Information Security Policy

Purpose

This policy establishes Westlink Logistics’ framework for protecting the confidentiality, integrity, and availability of all information assets. It supports compliance with the Defence Industry Security Program (DISP), the Australian Government Information Security Manual (ISM), the Protective Security Policy Framework (PSPF), and JOSCAR information security requirements.

Scope

This policy applies to all Westlink Logistics directors, officers, workers, contractors, and third parties who access, process, store, or transmit information on behalf of the organisation. It covers all information assets regardless of format, including electronic data, physical documents, verbal communications, and information held by third-party service providers.

Organisational Context

Westlink Logistics operates heavy haulage, project logistics, and maritime services across Australia, primarily supporting defence, government, resources, and infrastructure sectors. The organisation handles OFFICIAL and OFFICIAL:Sensitive information from Defence and government clients and is authorised under DISP to handle information up to OFFICIAL:Sensitive.

Westlink is a fully cloud-based Microsoft 365 organisation with no on-premises infrastructure. The information security framework is aligned with ISO 27001:2022, Essential Eight Maturity Level 2, and ISM controls appropriate to the OFFICIAL:Sensitive ceiling. JOSCAR pre-qualification requires demonstrated information security controls and cyber security maturity.

Policy Commitments

Westlink Logistics is committed to:

• Classifying and handling all information per the PSPF protective marking scheme (UNOFFICIAL, OFFICIAL, OFFICIAL:Sensitive). Information above OFFICIAL:Sensitive must not be stored, processed, or transmitted on Westlink systems without Defence Security Authority approval. Personnel must apply correct markings at creation.

• Controlling access to information on a need-to-know and least privilege basis. Multi-factor authentication is mandatory for all remote access, cloud services, privileged accounts, and systems processing OFFICIAL:Sensitive information. Access rights are reviewed at least every 12 months and revoked on role change or termination.

• Requiring pre-employment screening proportionate to information sensitivity. Personnel accessing Defence classified information must hold an appropriate AGSVA security clearance sponsored through DISP. All workers must complete information security awareness training at commencement and annually.

• Maintaining ICT security controls aligned with Essential Eight ML2 and ISM requirements: endpoint protection, patch management (critical/high within 48 hours for internet-facing systems), encryption of data at rest and in transit (TLS 1.2+), regular backups with restoration testing, and restricted use of removable media.

• Reporting all security incidents immediately to the Security Officer. Incidents involving Defence classified information must be reported to the Defence Industry Security Office per DISP timeframes. Data breaches involving personal information are managed per GOV-POL-015 and the NDB scheme. Ransomware or cyber extortion payments made by or on behalf of Westlink are reported to the Australian Signals Directorate via ReportCyber within 72 hours of payment in accordance with Cyber Security Act 2024 (Cth) Part 3.

• Assessing third parties and suppliers for information security risk before engagement. Contracts must include security requirements commensurate with information classification. Third parties handling OFFICIAL:Sensitive must hold DISP membership or equivalent accreditation.

Responsibilities

Review

This policy is reviewed annually as part of the management review cycle, or when significant changes occur to the threat environment, ISM, PSPF, DISP requirements, or following a significant security incident. This policy is communicated to all workers and is available to Defence, JOSCAR assessors, and other stakeholders on request.

Applicable Standards and Legislation

• Australian Government Information Security Manual (ISM) — ACSC

• Protective Security Policy Framework (PSPF)

• Defence Industry Security Program (DISP) — Security Governance Framework

• ISO/IEC 27001:2022 Information Security Management Systems — Requirements

• Privacy Act 1988 (Cth)

• Cyber Security Act 2024 (Cth) — No. 98, 2024

• ISO 9001:2015 Quality Management Systems — Requirements

Related Documents

• TEC-POL-002 User Access Management Policy

• GOV-POL-015 Privacy Policy

• GOV-POL-016 Social Media Usage Policy

• DEF-POL-001 Security Policies and Plans

• QHSE-PRO-001 Hazard and Incident Reporting and Investigation Procedure