The University’s ‘baseline’ information security standard defines the minimum organisational and technical security controls needed to keep your systems and data secure from most of the information security threats that we currently face. Providing you with a set of prescriptive controls allows the University to take a risk-based approach without burdening divisions, departments and faculties with having to carry out formal risk assessments. In other words, we’re telling you what “secure” looks like so you can concentrate on what it is you need to do. To provide assurance to the University that your information security arrangements are appropriate, you are required to complete an annual self-assessment against the baseline. The Information Security Team (IST) has developed a tool you can use to perform this assessment – the “Information Security Baseline Assessment”. The IST will collate the results of every self-assessment in order to: Determine the University’s current level of overall information security maturity and assess the information security hygiene of the University; Identify areas of both risk and good practice; Determine where assistance is most needed; and Provide prioritized recommendations to divisions, departments, faculties and the University as a whole.