Standards and baselines

Cyber security standards

Monash University has developed a suite of cyber security standards to provide guidelines which support the appropriate implementation of cyber security controls within the systems and environments we design, implement and manage.

The purpose of these cyber security standards is to provide guiding principles and controls for project and operational teams in incorporating cyber security best practices into the design, implementation and management of systems and/or environments.

Considering security at the design phase is more effective and cost-saving than at a later phase of the change management process. The purpose of this document is to guide projects and operations teams as well as service designers to bake cybersecurity into their design. It points to the minimum required cybersecurity controls that should be considered early in the concept design phase.
Minimum Cyber Security Standard
The purpose of this document is to guide project and operation teams in the expectations of the Cyber Risk and Resilience team regarding asset management for physical, virtual, and informational assets. It outlines the Cybersecurity team’s requirements and recommendations in order to ensure cybersecurity risks are mitigated to the university’s acceptable level.
Asset Management Standard
The purpose of this document is to guide project and operation teams in the expectations of the Cyber Risk and Resilience team regarding Cloud Security. It outlines the Cybersecurity team’s requirements and recommendations in order to ensure cybersecurity risks are mitigated to the university’s acceptable level.
Cloud Security Standard
The purpose of this document is to guide all Monash University staff, students, associates and visitors in the classification and handling of information assets within the University. Informational assets refer to any data, information, or intelligence classified and/or handled by the University.
It outlines the Cyber Risk and Resilience team’s requirements and recommendations in order to make sure cyber security risks are mitigated to the University’s acceptable level.
This helps to ensure appropriate protections for the vast range of information assets within the university, and to assist with compliance, legislative and regulatory requirements.
Information Classification and Handling Standard
The purpose of this document is to guide various teams and system/service owners in Monash University (MU) in securing remote access to those services/systems developed, deployed, offered, and/or operated by MU teams. It outlines the Cyber Risk And Resilience team’s requirements and recommendations in order to make sure cyber risks that are associated with user remote access are mitigated to the University’s acceptable level.
Remote Access Security Standard
The purpose of this document is to guide project and operation teams on the expectations of the Cyber Risk and Resilience team regarding vulnerability management. It outlines the Cybersecurity team’s requirements and recommendations in order to ensure cybersecurity risks are mitigated to the university’s acceptable level.
Vulnerability Management Standard
The purpose of this document is to guide project and operation teams in the expectations of the Cyber Risk and Resilience team regarding On-Premises Infrastructure Security. It outlines the Cybersecurity team’s requirements and recommendations in order to ensure cybersecurity risks are mitigated to the university’s acceptable level.
On-Premise Infrastructure Standard
The purpose of this document is to guide project and operation teams in the expectations of the Cyber Risk and Resilience team regarding the secure design, development and operation of their Standard Operating Environments (SOE) and the security of the SOE build environments. SOE is defined as a standardised build of an Operating System (OS) and associated software that can be used for servers, workstations, laptops and mobile devices.
This standard outlines the Cybersecurity team’s requirements and recommendations in order to ensure cybersecurity risks are mitigated to the university’s acceptable level.
Standard Operating Environment (SOE) Standard
The purpose of this document is to guide project and operation teams in the expectations of the Cyber Risk and Resilience team regarding Secret Management and its hosting environment.
It outlines the Cyber Security team’s requirements and recommendations in order to ensure cyber security risks are mitigated to the university’s acceptable level.
Secret Management Standard
The purpose of this document is to provide self-serve guidance to Monash University Australia (MUA) staff on vendor tiering and the minimum cyber security requirements applicable for each tier during an evaluation of an IT procurement. This will ensure that all vendors and suppliers meet the necessary cyber security requirements to protect our data and services.
Vendors / suppliers pre-procurement minimum cyber security standard

Cyber Security at Monash University

Cyber Security at Monash University

Standards and baselines

Cyber security standards