IT Risk Management: Victorian Protective Data Security

This report delves into the realm of IT Risk Management, specifically focusing on the Victorian Protective Data Security Standards (VPDSS). It outlines the obligations mandated by the VPDSS, emphasizing the creation and implementation of a Protective Data Security Plan (PDSP) and a Security Risk Profile Assessment (SRPA). The report meticulously details a five-step action plan, encompassing the identification of information assets, determining their value, identifying risks, applying security measures, and managing risks throughout the information lifecycle. Furthermore, it highlights the differences between risks and uncertainty, providing a comprehensive understanding of these crucial concepts. The report also includes a detailed analysis of the Security Risk Profile Assessment (SRPA) process, which involves workshops, self-assessments, and the creation of a risk matrix. The report concludes by discussing the application of security measures and the importance of managing risks, ensuring the protection of information assets. The document is a valuable resource for understanding and implementing IT risk management strategies within the context of the VPDSS.

Running Head: IT RISK MANAGEMENT
IT RISK MANAGEMENT
VICTORIAN PROTECTIVE DATA SECURITY FRAMEWORK
NAME OF THE STUDENT
STUDENT ID
NAME OF THE UNIVERSITY
AUTHOR’S NOTE

1IT RISK MANAGEMENT
Table of Contents
Introduction....................................................................................................................2
Victorian Protective Data Security Standards (VPDSS) Obligations............................2
Privacy and Data Protection's Five-Step Action Plan....................................................3
Step 1 – Identification of Information Assets............................................................3
Step 2 – Determine the Value of Information Assets................................................3
Step 3 – Identify Risks to Information Assets...........................................................4
Differences between risks and uncertainty..................................................................10

2IT RISK MANAGEMENT
Introduction
The VPDSS standard is intended to drive social change in the Victorian open area and
its related substances with the point of building its data security capacity and strength. The
Commissioner of Privacy and Data Protection under the Department of Premier and Cabinet
has ordered a prerequisite with particular development dates of movement towards VPDSS
consistency for all Victorian Public Sector Agencies and bodies characterised in the Public
Administration Act of 2004. Under the Privacy and Data Protection Act 2014 (Reboredo,
2013), these organisations must create and take part in homes that agree to the VPDSS. Other
administrative commitments incorporate building up a Security Risk Profile Assessment
(SRPA) and presenting a Protective Data Security Plan (PDSP).
It is a particular prerequisite of the VPDSS standard to increase official sponsorship
which implies that the ordered security methodology and hazard administration exercises are
supported and closed down at a senior level when detailing consistency to the Commissioner
for Privacy. The Security Risk Profile Assessment (SRPA) should quantify the association's
development of the 12 administration guidelines and four security areas of the VPDSS
(Sadgrove, 2016). The subsequent crevice examination should then prompt the improvement
of a Protective Data Security Plan (PDSP) with remediation exercises organised on a Risk
Basis and figured out how to guarantee targets are accomplished.
Victorian Protective Data Security Standards (VPDSS) Obligations
The principal deliverable is expected by June 2018 and requires the association to
present their Protective Data Security Plan (PDSP) to the Commissioner of Privacy and Data
Protection (CPDP) with supporting confirmation of the remediation design and advance
(Wiengarten et al., 2016). From there on at regular intervals, a Security Risk Profile
Assessment (SRPA) and the Protective Data Security Plan (PDSP) should be refreshed, and

3IT RISK MANAGEMENT
consistently an authentication from senior administration should be delivered affirming
consistency with the VPDSS structure.
Figure 1: Victorian Government Risks
(Source: Created by author)
Privacy and Data Protection's Five-Step Action Plan
Step 1 – Identification of Information Assets
The initial step to having the capacity to give fitting assurance to your data resources
is to realise what Information Assets you have. The result of this progression is to create an
Information Asset Register that is practical and direct to keep up. IPSec will guarantee that
proper documentation exists for the distinguished Information Assets. This is regularly
performed through a staff meeting and documentation survey process.
Step 2 – Determine the Value of Information Assets
The result of this progression is to finish the Information Asset enrol with
arrangement levels for all recognised Information Assets. Utilizing Victorian Office of the
Commissioner of Privacy and Data Protection (CPDP) affirmed apparatuses, for example, the
Business Impact Level App, IPSec will recognise the fitting characterisation for Example

