Governance Toolkit: Cyber security

Creating an information asset register can help your charity identify the information assets it has, and assess its importance to your charity’s operation.

Identify

An information asset register can help you identify:

• the types of information assets your charity has
• valuable information assets that need to be prioritised
• where the information assets are stored or held
• assets that pose significant risk
• who has access to assets, and which people and positions are responsible for particular information assets.

Your charity can use our information asset register template to identify and record information about your charity’s critical assets.

Assess

An information asset register can also focus your charity’s attention on:

• the relative value or importance of each of the assets to your charity’s operation
• the impact of a cyber incident on the assets, and business continuity.

You can use the information asset register to focus your charity’s attention and resources on protecting its information assets.

In an information asset register, assets can be ‘grouped’ – for example, by asset type or value to the charity.

A register can help clarify how your charity protects assets, as well as help you conduct a risk assessment for your charity that:

• identifies risks
• considers potential incidents
• analyses the likelihood and effect of an incident
• explores ways to manage risks or respond to incidents.

Your charity should record and retain its information asset register, as well as the findings of any risk assessments it does. The register should be updated when appropriate, and risk assessments reviewed or revisited regularly.

There are many practical things your charity can do to mitigate risks and prevent incidents.

• Ensure software and operating systems are updated regularly: Regular updates will fix known security vulnerabilities in software.
• Limit access: Only allow staff and volunteers to access the information they need for their roles.
  • This can be achieved through the use of security groups or restricting access to applications accessible through Software as a Service (SaaS) cloud-based arrangements.
  • You should also restrict the number of people that have administrator access or accounts.
• Use multi-factor authentication: Multi-factor authentication requires users enter more than just a password when they log in to your charity’s systems.
  • This enhances security and helps provide an extra layer of protection against security breaches caused by stolen or weak passwords.
  • Multi-factor authentication should be used wherever possible, particularly for access to critical or sensitive information such as financial or health information.
• Protect devices: Use antivirus software to protect all devices. Modern antivirus software can find, contain and remove viruses.
  • Scans should be automatic and regularly scheduled so your charity isn’t reliant on users remembering to conduct manual scans.
  • In addition, ensure your antivirus software is kept up-to-date, and turn on automatic updates if available.
• Protect networks: Use firewalls for your charity’s network. This is software that can prevent unauthorised access to a network, and unauthorised use of the network by your charity’s staff and volunteers.
• Use only authorised resources: Only allow approved applications on your charity’s computer and phones, and block access to inappropriate websites and downloads.
  • These restrictions can be enforced through group policy objects, or technology like Applocker.
• Use passwords effectively:
  • Make sure those who use the charity’s systems have unique passwords to protect every account, device and system. System users should not re-use passwords.
  • If your charity provides devices to staff and volunteers, ensure they set their own new and unique password.
  • Use a passphrase, which uses four or more random words, as your password. A strong passphrase should be long, unpredictable and unique.
• Make backups: Ensure your charity has scheduled regular automatic backups for its important information. Charities increasingly use the ‘cloud’ (a shared computer and storage resource service that is accessed through the internet) to protect their information, rather than a physical device. This can be a way to securely store backups outside of the charity’s physical location.

For more information on how to manage the risk of cyber threats, see the Australian Signals Directorate’s Essential Eight mitigation strategies.

It is a good idea for your charity’s staff and volunteers to have at least basic training in cyber security and data privacy.

The training, at a minimum, should cover common cyber security risks and their mitigations, and outline the ways to collect and handle personal information securely.

Your charity should have a plan for responding to cyber security issues and data breaches. We have a template plan for responding to data breaches below that your charity can use.

Everyone in the charity should be familiar with the plan and have access to it if they need it.

Your charity could use the following steps to manage, respond and address a data breach or other cyber security issue:

• Identify and contain: Understand what is happening and, if possible, take steps to prevent other systems, devices or data from being affected.
• Investigate: Find out the nature of the issue, which devices and systems are affected, and what the risks might be.
• Assess the risks and respond: Work out what harm has been done, the effects of the harm, and what could go wrong from here.
• Act and notify: Decide on the priorities for protecting individuals and organisations from further harm. In the case of a data breach, follow the OAIC notification guidelines to inform the regulator and other parties if required.
• Review: Look over your charity’s policies, procedures and systems to identify any changes that would reduce the likelihood and consequences of similar issues occurring again, and then implement these changes.