Managing Information Risk Allegra Huxtable Manager Government Recordkeeping

1. Managing Information Risk Allegra Huxtable Manager Government Recordkeeping Tasmanian Archive and Heritage Office

2. Overview • Definition of information risk • Information risk Vs. Information Security • Common information risks • Identify information risk • Determine whether being impacted by risk • Examples • Risk mitigation strategies • Remedial actions • Develop a risk register • Why do we want you to start managing information risk • How might you go about it

3. What is Information Risk? Information riskIs any risk which relates to the inherent characteristics and value of information in any form that is maintained by an agency and which may be transmitted, manipulated, and stored. Records are the subset of information that constitutes any evidence of activities.

4. Information Risk Management Vs. Information Security Information Risk Management is a broader management of all information related risk Information security risks are threats or vulnerabilities that introduce uncertainty regarding the availability, confidentiality or integrity of information Would you be able to pick up on data loss risks that result from inactive management or ineffective data migration processes? Focuses on all areas of information management and highlights high risk areas of the business

5. Defining information risks? • Common information risks that could be occurring in high risk business areas include: • Information that cannot be generated in a useable form • Information that cannot be maintained in a useable form • Information that is incomplete • Information that is meaningless • Information that cannot be trusted

6. Defining information risks? • Information that cannot be authenticated • Information that is inaccessible • Information that does not survive for as long as it is needed by the business • Information that is overwhelming and unmanaged and inhibits rather than enables business process • Information risks can hamper government business and accountability, particularly when these risks occur within high risk areas of business.

7. Identify High risk areas of business • Perform core, strategic, highly accountable or high value business • Receive a high level of public and media scrutiny • Instigate or are subject to litigation • Allocate or spend large amounts of money • Relate to issues of security • Are outsourced • Experience administrative change • Are conducted in cloud-computing systems • Relate to the health, welfare, rights and entitlements of citizens and/or staff • Involve organisational change management and/or transitioning to new systems/services • Relate to employment conditions of staff

8. Know what information is required to support high risk business processes • Talk to staff • Authorised disposal schedule • Legislation and standards that apply • Quality controls or procedure statements • Identify the information needed to support clients, projects and cases

9. Know the technology used to • support high risk business areas • Cloud, BYOD, Social media • Collaborative environments - SharePoint, Office 365 • Complex datasets as the basis for decision making • Systems including legacy applications • Large uncontrolled network environments • Personal storage networks • Diverse applications to perform different aspects of their operations • Backup systems as information storage environments.

10. Determine whether information is being impacted by information risk? • Usable • Complete • Meaningful • Trusted • Authenticated • Inaccessible • Missing • Lost within overwhelming and unmanaged data volumes

11. Examples of information Risks Jake Kovco A CD containing a draft of the confidential report into the bungled repatriation of the remains of Private Jake Kovco from Iraq was left in the Qantas Club at Melbourne airport. This caused public embarrassment, personal distress and reputational damage as the disc found its way into the hands of talkback radio host Derryn Hinch. Transcend Inadvertently published personal details of contractors working for them on their website. Details of this incident were published in the Mercury Newspaper and reported on the news. They apologised publically it caused embarrassment, personal distress and reputational damage.

12. Examples of information Risks • Aurora Energy • Accidently destroyed Personnel records before they were time expired leading to an investigation by the Ombudsman and mention in his Annual Report. • Aurora failed to effectively manage personal information a breach of the Personal Information Protection Act (PIP) 2004. • Ombudsman's Conclusions: • It is not possible to determine that the information destroyed was information no longer needed for any purpose. • failed to take reasonable steps to protect the personal information from misuse, loss, unauthorised access, modification or disclosure. • failed to take reasonable steps to obtain the approval of the State Archivist prior to destroying personal information. • have not met its obligations under the Personal Information Protection Act 2004 and the Archives Act 1983

13. Examples of information Risks • Aurora Energy • Some of the Ombudsman's Recommendations: • Immediate audit of all records holdings • Determine they are meeting its Personal Information Protection Act and Archives Act obligations, take any necessary action to meet those obligations where it is currently failing to do so • All employment contracts contain a requirement to foster a culture of best-practice information management These contracts should include appropriate key performance indicators to ensure that a best-practice information management culture is regularly measured

14. Determine appropriate risk mitigation strategies • What strategies can you adopt to mitigate information risk? • Key points at which you can mitigate information risk are: • In the implementation of strong information governance frameworks • At system specification, design and configuration • At system transition.

15. Examples of risk mitigation information governance frameworks • Promote a broad corporate understanding of the high risk/high value information generated and needed by your organisation • Communicate specific information management requirements applying to high risk areas of business to staff, management, ICT, contractors • Deploy change management strategies and training to develop an organisational culture which values information management.

16. Remedial actions • System transition if you are not migrating all the data then evaluate the need to keep and maintain legacy data • Moving to cloud, planning should include support, maintenance and re-transitioning if required so information continues to be available • Implement record disposal programs to destroy time-expired records and to focus corporate attention on the management of high risk/high value business information

17. Develop and information risk register • key information and metadata fields in System X are required for business process and must be maintained through the system’s migration • If business information needs to be kept long term, ensure that this is identified and flagged for any system or service offering or process review associated with this information • If a core business system is unable to export data of its transactions, identify that manual workarounds are necessary to provide reporting / information needed for service delivery and continuity • If information requirements were not built into contracts with services providers and data portability is not guaranteed, identify that alternate strategies for maintaining access to information of long term business value

18. Why do we want you to start identifying & managing information risk? • Information risks are not always obvious to corporate risk managers • Put your effort where it counts – high risk business areas • High volumes of digital records being created in unstructured environments means we need to look for new ways to appraise and sentence digital records

19. How might you go about it? • Select aspects of your current service provision where you could analyse risk: • Off site storage • Records in your business systems • Use of technology – particularly use cloud for example your agency may be looking to implement office 365 • Records on network drives • Tap into your agency existing risk management processes are their any information risks on the corporate risk register? • Identify high risk areas of your business and concentrate on those. • Escalate high level information risks and make sure they are put on the corporate risk register

20. Questions

21. Sources TAHO Guidelines and advice on managing Information Risk Identifying information risks that might be impacting on high risk business, State Records NSW, April 2014 Managing Record keeping risk, Keeping good companies March 2010, Authors Barbara Reed, Director and Kerry Gordon, Director, Recordkeeping Innovation