IS18 applicability, exceptions and departures guideline

Accountable officers

Accountable officers not already in scope of the Public Sector Act 2022 (Qld), but are in scope of the Financial and Performance Management Standard 2019 (Qld), must have regard to IS18. See What does ‘must have regard to’ mean? for information regarding this requirement.

Other entities strongly recommended to apply IS18

Local government

Local government councils are not required to comply with IS18 unless their Minister or Responsible Head, who has a shared responsibility for the local government council, has directed them to do so. However, it is strongly recommended that local government councils adopt IS18 (inclusive of all policy requirements and reporting requirements) to improve cyber posture and importantly, engage with the QGCSU for any incidents. It is also strongly recommended that local government report incidents to the QGCSU at the earliest opportunity to enable support and sharing of intelligence.

Government owned corporations

Government owned corporations (GOCs) are not required to comply with IS18 unless their Minister or Responsible Head, who has a shared responsibility for the GOC, has directed them to do so. However, it is strongly recommended government owned corporations adopt IS18 (inclusive of all policy requirements and reporting requirements) to improve cyber posture and importantly, engage with the QGCSU for incidents. It is also strongly recommended that GOCs report incidents to the QGCSU at the earliest opportunity to enable support and sharing of intelligence.

See Appendix B for an overview of IS18 applicability across all entities.

Applying IS18

The QGEA uses key word conventions to communicate what is and isn’t mandatory when interpreting QGEA documents. IS18 adopts this same keyword convention.

Please note that documents such as standards and frameworks that are mandated under IS18 will generally adopt the same keyword convention but may use the word ‘SHALL’ as an alternative to ‘MUST’, but the same description will apply.

What does ‘must apply’ mean?

Agencies within scope (e.g., departments, public service entities, directed entities) must apply both the policy requirements and the reporting requirements within IS18.

What does ‘must have regard to’ mean?

Section 5 of Financial and Performance Management Standard 2019 (Qld) defines ‘must have regard to’ to mean that the accountable officer or statutory body complies by:

• considering the contents of the document (IS18).
• deciding whether the contents apply in the circumstances.
• if the contents apply – applying the contents.

That is, ‘must have regard to’ means making a conscious and documented decision to follow or not to follow (and therefore not apply) IS18.

If you are considering making a conscious and documented decision not to follow IS18, we highly recommend you undertake a risk assessment and ensure the accountable officer signs off on the risk assessment and final decision.

Where you choose to apply IS18, you must implement all policy requirements and reporting requirements. In particular it is extremely important you report cyber incidents in a timely manner to the Queensland Government Information Security Virtual Response Team (QGISVRT) as per the QGEA Information Security Incident Reporting Standard.

See Appendix C for a decision flow chart about applicability.

Exceptions and departures

Agencies can document non-compliance with IS18 in two ways: through an exception, or a departure.

Exceptions

An exception is where an agency cannot comply with one or more IS18 policy requirements and/or reporting requirements.

Agencies can apply for exceptions as per the QGEA Alignment and exceptions process. In summary, to gain an exception an agency must provide evidence that a risk assessment has been conducted to understand the impact to the agency, to other impacted agencies, or to whole-of government where a policy requirement cannot be met. This risk assessment must be signed off by the accountable officer or relevant nominated delegate.

Exceptions are submitted to the Queensland Government Chief Customer and Digital Officer for endorsement. Exceptions may also be submitted to a relevant whole-of-government governance body if deemed necessary.

Departures

A departure is where an agency cannot or elects not to meet part of a QGEA policy requirement or reporting requirement. This can also include not meeting a sub requirement within a mandated standard or framework under IS18 (e.g., departure from a single control).

Where an agency has a departure from a sub requirement within a mandated standard or framework under IS18 (e.g., departure from a single control), agencies can undertake a risk assessment and have this approved by the agency accountable officer.

Departures do not require any whole-of-government endorsement.

Documenting exceptions and departures can be useful evidence for agencies auditing purposes.

When do multiple departures become an exception?

If you answer yes to any of the following questions, then you should apply for an exception:

• Are multiple departures impacting whole-of-government operations, or more than one agency?
• Is there an exceptional degree of complexity or unknown factors?
• Are there significant risks which would warrant additional consideration from a whole-of-government perspective?
• Could the multiple departures impact auditing reports?

Exception example:

A statutory body has just been notified by their shareholding minister that they are in scope of IS18. This statutory body has not completed an annual return before and would like to focus on implementing IS18 for the first 12 month before starting reporting. They have asked for a 12-month exception from the annual return.

Departure or exception?

An agency has recently been moved into a new government department. They have identified that they are meeting half of the Essential Eight controls and have documented it as a departure. However, after documenting the risk assessment, the agency has determined these risks to be such that warrant an exception due to the potential impact to other agencies. The agency then requests a 6-month exception from parts of the Essential Eight.

Departure example:

An agency is considering a departure from a single Essential Eight Requirement: Online services that are no longer supported by vendors are removed - SM-1905. The vendor for the service is no longer suitable but the risk of stopping the service is greater than the risk of no vendor support. There are limited vendors for this service, so the agency is considering a departure for 6-months, or until a new vendor has been chosen.