0

Introduction

In this topic, you’ll be introduced to the cyber security threat landscape and CBA’s Information Security Policy and Standards.

Scroll down
to learn more

As a trusted bank, CBA services hold valuable Group and customer information.

Protecting the confidentiality, integrity and availability of that information is vitally important to the ongoing health of our business.

But even with a mature central security capability, there are plenty of opportunities for someone to take advantage of vulnerabilities in our people, processes and technology.

The Digital Protection Group — or DPG — is available to support Service and Business Owners in securing their services throughout all stages of a project or activity, working in partnership to reduce risk exposure in our business.

Why this matters

At CBA, our purpose is to improve the financial wellbeing of our customers and communities. And as part of this commitment, we take the protection of our Group and customer information very seriously.

Watch the video to get an overview of the responsibilities of Service Owners to work together with the Digital Protection Group (DPG) to reduce risks and protect our information.

Accountability

No matter how experienced you are, or how long you’ve been in your position at CBA, you will often need to navigate new policies and processes.

This is because technology and security threats are constantly evolving, and we must update our policies and controls, as required, to protect our information.

To ensure that your services are compliant, make sure you always refer to and implement the most up-to-date versions of our Information Security Policy and Standards.

Nice to meet you, Doug - welcome to CBA! How are you settling in so far?

Getting there – just learning how everything works. Jan mentioned that you work in the Digital Protection Group?

Yes, I’ve been working in DPG for a few years now. I’m more than happy to help you navigate some of your security responsibilities.

Great, thank you! Are there any documents that I should read first?

The Information Security Policy and Standards are probably the best place to start – do you know where to find them?

Meet Doug

Doug has recently joined CBA as a Service Owner. He has completed his induction, including his mandatory training, and learned about his key information security and risk management responsibilities.

While getting a coffee with Jan down in the cafe, he’s introduced to Jamie from the Digital Protection Group.

Key Focus Areas

Doug uses this opportunity to clarify his understanding of some of the areas of the Information Security Policy and Standards that he is unsure of. Jamie highlights the importance of complying with these documents, and the Internal Privacy Policy, and explains how the criticality of an IT service can impact the way the controls are applied.

It’s a lot to take in, but it also gives Doug the opportunity to reflect on his own security behaviour, and how that might be improved. Doug understands that non-compliance leaves our services vulnerable to potential loss of confidentiality, integrity and availability of our information.

When it comes to protecting our information, we all have areas in which we are strong, and others that require improvement.

Take a moment to reflect on the following security behaviours and select any that you’d like to adopt.

Back at work

After chatting with Jamie, Doug bookmarks the Intranet page hosting all the Information Security Policy and Standards and deletes some outdated copies that have been saved locally.

You’ll find links to the CBA intranet in the Resources menu.

Information Security Policy

Information Security Standards

Group Internal Privacy Policy

Congratulations, you've finished Topic 1

Select the buttons below to continue.