Government releases new framework to strengthen data protections

The prevalence of data breaches and AI have shown up failings in how organisations protect data.

A new voluntary data classification framework has been released by the Federal Government as part of the national Cyber Security Strategy to help organisations better protect their data.

“It's government offering industry a shared language for understanding and protecting data,” said Lizzy Jones, head of data and AI at Interactive.

The Industry Data Classification Framework (IDCF), developed in partnership with the CSIRO, is designed to work for small-medium enterprises up to large organisations. The Department of Home Affairs will work closely with industry to support adoption of the IDCF.

The framework is intended to help organisations understand the value of their data, identify and manage risks, apply protections and share data securely. A framework that separates risk from controls

Jones said it brings private sector organisations in line with public sector agencies data protection measures.

“The public sector has had Protective Security Policy Framework (PSPF) classifications for years, but industries have had nothing common, so everyone invented their own scheme, and the minute data crossed a boundary the labels stopped meaning anything,” she said.

The framework separates the risk decision from the control decision, and Jones is positive about this approach because “prescriptive control lists age badly, a risk-based language doesn’t”.

“It tells you how to reason your way to a Data Security Level from 0 through to 5+, then leaves you to pick tools that meet or exceed it,” she said.

“The other thing it gets right is markers. You can say ‘DSL-3, Confidential’ and keep existing conventions instead of throwing them out such as the Microsoft Information Protection sensitivity labels,” she added.

One of the main benefits, according to Jones, is that it steers organisations towards how to manage their data rather than reinventing labelling schemes.

“This framework will get organisations past the basics to what really matters, which is deciding what data is important to you, how you want to manage it, and where it should live,” she told CRN Australia.

However, she cautions that there can be pitfalls with any classification system. “If this becomes an exercise where people have to manually label data (such as documents), they'll mark everything high to be safe or they won't label anything at all. The framework is the easy half,” she said.

What it means for service providers

For MSPs and MSSPs, adherence with the framework could become a tender question, according to Jones, because if a system claims to meet a DSL, the owner should be able to show it, and the data owner has to check.

“Providers that can clearly demonstrate how their platforms support and enforce different data security levels will have a significant advantage,” she said.

It should make multi-tenant work easier. “We deal with hundreds of customers, all with homegrown schemes. A common scale means a customer's DSL-4 data is handled the same way regardless of whose it is, which helps with playbooks, escalation, retention and response,” she explained.

And while it’s a voluntary framework, that doesn’t mean it’s optional, Jones noted. “Voluntary often becomes effectively mandatory through procurement, customer expectations and insurance obligations long before they show up in regulation,” she said.