NSW Government agencies need to move quickly to implement information security policies by next year, Office of Information Technology electronic commerce manager Nigel Evans said last week.

Speaking at the Information Security Management in Government conference in Sydney, Evans said agencies are being encouraged to have their IT systems certified to the national standard -- AS/NZS 17799 and 4444 - for information security management when accredited certifiers become available.

Evans said no deadline has been set yet. The OIT realises the scale of the challenge agencies face in implementing the standard, he said, but agencies are being asked to act as "quickly as they can".

"It will involve all NSW Government agencies which is probably around 450. But at least 100 of those agencies actually run their own IT, while the other agencies share," Evans said.

Once a few agencies have been certified, the Government will look to set "an achievable -- but not overly generous deadline", within a time frame that has to be realistic, he said.

In his presentation to around 300 Government information security and IT professionals, Evans said the discussion of the standards will "be one of many topics on the agenda" at a scheduled e-government committee meeting.

Premier's Department Circular number 2001-46 directs agencies to implement security standards and the Department of Information Technology and Management (DITM) will establish a program for external penetration testing of agencies' IT systems. According to the Circular, details will be issued in due course, but reporting will be quarterly until the end of 2002, then annually until 2004.

Also speaking at the conference, Yvette Lejins, information security manager for the NSW Attorney General's Department, said the AS/NZS 17799 information security standard is an excellent resource for organisations developing policies and procedures.

Lejins said government agencies in particular will benefit from adopting standards to avoid legislative breaches, avoid business interruption costs and to ensure that public records and information remain secure.

However, Lejins touched on some limitations of the standard saying it can be overwhelming for smaller organisations, adding that controls are at a conceptual level rather than technical.