Managed Service Provider

Managed service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET managed services undergo an Infosec Registered Assessor Program (IRAP) assessment, using the latest release of the ISM available prior to the beginning of the IRAP as...

The Directive scopes this deliberately at direct suppliers and service providers, which makes the first artefact an inventory of who those parties are and which of them touch the network and information systems behind the service.

CSF 2.0 outcome: outcomes, capabilities and services that the organization depends on are understood and communicated. Priority Medium.

Address cloud-resident data and hosted storage scope per NIST SP 800-88 Rev 1 considerations (acknowledged in Section 3.6) + cloud-era guidance from NIST CSF 2.0 + NIST SP 800-145 + provider-specific documentation.

Under a Ministerial authorisation for a serious incident (one with relevant impacts on critical infrastructure assets and a material risk of serious prejudice to social or economic stability, defence or national security, or relating to a national emergency de...

The program must treat as material risks: a stoppage or major slowdown of the asset's function for an unmanageable period; an impairment that prejudices Australia's social or economic stability or national security;