1. The purpose of our procedure
Adelaide University manages cyber security to protect the confidentiality, integrity and availability of its records, information, systems and services.
Our procedure establishes consistent standards across IT environments and sets clear accountability for Business Custodians and IT Custodians. It defines the responsibilities and actions required to manage cyber risks and respond to threats. All related processes, standards and frameworks including incident response, vulnerability management, asset classification and training are mandatory and enforceable under this procedure. This ensures effective cyber risk management and regulatory compliance across Adelaide University.
This procedure supports the Cyber Security Policy.
Please read this procedure in conjunction with the:
- IT Acceptable Use Policy
- IT Acceptable Use Procedure
- Information Governance Policy
- [Information Governance Procedure]
- [Data Management Procedure]
- Records Management Procedure
- [AI Policy and associated procedures]
- [Distributed IT Governance Framework].
2. Who our procedure applies to
This procedure applies to all members of the Adelaide University community. It covers the following systems and services:
- Adelaide University-owned or leased systems, platforms, infrastructure and data
- cloud-hosted and vendor-managed Information Technology (IT) services used for Adelaide University business
- all systems used for Adelaide University business.
This procedure authorises the Chief Information Officer (CIO) to maintain associated frameworks, standards and protocols.
3. Our cyber security procedure
3.1 How we apply a risk-based approach
3.1.1 Adelaide University identifies and documents cyber security risks through formal assessments conducted during system acquisition, development or modification.
3.1.2 Risks identified must be recorded in accordance with the Risk Management and Legal Compliance Policy and the Risk Management Procedure.
3.1.3 Risk owners must ensure these risks remain within Adelaide University’s risk appetite. Where a risk remains outside our risk appetite, it must be approved by the Chief Information Officer (CIO) (or delegate).
3.1.4 Mitigation actions must be tracked through the relevant business unit or project team.
3.1.5 IT and risk owners must review risk assessments annually, at minimum, or following any system changes or incidents.
3.2 How we embed security in activities
3.2.1 Technology acquisitions and system changes must undergo a cyber security review prior to approval. This includes software, cloud services, infrastructure and third-party platforms.
3.2.2 Third‑party and cloud services must undergo a security and privacy assessment, and contracts must include university security, privacy, breach-notification and right‑to‑audit requirements proportionate to risk and data classification.
3.2.3 Project teams must complete a Security Impact Assessment (SIA) during planning stages. The IT Services team will guide design decisions to ensure security is embedded throughout the system lifecycle.
3.3 How responsibility is defined and assigned
3.3.1 The CIO is accountable for cyber security governance and resourcing.
3.3.2 The Chief Technology and Security Officer (CTSO) owns the cyber security program, standards, monitoring and incident response, and has authority to set minimum controls and required remediation.
3.3.3 Information owners must ensure appropriate classification, access controls and protection of their information assets.
3.3.4 IT ownership must be formally assigned and reviewed at least every 12 months.
3.3.5 Business custodians are accountable for the data and business processes supported by their systems. They are responsible for ensuring required security controls and risk treatments are implemented and operating effectively, and for escalating residual risks that fall outside risk appetite to the CIO (or delegate) for determination.
3.3.6 IT custodians must ensure the environments they manage comply with Adelaide University’s cyber security, risk management and compliance requirements, including secure configuration, patching and audit logging, and must evidence compliance as requested.
3.4 How we apply operational and technical controls
3.4.1 All IT users at Adelaide University must:
- create and maintain strong, unique passwords and enable multi-factor authentication (MFA)
- keep all Adelaide University-managed and personal devices secure by installing software updates and antivirus tools
- never share passwords or access tokens, even with colleagues or supervisors
- report stolen, lost, or compromised devices immediately to the Technology - Services Hub.
3.4.2 System Implementation team must implement baseline security controls, including:
- strong passwords and enabling multi-factor authentication (MFA)
- encryption of sensitive data in transit and at rest
- endpoint protection and anti-malware tools
- regular vulnerability scanning and patching
- secure disposal of data and devices in line with records management requirements.
3.4.3 IT custodians must document how these controls are applied and report annually to the Cyber Security, Architecture and Data teams.
3.5 Local administrator rights
3.5.1 End-user computing devices (desktops, laptops, mobile workstations) must not assign default local administrator rights to users.
3.5.2 If a user is approved to have local administrator access to a device for ongoing needs, they will be able to get a temporary administrator password for 24 hours through an automated process, without the need to log a request in ServiceNow.