4IT RISK MANAGEMENT
Department Information Assets. The outline underneath demonstrates an abnormal state
visual portrayal of the Information Asset Assessment Process:
Step 3 – Identify Risks to Information Assets
VPDSS Deliverable 1 - Security Risk Profile Assessment (SRPA): The establishment
for the SRPA is a development appraisal measured against the 18 Standards of the VPDSS.
This will be finished through the accompanying exercises:
1. A Half-Day Workshop the motivation behind this workshop is three-overlay:
a) To guarantee senior administration and venture partners comprehend the reason and
destinations of the VPDSS Standard and the authoritative commitments;
b) To build up the required measures arrangement levels for the crevice investigation;
and
c) To recognise proposed whole research evaluation members.
The VPDSS evaluation appears as an online survey where respondents are required to
evaluate their apparent current level of arrangement concerning the necessary controls. The
poll adjusts precisely to the VPDSS gauges necessities and is in English dialect frame that
does not require IT ability to reply. The inquiries are related to the path in which
data/information is dealt with inside the association. Fitting respondents might be in the
vicinity of 3, and five essential workers finished the online studies given their expected set of
responsibilities speaking to a significant cross area of Information clients. For instance, the
CIO, HR Manager, IT Manager, key power client, Sys Admin or Records Managers would be
a typical study field.
2. Completion of the self-evaluation: Every respondent will get an online connection to the
poll and can be required to finish the evaluation of a predetermined time. The study can
be completed in different settings and will be considered finished once submitted. The

5IT RISK MANAGEMENT
survey requires the clients to choose one of five pre-characterized reactions. A VPDSS
study will take the average individual around 2 hours to complete. The inquiries and
answers are altogether given in plain English, dodging specific language. The upside of
this is the clients don't need to have point by point specific information to provide a
productive impact.
3. Self-evaluation results and survey: Toward the consummation of the appraisal, the
accompanying yield is created:
 Management Summary of High Business Risks
 Risk Diagram gathering by Likelihood and Consequence
 Cause Graphs demonstrating joins from business hazards back to control
shortcomings
 Gap Analysis indicating deviation amongst Expected and Assessed Maturity
 Compliance Summary mapping differences to particular statements in the VPDSS
Standards Cases of Risk Diagram and Associated Gap Analysis
Every distinguished crevice will be checked on and shown inside a benchmarks
agreeable hazard network, and detailed in a simple to peruse charts as demonstrated as
follows:
4. Creation of the Security Risk Profile Assessment (SRPA): Audit of the self-evaluation
yield and acknowledgement and prioritisation of the dangers will shape the establishment
of the SRPA.
Step 4 – Apply Security Measures to Protect the Information Assets

6IT RISK MANAGEMENT
VPDSS Deliverable 2 - Protective Data Security Plan (PDSP): Toward the fruition of
the SRPA, this progression will concentrate on arranging the remediation exercises required
to address the Information Security Risks prompting the plan of a PDSP. The Protective Data
Security Plan (PDSP) A Post Assessment audit will encourage handover of SRPA duties to
Example Department administration and the PDSF exercises to the people in charge of the
continuous management of the remediation undertakings.
The Senior Management Attestation
The chose PDSP components will be organised, planned and extend overseen
(Pritchard & PMP, 2014). IPSec will help with this movement and will confirm to support the
required high administration validation for the Privacy Commissioner that the PDSP
addresses the VPDSS guidelines.
Step 5 – Manage Risks Across the Information Lifecycle
The IPSec technique and related brilliant apparatuses enable Example Department to
effortlessly deal with their Information Asset Risks over their whole lifecycle (McNeil, Frey
& Embrechts, 2015). The logic of the IPSec Methodology is that overseeing danger ought to
be a day by day movement, in a comparable way to checking email or web-based social
networking bolsters. Along these lines, hazard administration is performed in little, chomp
estimated pieces that are sensible and non-nosy.
Hazard Register Dashboard and Task Manager
The online dashboard enables the dangers to be gathered (on a whole or select
premise) demonstrating the Risk craving versus Residual hazard given the Protective Data
Security Plan (Lam, 2014). As dangers are moderated through control upgrades, the
dashboard appears the diminishment progressively in the Example Department chance
profile. The inbuilt errand administrator makes doling out and overseeing singular
undertakings direct.

