Security, Privacy and Platform Protection

Overview

Assessment Manager has been designed using enterprise-grade cloud infrastructure and modern security technologies to provide a secure, reliable and resilient platform for managing organisational assessments, benchmarking, validation, improvement planning and supporting evidence.

Protecting customer information is fundamental to the platform. Multiple layers of physical, technical and administrative security controls work together to safeguard organisational information against unauthorised access, cyber threats, accidental loss and system failure.

Assessment Manager supports organisations in meeting their information security and privacy obligations through secure cloud hosting, encrypted communications, role-based access controls, continuous infrastructure monitoring and internationally recognised security standards.

The platform has been designed to support Australian organisations in managing information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) while providing a highly available and secure environment for operational information.

Security at a Glance

International Security Standards

Assessment Manager is hosted on enterprise cloud infrastructure designed to align with internationally recognised information security and privacy standards.

ISO 27001 – Information Security Management

ISO 27001 is the internationally recognised standard for Information Security Management Systems (ISMS). It provides a structured framework for identifying, managing and continually improving information security risks across people, processes and technology.

ISO 27017 – Cloud Security

ISO 27017 provides additional security controls specifically designed for cloud computing environments. It strengthens the protection of cloud-hosted applications and helps ensure secure management of cloud infrastructure.

ISO 27018 – Protection of Personal Information

ISO 27018 focuses on protecting personally identifiable information (PII) stored within public cloud environments and provides additional privacy controls for customer information.

ISO 27701 – Privacy Information Management

ISO 27701 extends ISO 27001 by providing a framework for managing privacy information and supporting compliance with modern privacy legislation and recognised privacy principles.

SOC 2 Type II

SOC 2 Type II is an independent audit framework that evaluates the effectiveness of security controls relating to security, availability, confidentiality and privacy over an extended period.

SOC 3

SOC 3 provides independent public assurance that appropriate security controls have been implemented and are operating effectively.

PCI DSS Level 1 Infrastructure

The underlying cloud infrastructure supports PCI DSS Level 1 security requirements, representing the highest recognised level of payment infrastructure security.

Enterprise Security Features

Assessment Manager incorporates multiple layers of security to protect organisational information throughout its lifecycle.

Encrypted Communications

All information transmitted between your browser and Assessment Manager is protected using TLS 1.2 or higher over HTTPS connections.

Encryption helps prevent information from being intercepted while travelling across the internet and ensures communications remain secure.

Encryption of Stored Information

Information stored within Assessment Manager is protected using AES-256 encryption or equivalent enterprise-grade encryption technologies.

Encryption at rest helps protect organisational information should physical storage media ever be compromised.

Secure Authentication

Every user is provided with an individual account and secure authentication credentials.

Users should never share login details or use shared accounts, ensuring every assessment, improvement action and uploaded document can be attributed to an individual user.

Role-Based Access Control

Assessment Manager uses role-based permissions to ensure users only have access to information appropriate for their role.

Organisation Administrators control user access and can assign permissions based on organisational responsibilities and facility access.

Infrastructure Monitoring

The hosting environment is continuously monitored for security events, performance issues and suspicious activity.

Continuous monitoring enables rapid identification and response to potential security risks and contributes to maintaining platform availability.

DDoS Protection

The platform incorporates Distributed Denial of Service (DDoS) protection to help safeguard against malicious attempts to disrupt platform availability.

This protection helps maintain service continuity during abnormal or malicious network activity.

Web Application Firewall (WAF)

Application traffic is protected through a Web Application Firewall, which helps identify and block common web-based attacks before they reach the application.

This provides additional protection against malicious traffic and application vulnerabilities.

Automatic Security Updates

Platform infrastructure and supporting services are regularly updated with security patches and software improvements.

Applying updates promptly helps protect against newly identified vulnerabilities and emerging cyber threats.

Backup and Disaster Recovery

Assessment Manager is hosted on resilient cloud infrastructure incorporating automatic backups, redundancy and disaster recovery capabilities.

These measures help protect customer information and support business continuity in the unlikely event of infrastructure failure.

Physical Data Centre Security

The enterprise cloud infrastructure incorporates multiple physical security controls including monitored facilities, controlled access, environmental monitoring and redundant power and network systems.

User Responsibilities

While Assessment Manager provides enterprise-grade security, every user plays an important role in protecting organisational information.

Users should:

• Use strong, unique passwords.

• Never share user accounts.

• Keep browsers and operating systems updated.

• Log out when using shared devices.

• Only upload authorised and relevant evidence.

• Protect confidential organisational information.

• Report suspected unauthorised access immediately.

• Ensure personal information is handled responsibly.

Organisation Administrators should also regularly review user permissions, remove inactive accounts and ensure employees only have access appropriate to their responsibilities.

IT Requirements

Assessment Manager is a cloud-based application and does not require software installation.

For optimal performance we recommend:

• Latest version of Google Chrome, Microsoft Edge, Safari or Mozilla Firefox.

• Reliable broadband internet connection.

• JavaScript enabled.

• Cookies enabled.

• Screen resolution of 1366 × 768 or higher.

• PDF reader for downloaded reports and documents.

• Modern desktop or laptop computer for completing detailed assessments.

Tablets and modern mobile devices are supported; however, desktop devices provide the best experience when reviewing dashboards, completing assessments and uploading evidence.

Privacy and Information Management

Assessment Manager stores organisational information including assessment data, improvement actions, uploaded evidence and limited user account information required to operate the platform.

Access to information is controlled through user authentication and role-based permissions.

Users should only access information necessary to perform their duties and should not upload confidential or personal information unless authorised by their organisation and directly relevant to the assessment or improvement activity.

Security Best Practice

To maximise the security of your Assessment Manager account, we recommend that organisations:

• Review user permissions regularly.

• Remove former employees promptly.

• Use individual user accounts.

• Enable strong password practices across the organisation.

• Keep browsers updated.

• Avoid unsecured public Wi-Fi when accessing sensitive information.

• Review uploaded evidence before publishing.

• Regularly monitor improvement actions and organisational activity.

• Report suspicious activity immediately.

Following these practices helps ensure Assessment Manager continues to provide a secure and trusted environment for managing organisational risk, compliance and continuous improvement.

Frequently Asked Questions

Is Assessment Manager encrypted?

Yes. All data transmitted between users and Assessment Manager is protected using TLS 1.2+ encrypted HTTPS connections, while stored information is protected using AES-256 encryption or equivalent enterprise-grade encryption technologies.

Is Assessment Manager hosted on secure cloud infrastructure?

Yes. Assessment Manager is hosted on enterprise-grade cloud infrastructure incorporating redundancy, automatic backups, disaster recovery capabilities, continuous monitoring and multiple layers of physical and cyber security.

How is the platform protected against cyber attacks?

The platform incorporates multiple security controls including DDoS mitigation, Web Application Firewall (WAF) protection, encrypted communications, infrastructure monitoring, secure authentication and regular security updates.

Who controls access to my organisation's information?

Access is managed through role-based permissions. Organisation Administrators determine which users have access to organisational information and assign permissions appropriate to each user's responsibilities.

Does Assessment Manager comply with recognised security standards?

The enterprise cloud infrastructure supporting Assessment Manager aligns with internationally recognised security and privacy standards including ISO 27001, ISO 27017, ISO 27018, ISO 27701 and independent SOC security assurance frameworks.

What can my organisation do to improve security?

Maintain strong password practices, review user permissions regularly, remove inactive accounts promptly, use individual user accounts, keep browsers updated and ensure staff follow good cyber security practices when accessing Assessment Manager.