Cyber Security Policy and Governance Specialist

⁠⁠⁠Background

The Australian Centre for International Agricultural Research (ACIAR) is Australia’s specialist international agricultural research for development agency, our purpose is to broker and fund research partnerships between Australian scientists and their counterparts in developing countries. The agency sits within the Foreign Affairs and Trade portfolio and is represented by staff at its head office in Canberra and across ten international offices.

ACIAR is currently undertaking a cyber security improvements project to further bolster cyber security capability with a focus on the ASD Essential Eight. The agency is seeking the services of a cyber security policy specialist to develop a suite of policies and procedures and to provide governance advice to support the cyber security program.

Scope of Work

ACIAR requires a cyber security policy and governance specialist to develop a cyber security policy framework including (but not limited to) the following:

ICT Security Policy (including Cyber security risk management matrix)

•  block/trust procedures for app whitelisting, Macros, etc
•  Log capture and management standards
•  Compliance review process Systems access policy
•  Password policy
•  Multifactor etc
•  Compliance review process

Backup Policy

•  Process for checking back up success
•  Process for testing backups

Privileged Access Management Policy

•  Procedures for approving and reviewing PAM

Patching Policy

•  Operating system

1.  Procedures

•  Application

1.  Procedures

•  Compliance review process

The specialist will be required to work closely with ACIAR SMEs to develop each policy and procedure taking into account, ACIAR’s current and future ICT capability and risk profile.

In addition, the specialist will be required to provide weekly progress reports to the CIO as well as advice on best practice cyber security governance.

The specialist will be expected to commence work in early January 2020. ACIAR will accept quotes for on a fixed price or capped time and materials basis.