3.5.3 Temporary access must be time-bound and auto-expire after the authorised period.
3.6 Requests for local administrator access must:
3.6.1 be submitted via the ServiceNow platform using the approved request form for a once-off standing exemption that is time limited, and
3.6.2 include clear business justification, duration of access, and a designated responsible officer, and
3.6.3 undergo risk assessment by the IT Security team, in consultation with the IT Custodian, and
3.6.4 have exceptions approved by the reporting line function executive and CTSO (or delegate). View the Transition Rules Procedure.
3.7 How to respond to security incidents
3.7.1 Suspected or confirmed cyber security incidents must be reported by the affected user immediately to the IT Service Desk or Cyber Security Operations team via the approved channels.
3.7.2 Incidents are classified into low, medium, high or critical based on potential impact. View the Information Breach Procedure.
3.7.3 The Cyber Security Operations team will investigate and respond to incidents, coordinating with Legal, Risk and Compliance teams as required.
3.7.4 Potential data breaches must be assessed under the Notifiable Data Breaches (NDB) scheme within required timeframes. Any notification to the Office of the Australian Information Commissioner (OAIC) and affected individuals will be coordinated by the Privacy Officer (in consultation with Legal and the CTSO).
3.8 Monitoring of System use, Metadata and content
We collect and analyse information about how our systems are used to keep them secure, protect organisational information, meet legal obligations, and support day-to-day operations.
Monitoring of the use of university IT systems is also addressed in the IT Acceptable Use Procedure under ‘3.3 Monitoring and analysis of IT usage’, which sets out the notification and consent that applies. This procedure describes how that monitoring is operated as a cyber security control.
For this procedure, we distinguish between:
- System activity information – information about how systems are used, such as user IDs, login activity, file names and locations, access permissions, sharing activity, timestamps, device details, and network activity.
- Content – the actual information contained in documents, emails, messages, files, images, recordings, and other communications.
We routinely monitor and analyse system activity information using automated tools to support cyber security, compliance, data governance, and operational management. This monitoring generally does not involve reviewing the content of documents, emails, messages, or other communications.
Access to content will only occur when reasonably necessary for a legitimate business purpose, including:
- investigating suspected breaches of law, policy, or security requirements
- responding to cyber security incidents or threats
- locating, recovering, or restoring organisational information
- meeting legal, regulatory, audit, or law enforcement requirements
- supporting business continuity, operational recovery, or system administration
- other authorised business purposes.
Any access to content will be limited to what is reasonably necessary, subject to appropriate authorisation and applicable legal and privacy requirements.
The use of automated tools to analyse system activity information and other non-content data forms part of our routine security and monitoring activities and may occur without individual notice.
3.9 Triggers for examining an individual user
The University may examine the activity, communications, or content associated with an individual user account only where one or more of the following conditions apply:
3.9.1 If there is a reasonable basis to suspect that the user has breached applicable legislation, university policies, standards, procedures, or other authorised requirements.
3.9.2 When access can be justified to support a legitimate or business need to retrieve information associated with the users account to support legitimate university operations, including continuity of business activities, recovery of university records, or access to information necessary for authorised institutional purposes.
3.9.3 Where a request for examination has been made by the user's Dean of School (or equivalent) and the request is supported by a legitimate business, operational, compliance, or risk-management purpose.
3.9.4 Examination of Individual User Accounts.
- Any examination of an individual user account must be authorised, proportionate to the purpose, and conducted in accordance with applicable legal, privacy, and information security requirements.
- A targeted examination of an individual user account must not proceed without documented approval from the CIO or CTSO, or another designated approving officer.
- Before approving the examination, the approving officer must be satisfied that the request is reasonable, necessary, proportionate, and supported by a legitimate purpose. The approving officer should be independent of the area requesting the examination.
- The approval record must include the reason for the examination, its scope, duration, and any limits on access. This ensures appropriate oversight, accountability, and separation of duties.
3.10 Disclosure of retrieved information and records
When information is retrieved it may be disclosed to the Dean of School (or equivalent) or the appropriate authority which may include outside authorities where the University has a legal obligation to disclose.
3.11 Our cyber awareness training
3.11.1 All members of the Adelaide University community who access the University’s technology environment must complete cyber security awareness training upon commencement and annually thereafter. Non‑completion may result in access suspension or disciplinary action.
3.11.2 The Cyber Security Operations team delivers additional campaigns, simulations (for example phishing simulations) and learning resources throughout the year as part of the annual Cyber Security Training and Awareness Program. Additional individual training may be required based on the outcomes of these activities.
