ASD ISM 0664 Authorisation of SECRET data exports

The IT team should work with department heads to create a formal process for data export approval.

This involves setting up clear steps, like filling out a data export request form and identifying who in leadership will give the final approval. Clearly outline this process in a document and share it with everyone involved.

Managers need to designate trustworthy employees who have the responsibility to approve data exports.

This involves selecting people who understand the importance of data security and have a good track record. It's also essential that these employees have the adequate security clearances needed to review sensitive data.

The security team should regularly provide training on recognising sensitive data and understanding the risks associated with exporting it.

Sessions should include real-world examples and how breaches have affected other organisations. Information should be made easy to understand so that everyone, even non-technical staff, gets the message.

Human Resources (HR) should establish a system that periodically reviews the list of employees who are authorised to approve data exports.

This includes ensuring these employees are still in good legal standing and understanding current security protocols. HR should work closely with the security team to update this list as necessary.

System owners should use encryption to protect sensitive data files meant for export.

This means converting the information into a code to prevent unauthorised access, even if the data falls into the wrong hands. Implement tools and software that handle encryption as part of the data export pipeline.