Intro
The purpose of this policy is to establish clear guidelines for cyber security researchers engaging in vulnerability discovery activities related to the Department of Creative Industries, Tourism and Sport (CITS) and the Cultural Statutory Authorities (CSAs) systems and outlines expectations for responsible disclosure.
By defining the scope of acceptable cyber security research, submission procedures, and our response practices, this policy aims to foster collaboration while ensuring the security of our digital assets.
This policy applies to:
This policy applies to systems and services owned and operated by CITS and the CSAs, including:
Specific systems and services that are out of scope:
Systems listed above, including any third-party services or integrations, are excluded from scope, and not authorised for testing. If you aren’t sure whether a system is in scope, please contact CITS Cyber Security at vulnerability.disclosure@cits.wa.gov.au to discuss.
In general, low severity issues without a direct security impact (weak SSL cipher suites, missing HTTP security headers, SPF/DKIM/DMARC misconfiguration, etc) will not be considered in scope.
Cultural Statutory Authority (CSA): Means the Art Gallery of Western Australia, Arts and Culture Trust, State Library of Western Australia, and Western Australian Museum.
Cyber Security Researcher: Individuals who are external to and not otherwise contracted by CITS and the CSAs (commonly referred to as ethical hackers), who identify, analyse, and report potential security vulnerabilities in systems, applications, or infrastructure. These individuals provide such information to the department through responsible disclosure practices outlined in this policy.
External Vendors: Third-party organisations or service providers that supply products, services, or support to your agency but are not part of your internal structure. In the context of vulnerability reporting and ICT risk, they may include:
Policy: A statement of the mandatory principles guiding an organisation’s operations and significant decision-making.
Vulnerability: A flaw in code or design that creates a potential point of security compromise for an endpoint or network. Vulnerabilities create possible attack vectors, through which an intruder could run code or access a target system’s memory.
Western Australian (WA) Government Cyber Security Policy: A formal directive that outlines the minimum cybersecurity requirements for all WA public sector agencies to protect government systems, data, and services from cyber threats.
Internal stakeholders who identify a vulnerability should refer to the Information and Security Management Policy for the internal vulnerability disclosure policy statement.
This policy is in addition to, and does not replace or override, any vendor or platform terms, acceptable use requirements or security testing policies that apply to CITS systems (for example Azure and Microsoft 365). You must comply with both this policy and any applicable vendor requirements. If there is a conflict, the more restrictive requirement applies.
To report a vulnerability, please submit all reports to vulnerability.disclosure@cits.wa.gov.au
The cyber Security team will coordinate with you as openly and as quickly as possible during the remediation of any identified vulnerabilities.
This policy is in alignment, and should be read in conjunction with the Western Australian Government Cyber Security Policy.
This document will be reviewed at a minimum every 2 years.