3.11.3 Line Managers must ensure their teams complete required training and may request additional training and support briefings as required.
3.12 How we monitor and audit our cyber security posture
3.12.1 Adelaide University IT systems must log user activity, system changes and access to sensitive data. Logs must be retained for a minimum of 12 months and reviewed periodically by IT Security.
3.12.2 Internal cyber security audits must be conducted at least every two years. Findings and recommendations must be documented and actioned by responsible units.
3.12.3 Cyber security control testing must be conducted at least annually, including business continuity testing, independent assessments or penetration testing after material changes.
3.13 How we review and improve our practices
3.13.1 Our procedure will be reviewed at least every two years, or as required in response to significant incidents, regulatory change, or audit findings.
3.13.2 Continuous improvement is informed by incident learnings, audit outcomes and emerging threats. Updates to affected systems, services or domains must be approved by the CIO or the relevant accountable authority under the University's Delegation Register.
4. Governance and enforcement
This section sets out reporting, investigation, and disciplinary processes, and includes obligations under the OAIC NDB scheme.
4.1 Breaches of policy or procedure
Breaches of our policy or procedure may include:
- failing to apply required cyber security controls
- mishandling confidential or sensitive information
- using university systems without authorisation
- ignoring known vulnerabilities or security recommendations.
Breaches may be unintentional or deliberate. All incidents must be reported to the IT Service Desk and reviewed by the Cyber Security Operations team.
4.2 Disciplinary action and legal consequences
Disciplinary action and legal consequences of a data breach may include:
- removal of system access
- performance or disciplinary action (for staff or students)
- termination of contracts (for third parties)
- referral to regulators or law enforcement in serious cases.
Disciplinary responses are aligned with the Student Code of Conduct, Student Misconduct Procedure, Staff Code of Conduct, and employment contracts.
4.3 Reporting and notifying data breaches (OAIC NDB Scheme)
If a security incident involves the unauthorised access, disclosure or loss of personal information that is likely to cause serious harm:
- an immediate assessment will be conducted.
- affected individuals and the OAIC must be notified in accordance with the Privacy Act 1988 (Cth).
- risk-mitigation measures must be activated to prevent further harm.
The CTSO leads the assessment and notification process and coordinates with Legal and Privacy teams where required.
4.4 Audit, logging and oversight
The CTSO sub-function must:
- monitor and audit adherence to cyber security procedures
- record and investigate all breach events
- ensure system logs are retained for at least 12 months
- provide reports to the University Audit and Risk Committee and other relevant oversight bodies.
5. Who holds a responsibility within this procedure
Refer to the Delegation Policy for all delegations at Adelaide University.
5.1 The Chief Information Officer (CIO) is required to:
- oversee the University’s cyber security strategy and ensure appropriate resources and governance are in place
- oversee policy implementation as the IT Custodian for centrally managed IT
- accept and approve residual risks that remain outside the risk appetite
- ensure centrally managed systems comply with this procedure and related standards.
5.2 The Chief Technology and Security Officer (CTSO) is required to:
- own the cyber security program, standards, monitoring and incident response
- set minimum security controls and require remediation where controls are not met
- coordinate response to cyber incidents and ensure effective logging, monitoring and reporting
- provide assurance on adherence to this procedure.
5.3 IT Custodians are responsible for:
- ensuring systems in their areas comply with this procedure and related standards
- coordinating with the CIO on risk management and incident response
- implementing and enforcing secure configuration, patching and audit logging on managed systems
- evidencing compliance when requested and reviewing system ownership at least annually.
5.4 Business custodians are accountable for:
- the data and business processes supported by their systems
- ensuring required security controls and risk treatments are implemented and operating
- escalating residual risks outside the risk appetite to the CIO for decision.
Business custodians are the senior business role accountable for the business processes and the information supported by systems within their area of responsibility. Ownership must be recorded in the Information Asset Register and the IT Service Catalogue.
5.5 Information owners must:
- classify information assets and ensure access controls and protections are applied consistent with classification and least-privilege
- approve access to information within their remit.
Information owners are the designated business role responsible for classification and access decisions for a defined information asset. Where not otherwise specified, this is the same role as the business custodian.
5.6 Risk owners must:
- record, monitor and manage identified risks, ensuring risks remain within the risk appetite
- review risk assessments at least annually and after material changes or incidents.
