Document 9 FINAL.pdf

ICT Shared Capabilities
Information Technology
Service Management
(ITSM)
Risk Assessment
September 2023
under the Official Information Act 1982
Issued by
Released
Digital Public Service Branch

under the Official Information Act 1982
Released

IN-CONFIDENCE
Contents
Document Control
2
Document Information
2
Revision History
2
Document Approval
3
Executive Summary
5
Introduction
5
Agency Responsibilities
5
How to use this Risk Assessment
5
Risks Summary
5
Key Risks
6
Gross/Residual Risks
8
Detailed Findings – Common Risks
9
Controls Catalogue
22
Appendix A – Project Overview
32
Background
32
Scope
32
Appendix B – Risk Assessment Guidelines
33
Rating Risk
33
Likelihood (Probability) Assessment
33
Impact (Consequences) Assessment
33
Escalation of Risk
35

List of Tables:
Table 1 – Gross Risk Summary by Zones
6
Table 2 – Gross Risk Ratings
8
Table 3 – Service Provider Target Risk Rating
8
Table 4 – ITSM Risks
9
Table 5 – Recommended Controls
22
Table 6 – DIA Risk Likelihood Scale
33
Table 7 – AoG DIA All-of Government Risk Consequence Guide
34
Table 8 – Risk Matrix
35
Table 9 – Risk Escalation and Reporting
35

under the Official Information Act 1982
Released
ITSM Risk Assessment
IN-CONFIDENCE
Page 4 of 35

IN-CONFIDENCE
Executive Summary
Introduction
This document contains an information security Risk Assessment of Service Providers storing Agency
information  classified  at  Classification Removed and  below  within  their  Information  Technology
Service  Management  (ITSM).  The  Risk  Assessment  followed  the  Government  Chief  Information
Officer’s (GCIO) Risk Assessment process1, which is based on the AS/NZS ISO 31000 and ISO/IEC 27005
risk  management  standards  and  consumes  the  intent  from  the  New  Zealand  Information  Security
Manual (NZISM), the Protective Security Requirements (PSR) and the cloud hosted Office Productivity
Services guide.
Though  this  is  a  generic  Risk  Assessment  based  on  the  recent  threats  and  cyber-attack  patterns
concerning supply chain risks, the risks identified, and ratings assessed may be different and unique
in  the  context  of  Subscribing  Agencies  and  the  type  of  information  being  stored  on  the  Service
Providers ITSM platform. Therefore, agencies reading this report should review the risks in the context
of the services being supplied by their Service Provider (e.g. change, incident, asset management etc.),
while using their own risk management framework. This ensures that the risks identified are specific
to the Agency’s information being hosted, are within their business context, and their risk appetite.
The details of the Risk Assessment scope can be found in Appendix B.
Agency Responsibilities
The overall risk  position  presented to  Agencies  is based on data stored within a  Service Provider’s
ITSM  platform  and  may  change  depending  on  the  services  that  are  subscribed  from  their  Service
Provider.  Consuming  Agencies  are  responsible  for  performing  their  own  Security  Risk  Assessment
(SRA) and Privacy Impact Assessment for the associated services they have subscribed under Service
Provider’s ITSM offerings. This may be achieved by leveraging this Risk Assessment and incorporating
it into the Agency’s risk management framework.
How to use this Risk Assessment
As  part  of  management  platform  certification,  Service  Providers  are  recommended  to  adopt  this
template to provide assurance to Agencies that data stored within their ITSM platform is appropriately
managed and within the Agencies risk appetite.
under the Official Information Act 1982
Agencies (or other organisations) that do not have a risk management framework can use the GCDO’s
risk framework, and they must review the risks, ratings and controls, and make any changes to ensure
it is applicable in their context.
Risks Summary
9(2)(k)
Released
1 1 https://www.ict.govt.nz/guidance-and-resources/information-management/privacy-and-security/
ITSM Risk Assessment
IN-CONFIDENCE
Page 5 of 35

IN-CONFIDENCE
Table 1 – Gross Risk Summary by Zones
9(2)(k)
under the Official Information Act 1982
Released
ITSM Risk Assessment
IN-CONFIDENCE
Page 6 of 35

IN-CONFIDENCE
9(2)(k)

under the Official Information Act 1982
Released
ITSM Risk Assessment
IN-CONFIDENCE
Page 7 of 35

IN-CONFIDENCE
Gross/Residual Risks
Tables below illustrate the gross rating and target risk rating for a Service Provider if recommended controls are implemented correctly and operating effectively. The Service Provider target risk position for Risk ID ITSM01 is presented in two different
risk positions considering shared tenancy and government only tenancy. Service Providers are requested to present ITSM01 only at one risk position based on their implementation scenario.
9(2)(k)
under the Official Information Act 1982

Released

ITSM Risk Assessment
IN-CONFIDENCE
Page 8 of 35

under the Official Information Act 1982
Released

IN-CONFIDENCE
Appendix A – Project Overview
Background
Service Providers supplying TaaS and other AoG services are moving towards cloud-based Information
Technology Service Management (TISM) platforms where Agency data is often stored within them in
the  form  of  Incidents,  Changes  and  Problem  tickets.  This  information  could  be  classified  at
Classification Removed
below as Agency data is stored/transmitted within these platforms, this
Risk  Assessment  provides  Agencies  an  understanding  of  the  risks  of  that  data  being
stored/transmitted in these cloud-based Information Technology Service Management.
Scope
This Risk Assessment was written for Service Providers and Agencies, to understand the risks and the
effectiveness of controls that manage Agency data within a Service providers Information Technology
Service Management.

The  objective  was  to  create  a  Risk  Assessment  that  is  comprehensive  and  yet  cost-effective  to  be
included within the Management Platform certification of TaaS or other AoG services and also to be
used as an individual risk assessment on its own.

Minimum requirement for the scope of this Risk Assessment is depending on:
•  Risk profile of Agency data within the Service Provides ITSM platform.
•  Use / Support of TaaS or other AoG products to deliver Managed Services.
.
under the Official Information Act 1982
Released
ITSM Risk Assessment
IN CONFIDENCE
Page 32 of 35

under the Official Information Act 1982
Released