This policy outlines the principles, objectives and approach to managing information security within the Queensland Family and Child Commission (the Commission).
The Commission will implement security controls to protect the information it holds by applying a systematic and repeatable approach to information security and integrating this policy into corporate risk management processes. This will ensure business continuity and the adoption of recognised international and Australian standards to managing information security.
This Information security policy applies to the protection of all Commission information, application and technology assets. This includes electronic and hard copy assets owned by the Commission and/or entrusted to it by customers, partners or external third parties.
This policy applies to all Commission employees, sub-contractors or consultants and any external parties deployed or engaged within the Commission.
This policy encompasses all forms of accessing, storing and distributing information to the Commission. As such, the policy applies to on-site and off-site (remote) Commission work arrangements (e.g. home-based, mobile, regional, and interstate).
The Commission implements and operates an ISMS based on ISO 27001, consistent with IS18 Requirement 1, covering services, information, applications and technology assets across the organisation and its suppliers.