Information Security Reporting
The information on this page provides a generic overview of reporting to OVIC on information security matters.
Reporting deliverables and timeframes
| wdt_ID | Deliverable | Timeframe |
|---|---|---|
| 2 | Provide OVIC with an Attestation by the public sector body Head. | Annual |
| 3 | Submit a PDSP (including an Attestation) by the public sector body Head. | Biennial (every 2 years) |
| 4 | Submit an updated PDSP to OVIC, if there is significant change to the:
|
In consultation with OVIC |
| 5 | Notify OVIC of any information security incidents that compromise the confidentiality, integrity, or availability of public sector information, with a ‘limited’ business impact or higher, on government operations, organisations or individuals. | As required |
What is required this year?
For tailored guidance on what is required this year, select from the options below.
Victorian public sector stakeholder
Class B cemetery trust stakeholder
Committee of Management of Crown Land Reserves stakeholder
Protective Data Security Plan
What is a Protective Data Security Plan (PDSP)?
A PDSP serves several purposes. It is designed to:
- help an agency or body assess its information security capability,
- summarise the organisation’s progress towards implementation of the Victorian Protective Data Security Standards (VPDSS or Standards) and elements, and
- provide assurance to OVIC that the agency or body is making progress to improving information security.
Agencies or bodies subject to Part 4 of the PDP Act must submit a PDSP to OVIC every two years, or sooner in the event of significant change.
Attestation
Each year, Victorian public sector (VPS) organisations are required to submit an Attestation to OVIC, in which they attest to the continuation of information security activities outlined in their previous Protective Data Security Plan (PDSP).
Significant change
Section 89(4) of the PDP Act requires VPS agencies and bodies to submit an out-of-cycle PDSP to OVIC if it has undergone, or expects to undergo, a ‘significant change’ to its operating environment or its security risks.
In the event of significant change, contact the Information Security Unit (ISU) OVIC to discuss your reporting options.
Read more about significant change.
Newly established organisations
If your organisation is newly formed, please contact the ISU to receive an overview of the VPDSS and discuss your obligations.
Information Security Incident Notification Scheme
Under VPDSS Element E9.010, VPS agencies and bodies are encouraged to notify OVIC of any compromise of public sector information that may cause ‘limited’ (BIL 2) or higher harm/damage to government operations, organisations, or individuals.
This includes, but is not limited to, information with a protective marking of OFFICIAL: Sensitive, PROTECTED, Cabinet-In-Confidence or SECRET.
Notifying OVIC of an Information Security Incident
Please refer to this page to access a copy of the Information Security Incident notification form and details on the scheme.
Information Security resources
This section contains a suite of resources to assist in understanding and implementing the Victorian Protective Data Security Framework (VPDSF) and the Victorian Protective Data Security Standards (VPDSS).
Contact us
If you need help, please contact us on 1300 006 842 (1300 00 OVIC) between 9:30am to 4:30pm, Monday to Friday, or email us security@ovic.vic.gov.au
OVIC is always looking to improve the quality of its website resources. If you have feedback to share, please email enquiries@ovic.vic.gov.au.