) Act 2015

University of Southern Queensland Act 1998

Policy Exceptions Policy Exceptions Register

Related Policies Acceptable use of ICT Resources Policy

Business Continuity Policy

Code of Conduct Policy

Contract Management Policy (under development)

Crisis Management Policy

Employee Complaints Policy

Enterprise Architecture Policy

Enterprise Risk Management Policy

Handling Personal Student Information Policy and Procedure

Intellectual Property Policy

Mobile Device and Service Policy

Physical Security Policy

Policy Framework

Privacy Policy

Procurement Policy

Public Interest Disclosure Policy

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 Records and Information Management Policy

Research Code of Conduct Policy

Student Communication Policy

Student General Conduct Policy

Under 18 International Students Policy

Related Procedures Business Continuity and Crisis Management Procedure

Commercialisation of Intellectual Property Procedure

Conflict of Interest Procedure

Contract Management Procedure (under development)

Integrated Planning and Performance Procedure

Intellectual Property Procedure

Physical Security Infrastructure and Equipment Procedure

Privacy Procedure

Records and Information Management Procedure

Recruitment, Selection and Appointment Procedure

Student Communication Procedure

Student General Misconduct Procedure

Use of Electronic Mail Procedure

Website Procedure

Related forms, Enterprise Information Management Framework (EIM Framework)

publications and
websites Use of Copyright Materials Guideline (Queensland Government)

Definitions Terms defined in the Definitions Dictionary

Council

Council means the governing body, the University of Southern

Queensland Council.

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 Course

A discrete element of a program, normally undertaken over a single

Study Period, in which the Student enrols, and on completion of which
the Student is awarded a grade.

Course Coordinator

Responsibilities of Course Coordinators include but are not limited to:

Course planning, design and development Course Specifications and
alignment with Program Learning Outcomes Assessment design,
implementation and marking Course delivery and Student learning
experiences by providing Student support leadership and guidance of
teaching teams engagement with professional and accreditation
bodies ensuring currency of disciplinary and content knowledge and
expertise reflecting on evaluations for the purpose of quality
enhancement of Courses.

Employee

A person employed by the University and whose conditions of

employment are covered by the Enterprise Agreement and includes
persons employed on a continuing, fixed term or casual basis.
Employees also include senior Employees whose conditions of
employment are covered by a written agreement or contract with the
University.

General Misconduct

Behaviour or conduct which is contrary to expected Student conduct

outlined in the Student General Conduct Policy.

Information

Any collection of data that is processed, analysed, interpreted,

organised, classified or communicated in order to serve a useful
purpose, present facts or represent knowledge in any medium or form.
This includes presentation in electronic (digital), print, audio, video,
image, graphical, cartographic, physical sample, textual or numerical
form.

Information Asset

An identifiable collection of data stored in any form and recognised as

having value for the purpose of enabling the University to perform its
business functions, thereby satisfying a recognised University
requirement.

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 Information Security

Concerned with the protection of Information from unauthorised use or

accidental modification, loss or release.

Information System Custodian

An individual or group of people who have been officially designated

as accountable for specific data that is transmitted, used, and stored
on a System within the University.

Information Systems

The organised collections of hardware, software, equipment, policies,

procedures and people that store, process, control and provide
access to information.

Regulatory Compliance Instrument

An external compliance instrument provided by legislation, regulation,

standards, statutes or rules, including subordinate instruments.

Regulatory Compliance Obligation

An external obligation provided in Regulatory Compliance

Instruments.

Researcher

Any person/s involved in Research Activities at, or on behalf of the

University. This includes, but is not limited to Employees, Students,
visiting scholars, research partners, research affiliates, holders of
Honorary or Adjunct positions.

Student

A person who is enrolled in a UniSQ Upskill Course or who is

admitted to an Award Program or Non-Award Program offered by the
University and is: currently enrolled in one or more Courses or study
units; or not currently enrolled but is on an approved Leave of
Absence or whose admission has not been cancelled.

University

The term 'University' or 'UniSQ' means the University of Southern

Queensland.

University Members

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 Persons who include: Employees of the University whose conditions
of employment are covered by the UniSQ Enterprise Agreement
whether full time or fractional, continuing, fixed-term or casual,
including senior Employees whose conditions of employment are
covered by a written agreement or contract with the University;
members of the University Council and University Committees;
visiting, honorary and adjunct appointees; volunteers who contribute
to University activities or who act on behalf of the University; and
individuals who are granted access to University facilities or who are
engaged in providing services to the University, such as contractors or
consultants, where applicable.

Definitions that relate to this policy only

Clear Desk

Clear desks at the end of each work day of all sensitive Information
Assets including documents and notes, business cards, and
removable media (e.g. USB memory sticks) to ensure a reduction of
the risk of information theft, fraud, or a security breach caused by
sensitive Information being left unattended and visible in plain view.

Clear Screen

Locking computers when leaving a desk unattended and logging off

when leaving for an extended period of time to ensure that the
contents of the computer screen are protected from prying eyes and
the computer is protected from unauthorised use.

Cyber Security

Measures relating to the confidentiality, availability and integrity of

Information that is processed, stored and communicated by electronic
or similar means.

Source: Australian Government. (2016). Attorney-General's

Department - Cyber security. Retrieved from
[Link]
CyberSecurity/Pages/[Link]

ICT Asset

All applications and technologies that are owned, procured and/or

managed by the University. These include desktop and productivity
tools, application environments, hardware devices and Systems
software, network and computer accommodation, and management
and control tools.

Public Record

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 Refer Public Records Act 2023.

A public record is any form of recorded Information that provides

evidence of the decisions or actions of a 'public authority' (in this case
the University of Southern Queensland) in undertaking its business
activities or in the conduct of its affairs. The Act includes all records
(and Information) irrespective of the form, the custodial arrangements
and the technology used to generate, manage, preserve and access
records.

Secure Area

Provides the highest integrity of access to, and audit of, Security
Classified Information Assets to ensure restricted distribution and to
assist in subsequent investigation if there is unauthorised disclosure
or loss of Information Assets. The essential physical security features
of a Secure Area include, but are not limited to:

appropriately secured points of entry and other openings

tamper-evident barriers, highly resistant to covert entry

an effective means of providing access control during both

operational and non?operational hours

all persons to wear passes

all visitors escorted at all times

during non-operational hours a monitored security alarm

system, providing coverage for all areas where Security
Classified Information Assets are stored

an approved means of limiting entry to authorised persons.

Security Safeguards

Hardware, programs, procedures, policies and physical safeguards

which are put in place to assure the integrity and protection of an
Information Asset System together with other forms of control
including training.

System

A combination of Information Assets and ICT Assets supporting a

business process.

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.
 Keywords Information management and security

Record No 13/340PL

Failure to comply with this Policy or Policy Instrument may be considered as misconduct and the provisions of the relevant Policy or Procedure
applied. A hard copy of this electronic document is uncontrolled and may not be current as UniSQ the University regularly reviews and updates
its Policies and Policy Instruments. The latest controlled version can be found in the UniSQ’s Policy and Procedure Library.

Powered by TCPDF ([Link])