This guide surveys changes to the standard, including:

Critical mineral businesses are becoming increasingly vulnerable to cyber-attacks because of the sheer volume of data generated and used.

Hackers and cybercrime groups pose grave threats. They can gain access to a computer network, often through third-party suppliers with weak security systems, and:

• disrupt or destroy global supply chains
• steal significant amounts of data to gain a competitive advantage and/or create financial pressure on the market
• take control of the industrial control system (ICS), mine safety systems, processing facilities, heavy machinery and/or IT environments
• compromise systems to severely disrupt mining operations
• jeopardise worker safety through attacks on underground ventilation systems, tailings dam monitoring systems or pipeline controlling systems.

Nameless Mining has discovered and proven a significant ore body of rhenium in Queensland. But the development costs are beyond their resources and they need a well-capitalised equity partner to fund and develop the mine.

Information/cyber security

• loss of confidential data and theft of IP
• denial of service (DoS) attacks
• blackmail
• ransomware and malware
• disruption to operational systems.

No. They are encouraged by the Australian Government.

Information/cyber security

• creating a proactive security posture
• enhancing the management and protection of information in the organisation
• reducing vulnerabilities, threats, and risks associated with information systems
• determining roles and responsibilities regarding information security
• improving efficiency in decision-making by articulating business objectives and providing more focused management information
• enhancing availability, confidentiality and integrity of information
• creating plans for business continuity and disaster recovery
• improving confidence and competitiveness, and providing a framework for risk management at the national and international levels
• maintaining the organisation’s reputation and placing it among industry leaders
• building confidence for customers, partners, and stakeholders that the organisation is committed to protecting data
• increasing the company’s revenue, profitability, and savings of industry by using protective controls effectively
• performing optimally in the face of disparate risks and multiple uncertainties.

No.

Due to the rapidly changing nature of information technology and cyber security, there are three international standards that cover this area.

Information/cyber security

• ISO/IEC 27001:2013 — Information technology — Security techniques — Information security management systems — Requirements
• ISO/IEC 27002:2022 — Information security, cybersecurity and privacy protection — Information security controls
• ISO/IEC TS 27110:2021 — Information technology, cybersecurity and privacy protection — Cybersecurity framework development guidelines

In practice, while the ISO/IEC 27001:2013 standard has the most thorough coverage of information security topics, it has limits and is often augmented by other technical standards that provide additional controls. These are the related standards:

• NIST (National Institute of Standards and Technology) Cybersecurity Framework (CSF)
• NIST Special Publication (SP) 800-53
• The Centre of Internet Security (CIS) Critical Controls
• The Cloud Security Alliance (CSA) Cloud Control Matrix (CCM)
• Consensus Assessment Initiative Questionnaire (CAIQ).

It makes sense to augment controls in ISO/IEC 27001:2013 Annex A with controls from more technical standards in the case of sector-specific requirements.

For example:

• Financial services — more controls to prevent fraud such as identity verification and anti-money laundering
• Energy sector — controls that relate to Operational Technology
• NIST CSF — critical infrastructure and cyber-orientated organisations
• NIST SP 800-53 — critical infrastructure and government departments and organisations doing business with them
• CSA CCM/CAIQ — cloud-orientated service provider
• CIS Critical Controls — internet-enabled organisations, particularly those managing platform infrastructure (e.g., operating systems) that requires hardening.

ISO/IEC TS 27110 was introduced by ISO/IEC in 2021 and expands the focus of the ISO 27000 series from a traditional information security orientation to include cybersecurity.

The technical specification does this by detailing five cybersecurity concepts:

• Identify
• Detect
• Protect
• Respond
• Recover

This terminology was first popularised by NIST when it published the first version of the NIST CSF in 2014

The Identify, Detect, Protect, Respond and Recover cybersecurity language is very appealing to cybersecurity practitioners because it relates to the layers of activities required to stop or otherwise limit the damage caused by cyber adversaries.

• Identify – The Identify concept develops the organisational understanding required to manage cybersecurity risks. ISO/IEC 27002 refers to this as an ecosystem.
• Protect – The Protect concept develops appropriate safeguards to ensure delivery of critical services. ISO/IEC 27002 refers to this as protecting the organisation’s cyber persona.
• Detect – The Detect concept sees that the organisation develops and implements appropriate activities to identify the occurrence of a cybersecurity event.
• Respond – The Respond concept relates to developing and implementing appropriate activities to take action regarding a detected cybersecurity incident.
• Recover – Finally, the Recover concept involves developing and implementing appropriate activities to maintain plans for resilience and to restore capabilities or services impaired by a cybersecurity incident.

The Identify, Detect, Protect, Respond and Recover cybersecurity language is very appealing to cybersecurity practitioners because it relates to the layers of activities required to stop or otherwise limit the damage caused by cyber adversaries.

• Identify – The Identify concept develops the organisational understanding required to manage cybersecurity risks. ISO/IEC 27002 refers to this as an ecosystem.
• Protect – The Protect concept develops appropriate safeguards to ensure delivery of critical services. ISO/IEC 27002 refers to this as protecting the organisation’s cyber persona.
• Detect – The Detect concept sees that the organisation develops and implements appropriate activities to identify the occurrence of a cybersecurity event.
• Respond – The Respond concept relates to developing and implementing appropriate activities to take action regarding a detected cybersecurity incident.
• Recover – Finally, the Recover concept involves developing and implementing appropriate activities to maintain plans for resilience and to restore capabilities or services impaired by a cybersecurity incident.

When applying these concepts in response to risk management needs. These are the specific business drivers relevant to the mining and minerals sector:

• Maintain safety of facilities and protection of life (and contributes to continuity of operations)
• Maintain continuity of operations (to minimise disruption and maximise wealth generation)
• Minimise losses associated with successful cyberattacks including regulatory intervention
• Protect intellectual property (to maximise competitive advantage).

A cybersecurity framework creator needs to identify which categories, subcategories and activities of the various standards are relevant in their circumstances.

They should follow the standards mappings provided below to extract and present an easily accessible framework.

Cybersecurity framework creators should be aware of the differences (i.e., additions and subtractions) between ISO/IEC 27110 Annexures and the NIST CSF.

The following table summarises the mapping of ISO/IEC TS 27110 Categories to the NIST CSF functions.