Risk owners are accountable for keeping an asset or system’s cyber risk within Adelaide University’s risk appetite, and for approving and tracking risk controls, and any other obligations outlined in the Risk Management and Legal Compliance Policy and the Risk Management Procedure. For business systems this is the business custodian; for centrally managed shared platforms and infrastructure this is the CIO.
5.7 System implementation teams must:
- implement the baseline security controls mandated by this procedure and associated standards (for example MFA, encryption, endpoint protection, vulnerability management, secure disposal)
- document how required controls are applied.
5.8 Line managers must:
- ensure staff complete mandatory cyber security training and request additional training where needed.
5.9 Privacy Officer must:
- coordinate assessment and notification of eligible data breaches under the Privacy Act 1988 (Cth) with Legal and the CTSO.
6. Definitions used in our procedure
Please refer to our Adelaide University glossary for a full list of our definitions.
Adelaide University community means a broad range of stakeholders who engage with Adelaide University and includes (but is not limited to) all students, staff, and non-staff members of Adelaide University including alumni, honorary titleholders, adjuncts, visiting academics, guest lecturers, volunteers, suppliers and partners who are engaging with and contributing to the work of Adelaide University.
Business Custodian refers to the person who is accountable for security of data or services provided by university IT and associated risk.
Cyber security incident means a real or suspected event that attempts to compromise or has resulted in the compromise of the confidentiality, integrity or availability of Adelaide University information, systems or digital services.
Cyber security means the protection of information systems and digital infrastructure from unauthorised access, disruption, modification, or destruction to ensure the confidentiality, integrity, and availability of information.
Information asset means any information, regardless of format or location, that has value to Adelaide University and is managed as a resource for decision-making, teaching, research, operations or compliance. Examples include documents and records, publications, web content, emails and messages, spreadsheets, images and photographs, datasets and databases, software applications and tools, drawings and plans, and audio or video recordings.
IT custodian means the individual or function responsible for implementing, maintaining and operating the technical aspects of a system in line with Adelaide University’s security and compliance standards. For central IT managed systems, the IT custodian is the Chief Information Officer. For non-central or distributed IT environments, each area must nominate a distributed IT custodian.
Information Owners refers to the designated business role responsible for classification and access decisions for a defined information asset.
Notifiable Data Breaches (NDB) scheme means the regime under Part IIIC of the Privacy Act 1988 (Cth) that requires entities to notify the OAIC and affected individuals as soon as practicable when an eligible data breach occurs.
Multi-factor authentication (MFA) means a login method that requires two or more forms of identification before granting access to systems or data.
7. How our procedure is governed
This procedure is categorised, approved and owned in line with the governance structure of Adelaide University and the offices and officers listed below.
Parent policy | |
Policy category | Corporate |
Policy owner | Chief Information Officer |
Approving authority | Vice Chancellor and President |
Procedure owner | Chief Information Officer |
Responsible officer | Chief Technology and Security Officer |
Effective from | 19 December 2025 |
Review date | 2 years after date this version is approved |
Enquiries | Policy Unit |
Replaced documents | None |
8. Legislation and other documents related to our procedure
Refer to the Delegation Policy for all delegations at Adelaide University.
Category | Documents |
|---|---|
Related policy documents |
[Data Management Procedure] [Information Governance Procedure] Risk Management and Legal Compliance Policy [AI Policy] |
Referenced legislation | |
Related legislation | Security of Critical Infrastructure Act 2018 (Cth) Telecommunications (Interception and Access) Act 1979 (Cth) Freedom of Information Act 1991 (SA) |
External references | Essential Eight | Australian Signals Directorate (ASD) & Australian Cyber Security Centre (ACSC) Compliance in focus: Cyber security | TEQSA South Australian Protective Security Framework Overview | SA Gov South Australian Cyber Security Framework | SA Gov South Australian Protective Security Framework Executive Guide | SA Gov About the Notifiable Data Breaches scheme | OAIC NIST Cybersecurity Framework (CSF) 2.0 NIST Security and Privacy Controls for Information Systems and Organizations |
9. History of changes
Date approved | To section/clauses | Description of change |
|---|---|---|
18 December 2025 | N/A | New procedure |
29 September 2026 | Sections 1, 3.3.4, 3.5, 3.6, 3.8, 3.9.4 and 6 | Significant wording updates to accommodate monitoring of systems and access as well as streamlining roles across the IT policy suite. |
At the time of writing, some organisational details within Adelaide University are still evolving. Square brackets [ ] are used to indicate placeholders or areas where information may be refined, clarified or confirmed. These will be updated as the University's arrangements are finalised.