Policy: Information technology security
- holds, transmits, manages, uses, analyses, or accesses data and information; and
- transmits electronic communication.
- This policy and related documents draw their authority from the Information Infrastructure and Services Rule 2015.
- The University requires external network interconnectivity and the internet for its research, teaching and learning, public policy, outreach, and administration activities.
- The University is committed to providing a secure information infrastructure that protects the integrity and confidentiality of information without compromising its availability.
- The University implements a framework for the management of information security and incident response.
- Information security applies to all forms of information and data, be they digital, print, or other and includes the management of the software and/or communications technology systems and networks for storing, processing, and communicating information.
- ANU is committed to ensuring the security of all information technology, data, equipment, and processes within its ownership and control.
- The University remains the owner of University data regardless of the ownership of the device.
- The University reserves the right to refuse, prevent or withdraw access to authorised users and/or particular devices or software.
- The University reserves the right to modify user access to data, in line with the Infrastructure security classification standard.
- The University takes appropriate action to protect, preserve, and keep available and accessible, its IT and information infrastructure, including the managed end-to-end network.
- The University provides and is responsible for:
- identifying, managing and mitigating risk across the University's IT and information infrastructure;
- coordinating all information security activities required to ensure the security of IT and information infrastructure;
- providing network security to protect the University's information sources, electronic resources, intellectual property, and network access;
- applying security updates to software and operating systems to minimise security vulnerabilities; and
- ensuring periodic audits of areas to ensure compliance with relevant policies and procedures.
System owner responsibilities
- All information technology systems have a system owner. System owners:
- ensure systems and applications are documented, classified, and secured in accordance with the Infrastructure security classification standard;
- identify and manage disaster recovery and business continuity requirements for their systems;
- ensure that all changes to infrastructure are managed through the Change Advisory Board and that only authorised changes are made;
- ensure that risk management, including risk assessment and mitigation, is undertaken with respect to the information assets within areas under their control;
- ensure periodic reviews of information assets are conducted to maintain the required security level as specified in the Infrastructure security classification standard;
- ensure that authorised users are aware of their obligation to operate in accordance with this policy and its related procedural documentation, and receive adequate support and training to do so; and
- advise the ITS Cyber Security Team of any exceptional circumstances that warrant non-patching of servers hosting their systems.
- protect information infrastructure resources from unauthorised access, modification, destruction, or disclosure;
- maintain compliance with University policies, procedures, rules and standards governing IT and information assets;
- report suspected or known security incidents and/or breaches to the ITS Cyber and Digital Security Team by emailing firstname.lastname@example.org; and
- keep University information and data secure.
- Users are required to assist and support the University in carrying out its legal and operational obligations, including co-operating with ITS should it be necessary to access or inspect University data stored on a personal device.
- The University investigates unauthorised use of the University’s IT and information infrastructure.
- Identified breaches of this policy and related documents are investigated under the following:
Legislation, standards, and regulations
- To enable better practice within its policy and procedural frameworks, the University recognises, and is consistent with, the following standards and regulations:
- Australian National University Act 1991
- Australian Government Protective Security Policy Framework
- Public Governance, Performance and Accountability Act 2013
- Public Governance, Performance and Accountability Rule 2014
- Commonwealth Crimes Act 1914
- Privacy Act 1988
- Telecommunications Act 1997
- Telecommunications Regulations 2021
- Telecommunications (Interception and Access) Act 1979
|Printable version (PDF)|
|Title||Information technology security|
|Purpose||This policy establishes the framework for Information Technology (IT) security, systems, and operations that support the core functions of the University, and outlines the responsibilities of the University, owners, and users of IT, infrastructure, and systems.|
|Audience||Staff, Students, Alumni, Affiliates|
|Topic/ SubTopic||Information Technology - Security|
|Effective Date||2 Apr 2019|
|Review Date||5 Apr 2022|
|Responsible Officer:||Director, Information Technology Services|
|Contact Area||Information Technology Services|
AS ISO/IEC 27002:2015
Australian National University Act 1991
Australian Government Protective Security Policy Framework
Public Governance, Performance and Accountability Act 2013
Public Governance, Performance and Accountability Rule 2014
Australian Government Department of Finance and Deregulation Finance Circular No. 2009/08
Crimes Act 1914 (Cth)
Privacy Act 1988
Telecommunications Act 1997
Information Infrastructure and Services Rule 2020
Information Infrastructure and Services Order 2020
On 9 April 2021, the ANU Council assigned authority to approve academic policy to the Academic Board.