The Australian Department of Finance is inviting feedback from the IT industry about draft cyber security clauses.
Department of Finance assistant secretary, Mundi Tomlinson, wrote in a that the cyber security clauses are designed to:
- Define service provider’s and contractor’s responsibilities in order to manage cyber security risks
- Provide clear contract arrangements for safeguarding government data
- Increase the visibility of cyber security incidents
If a data breach occurs, the contractor must notify the customer in writing. It must also contact the Australian Cyber Security Centre, or other cyber security organisation such as AusCERT, as required by the customer.
The contractor would also need to obtain evidence about how the customer’s IT system was compromised and provide this to the customer on request.
Finally, the contractor will implement mitigation strategies to reduce the impact of future cyber security incidents.
According to Tomlinson, the cyber security clauses will be included in the Department of Finance’s SourceIT model contracts.
“The Commonwealth needs to have a way of managing cyber security risks that acknowledges the role of suppliers and subcontractors. These model clauses outline the Australian government’s preferred position,” Tomlinson said in a statement.
People can leave a comment on Tomlinson’s or email ICTprocurement@finance.gov.au The deadline for replies is 19 September, 2014.
Follow Hamish Barwick on Twitter: @HamishBarwick