Keeping the register safe

IntegrityA register is a record

Business use, and the clock on each asset record sets out the format rules. Three shape how a register should behave once it is in software. Information “must be stored in a way that protects the information from being changed or the record from being damaged”, and the ATO may ask a business to show it has appropriate safeguards in place. The business also keeps information about any routine procedures it has for destroying digital records.

Digital records can stand alone. business.gov.au says a business keeping digital records does not also need paper copies unless a particular law or rule says it must, and that once an image of an original paper record is saved, the paper version need not be kept, provided the image is a true and clear reproduction of the original and follows the record-keeping rules. For a register, that makes the scanned invoice part of the asset’s card.

Those rules suggest four questions to put to any register:

• When a value is edited, does the register keep the earlier value, with who changed it and when?
• Can the whole register, history included, be exported in a standard format? The ATO names Excel and CSV as examples.
• Are scanned invoices stored with the asset they belong to?
• If the software is replaced, can the original data still be reconstructed?

LocksWho can open the register

The Australian Signals Directorate’s Small business cyber security handbook names accounting software among the high-risk accounts to protect first with multi-factor authentication, alongside email, banking, cloud storage and social media. Its reason: with MFA, “a stolen password alone can’t be used to gain access to an account”. Of the ways to receive a code, it calls one-time codes by SMS or email the least secure.

The handbook’s other locks, read for a register:

• Individual accounts for staff wherever possible.
• The principle of least privilege: administrator access only for those who need it, and access removed promptly when staff leave.
• Separate administrator accounts for staff with administrative privileges.
• Access permissions reviewed regularly, especially when staff change roles, leave the business or are involved in a cyber security incident.
• User activity tracked and logged, and the logs reviewed for unusual or unauthorised behaviour.
• Where MFA cannot be used, passwords at least 15 characters long.
• For cloud services, administrator access reviewed regularly and unused accounts or third-party integrations removed.

Outside providers count too. The handbook says businesses should understand what systems, information and accounts external providers can access, and that this access be reviewed regularly and withdrawn once it is not needed. A bookkeeper or tax agent given a login to the register is one such provider.

BackupsA copy that is not the original

business.gov.au advises backing up digital records and, if possible, keeping a secure off-site copy, which may include cloud storage. The handbook gives the reason: “Without reliable backups, it may be difficult or impossible to recover information after a cyber incident.” Three of the questions the OAIC’s guide to securing personal information asks about backups suit a register just as well.

• Three of the OAIC’s backup questions
• “Are backups set up to run frequently?”
• “Is all essential information included in backups?”
• “How far back is data recoverable?”

LocationWhere a cloud register sits

On choosing a hosted service, the handbook’s advice is to confirm where the provider is located and the security and privacy standards it follows, noting that providers outside Australia may be subject to different legal obligations.

A register of things is not automatically a register of people. Privacy law enters only if the register also holds personal information, and only for an organisation the Privacy Act covers, which the OAIC describes as, in general, businesses whose annual turnover is over $3 million, every health service provider regardless of turnover, and a range of small businesses.

For such a business, APP 11 requires reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure. The OAIC says that if a business continues to hold personal information it stores in the cloud, reasonable steps may include managing the provider through effective contractual clauses, verifying its security claims, and regular reporting and monitoring. Other principles may apply as well, the OAIC adds, including APP 8 “where personal information is disclosed to an overseas recipient”. Before such a disclosure, APP 8.1 requires reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles, apart from APP 1. APP 8.2 sets out exceptions. One is where the business reasonably believes the recipient is bound by a law or binding scheme protecting the information in a way that is, overall, at least substantially similar to the protection the Australian Privacy Principles give, and that the individual has access to mechanisms to enforce that protection. Where none applies, APP 8.1 stands. Section 16C of the Act can then treat an act of the overseas recipient as an act of the business, and a breach of the principles by the business.

The last lock is the plainest. The handbook advises updating devices, apps and software through their settings, and turning on automatic updates where possible so security fixes are applied as soon as they are available. The card on assets that leave the business picks up the device itself, once it is sold or thrown away.