7IT RISK MANAGEMENT
Progressing Support and After Sales Care
After the hand-over of the venture to Example Department for Business-As-Usual
exercises, IPSec can give a full suite of offerings to help with executing controls for the relief
of Information Asset Risks. IPSec's Master Security Engineers, 24x7x365 Security
Operations Center and Security Consultants are accessible for your help (Hopkin, 2017);
influencing your trip to full VPDSS consistency to smooth and inconvenience free.
Keen Tools, not Spreadsheets
Utilizing bright, modern cutting edge apparatuses (not spreadsheets), IPSec gives
Information Security Standards based administrations in a drastically diminished period,
redid to your association's prerequisites. IPSec conveys the necessary communication with
your starts fitting business clients using an expert SAAS instrument that carries significant
help for administrative and consistency based exercises in an adaptable and exceptionally
time proficient way (Glendon, Clarke & McKenna, 2016). Utilizing brilliant innovation, all
the hard, manual work of principles based evaluation arrangement and whole investigation is
significantly diminished; giving Industry Standards content contained in an easy to use
interface. It brings together revealing and research, with developing philosophies for
performing consistency examination in a financially savvy and proficient way.
Venture Management
IPSec Consult's advisors are exceptionally aware of the significance of appropriate
venture administration to guarantee the quality results required by Example Department In
that capacity we keep up strict experiment start, conveyance and fruition administrations to
accomplish an ideal result for example Department and to guarantee the slightest conceivable
impedance to both the venture transfer and the affected data condition (DeAngelo & Stulz,
2015). After being locked in by Example Department to convey proficient hazard

8IT RISK MANAGEMENT
administrations, IPSec Consult will ask for that an essential purpose of contact be doled out
by Example Department to go about as a definitive proprietor of the venture inside Example
Department's association. IPSec Consult extends all require a start, conveyance and finish
arrange (Collignon et al., 2016). While the particular segments that make up these stages may
fluctuate in light of the expectations of the venture, IPSec Consult keeps up these predictable
viewpoints to guarantee a quality result. These include:
Venture Kick-Off (Initiation)
 Liaise with the customer to set up essential contact, and other key communication
focuses.
 Liaise with customer to set up abnormal state timetable of exercises and assets.
 Liaise with a client in regards to extra points of interest that might be required for the
venture.
Venture Delivery
If the venture conveyance time is longer than seven days, hold week after week
gatherings (phone or face to face) to:
 Update customer on transportation advance.
 Review timetable of exercises and assets.
 Liaise with the customer in regards to extra specialised subtle elements that might be
required.
 Liaise with the client in regards to different issues influencing conveyance of venture
results.
Venture Completion
Provide the customer with a venture finish report sketching out exercises attempted,
discoveries of the experiment (Cole et al., 2013), proposals from the venture, and references
helpful to the customer because of the venture.

