CybersecurityGuideline

IS18

Information and Cyber Security Policy (IS18)

The Information and Cyber Security Policy (IS18) is a policy framework established by the Queensland Government to enhance information security and organizational resilience. It mandates the implementation of ISO 27001-based ISMS, systematic risk management, and compliance with the Australian Signals Directorate's Essential Eight Strategies for all Queensland Government agencies.

Book your strategy call View source ↗

Overview

The IS18 is a mandatory policy for Queensland Government agencies aimed at ensuring a consistent, risk-based approach to information and cyber security. Agencies must implement an Information Security Management System (ISMS) aligned with ISO 27001, manage risks systematically, and meet defined minimum security requirements including compliance with the Essential Eight Strategies. The policy also requires annual security assurance attestations by accountable officers and incident reporting to the Queensland Government Cyber Security Unit. The scope covers all information systems, applications, technologies, and their associated risks, with guidance on operational technology and supply chain management. By adopting IS18, the government aims to align with international standards, reduce cybersecurity risks, and improve resilience.

Related in Cybersecurity

CybersecurityStandard

CCC-2: 2024 — Cloud Cybersecurity Controls

The Cloud Cybersecurity Controls (CCC – 2: 2024) define minimum cybersecurity requirements for cloud computing services used by Cloud Service Providers (CSPs) and Cloud Service Tenants (CSTs) in Saudi Arabia. The controls aim to enhance national cybersecurity goals and mitigate cyber risks.

National Cybersecurity Authority (NCA) • Saudi Arabia • v2: 2024

View details

CybersecurityStandard

OTCC-1:2022 — Operational Technology Cybersecurity Controls

The Operational Technology Cybersecurity Controls (OTCC-1:2022), developed by Saudi Arabia’s National Cybersecurity Authority (NCA), establish minimum cybersecurity requirements for Operational Technology (OT) and Industrial Control Systems (ICS) environments. The framework aims to protect critical infrastructure from cyber threats and enhance operational resilience, safety, and security. OTCC consists of 4 domains, 23 subdomains, 47 controls, and 122 sub-controls, with requirements categorized across three control levels (L1, L2, and L3) based on facility criticality and risk.

National Cybersecurity Authority (NCA) • Saudi Arabia • v2022

View details

CybersecurityControl setGuideline

ITSG-33 — IT Security Risk Management: A Lifecycle Approach (ITSG-33)

ITSG-33 is a guideline developed by the Canadian Centre for Cyber Security to help government departments manage IT security risks effectively. It outlines activities at both departmental and project levels, providing a structured process for integrating security considerations into IT environments and maintaining authorization to operate.

Canadian Centre for Cyber Security • Canada

View details

CybersecurityStandard

ESMA Minimum Standard IT Security Controls

The ESMA Minimum Standard IT Security Controls is a cybersecurity and compliance framework that defines the minimum security requirements service providers must implement to protect ESMA systems, applications, data, and information services.

European Securities and Markets Authority (ESMA) • EU

View details

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call