Mary Grace is business owner of learning management software (LMS). She has reached out to cyber security team after performing a data classification for her software. The data classification type is sensitive, and the solution will host less than 1000 records. If all other cyber risk rating criteria are not met, what is the cyber risk rating for the software?

• High

• Medium

• Low

Which of the following statements is true regarding the Cyber Security Risk Rating for UNSW Information Resources?

Resources.

• A) The Cyber Security Risk Rating for each UNSW Information Resource type must be assessed separately.

• B) The Cyber Security Risk Rating for all UNSW Information Resources can be assessed together.

• C) The Cyber Security Risk Rating is not important for UNSW Information

• D) The Cyber Security Risk Rating only applies to endpoint devices at UNSW

Select all the correct information resource type categories in the Risk Management Standard (Select multiple correct choices)

• IT assets

• Server instances (including virtual machines, IaaS and PaaS (including containers and serverless))

• Networks and Network Devices (including SDN and Cloud)

• Printers

• SaaS and Mobile Apps and including Research Administration

Regulatory Compliance (Critical Infrastructure) control is required for information resources irrespective of the risk ratings or the type of delivery

• True

• False

Match the cyber risk rating with the level of controls required as per the Risk Management Standard

• Elevated

• High

• Minimal

• Medium

• Baseline

• Low

It is mandatory for all persons with physical access to UNSW Data Centres and on-campus IT Hosting locations to be authorised irrespective of the risk rating of the information resource

• True

• False

The Risk Management Standard does not differentiate between a UNSW entity and non UNSW entity in terms of prescribing the controls required for the information service based on the risk rating

• True

• False

UNSW Information Resources (other than endpoints) must be hosted in a facility or Cloud Service that satisfies the following: (select multiple correct options)

• equipment must be sited (placed) and protected to reduce the risks from environmental threats and hazards.

• supporting utilities such as power, lighting, cabling, temperature, and humidity must be maintained and tested to ensure they support the safety and resilience requirements of the business or technology functions they support

• with cheapest possible real estate cost

• emergency power must be available to ensure an orderly shutdown of the UNSW Information Resource and/or transition of the Information Resource to long-term alternate power in the event of the loss of the primary power source.

• fire detection and suppression systems must be maintained and supported by an independent energy source (if powered).

Based on the risk management standard, how many scenarios exist to implement controls based on risk rating of the information resource?

• 3

• 6

• 4

• 2

Joseph is implementing an IoT solution in the Faculty of Law. The cyber risk rating of his solution has been determined as low. Which of the following controls is Joseph required to implement in his solution as per the Risk Management Standard. (Select multiple correct options)

• Data and Media Protection

• Encryption in Transit

• Security Event logging

• Single Sign on

• Anti Malware