9IT RISK MANAGEMENT
 Where fitting IPSec Consult may prescribe for a draft answer to be given, and
additionally, a report introduction be offered preceding the last reply to permit the
customer to survey the discoveries and results of the venture and to look for
elucidation on purposes of the investment results.
Differences between risks and uncertainty
The uncertainty is an absence of finish conviction. In instability, the result of any
occasion is obscure, and it can't be measured or speculated (Chance & Brooks, 2015). Here
you don't have any foundation data on occasion. Presently you may contend that instability is
the same as obscure dangers, notwithstanding, vulnerability is not an obscure hazard. In
vulnerability, you totally do not have the foundation data of an occasion despite the fact that
it is distinguished (Calkin et al., 2014). On account of an obscure hazard, despite the fact that
you have the foundation data, you just miss it amid the distinguish dangers process.
According to the PMBOK Guide Fifth release, "Risk is an unverifiable occasion or
condition that, on the off chance that it happens, has a positive or negative impact on at least
one anticipate goal, for example, scope, calendar, cost, and quality (Brindley, 2017)." But
essentially, a hazard is an impromptu occasion, and on the off chance that it happens it might
influence any of your venture goals. On the off chance that it affects your venture decidedly
than the hazard is certain, and if it impacts the investment adversely it is an adverse risk.
There are separate hazard reaction systems for negative and positive dangers (Bolton, Chen &
Wang, 2013). The goal of an adverse risk response system is to limit the effect of serious
threats, and the target of an effective hazard reaction methodology is to amplify the
possibility of actual dangers happening. You may likewise find out about two more dangers
terms: known dangers and obscure dangers. Known dangers are those dangers which you
have recognized amid the distinguish dangers process and obscure dangers are those dangers

10IT RISK MANAGEMENT
which you couldn't distinguish amid the distinguish dangers process (Aven, 2016). An
emergency course of action is made for known dangers, and you will utilize the possibility
hold to deal with these dangers. Then again, obscure dangers are overseen through a
workaround and the administration save is utilized to deal with these sorts of dangers.
 Risk can predict the possibilities of future outcomes
 Uncertainty cannot predict the possibility of future outcome
 Risk is moreover controllable but uncertainty is not
 Risk is also measurable while uncertainty is not
 Where there is risk there can is probability while in the case of uncertainty it is
different
People mistakes uncertainty with risk while the both are two very different things,
managing risk is easier because of it is identifiable and it is roughly based on the previous
experiences of the person (Agca et al., 2017). On the other hand, managing uncertainty is
very hard because ofe its lack of earlier records. There are various parameters involved in this
case therefore identification or prediction of it is not simple.

11IT RISK MANAGEMENT
References
Agca, R., Heslinga, S. C., Rollefstad, S., Heslinga, M., McInnes, I. B., Peters, M. J. L., ... &
Primdahl, J. (2017). EULAR recommendations for cardiovascular disease risk
management in patients with rheumatoid arthritis and other forms of inflammatory
joint disorders: 2015/2016 update. Annals of the rheumatic diseases, 76(1), 17-28.
Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their
foundation. European Journal of Operational Research, 253(1), 1-13.
Bolton, P., Chen, H., & Wang, N. (2013). Market timing, investment, and risk
management. Journal of Financial Economics, 109(1), 40-62.
Brindley, C. (Ed.). (2017). Supply chain risk. Taylor & Francis.
Calkin, D. E., Cohen, J. D., Finney, M. A., & Thompson, M. P. (2014). How risk
management can prevent future wildfire disasters in the wildland-urban
interface. Proceedings of the National Academy of Sciences, 111(2), 746-751.
Chance, D. M., & Brooks, R. (2015). Introduction to derivatives and risk management.
Cengage Learning.
Cole, S., Giné, X., Tobacman, J., Topalova, P., Townsend, R., & Vickery, J. (2013). Barriers
to household risk management: Evidence from India. American Economic Journal:
Applied Economics, 5(1), 104-135.
Collignon, P. C., Conly, J. M., Andremont, A., McEwen, S. A., Aidara-Kane, A., World
Health Organization Advisory Group, Bogotá Meeting on Integrated Surveillance of
Antimicrobial Resistance (WHO-AGISAR), ... & Dang Ninh, T. (2016). World
Health Organization ranking of antimicrobials according to their importance in human