Monash University implements a defence-in-depth approach to information security and employs a multitude of cyber security controls to protect our infrastructure and data. These controls are aligned to the ISO 27001 standard and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).
Access control security
View
Objective: To limit access to information and information processing facilities and ensure authorised user access and to prevent unauthorised access to systems and services. Also, to make users accountable for safeguarding their authentication information and prevent unauthorised access to systems and applications.
Control implementation overview:
Asset management security
View
Objective: To identify organisational data and technology assets and define and implement appropriate levels of protection responsibilities and controls.
Control implementation overview:
Business continuity security
View
Objective: Information security continuity shall be embedded in the organisation's business continuity management systems and to ensure availability of information processing facilities.
Control implementation overview:
Communications security
View
Objective: To ensure the protection of information in networks and its supporting information processing facilities.
Control implementation overview:
Cyber security compliance
View
Objective: To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements and to ensure that information security is implemented and operated in accordance with the organisational policies and procedures.
Control implementation overview:
Cyber security incident management
View
Objective: To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses
Control implementation overview:
Cyber security management
View
Objective: To establish a management framework to initiate and control the implementation and operation of information security within the organisation.
Control implementation overview:
Cyber security policy and standards
View
Objective: To provide management direction and support for information and cyber security in accordance with business requirements and relevant laws and regulations.
Control implementation overview:
Encryption security
View
Objective: To ensure proper and effective use of encryption to protect the confidentiality, authenticity and/or integrity of information.
Control implementation overview:
Human resources
View
Objective: To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.
Control implementation overview:
Operational security
View
Objective: To ensure correct and secure operations of information processing facilities, to protect against loss of data and to record events and generate evidence.
Control implementation overview:
Physical and environmental security
View
Objective: To prevent unauthorised physical access, damage and interference to the organisation's information and information processing facilities and to prevent loss, damage, theft or compromise of assets and Interruption to the organisation’s operations.
Control implementation overview:
Supplier management
View
Objective: To ensure protection of the organisation's assets that are accessible by suppliers. To maintain an agreed level of information security and service delivery in line with supplier agreements.
Control implementation overview:
System and application development security
View
Objective: To ensure that information security is an integral part of information systems across the entire system development and maintenance lifecycle.
Control implementation overview:
Cyber security awareness plan
View
Our Cyber Security awareness plan sets out our approach to training and educating employees about the cyber security landscape in order to reduce human based cyber security risks within the organisation.
The Plan supports and is a subcomponent of the broader Monash University cyber security strategy and has been developed to focus on the top human risks facing the organisation by providing employees with mandatory eLearning training and additional training for groups that have unique roles or high-risk profiles.
