Unit of Competency Mapping – Information for Teachers/Assessors – Information for Learners

ICANWK513A Mapping and Delivery Guide
Manage system security

Version 1.0
Issue Date: April 2024


Qualification -
Unit of Competency ICANWK513A - Manage system security
Description This unit describes the performance outcomes, skills and knowledge required to implement and manage security on an operational system.
Employability Skills This unit contains employability skills.
Learning Outcomes and Application This unit applies to middle managers such as information security managers or security analysts, responsible for implementing and managing the organisation’s security management system. They provide technical advice, guidance and leadership in resolution of specified problems and the role may involve responsibility for others.The role also involves leading development of strategic reviews, and determining security threats and implementing controls to mitigate risk. Related tasks include planning and budgeting.
Duration and Setting X weeks, nominally xx hours, delivered in a classroom/online/blended learning setting.
Prerequisites/co-requisites Not applicable.
Competency Field
Development and validation strategy and guide for assessors and learners Student Learning Resources Handouts
Activities 		Slides
PPT 		Assessment 1 Assessment 2 Assessment 3 Assessment 4
Elements of Competency Performance Criteria              
Element: Analyse threats to system
  • Evaluate the organisation’s system and verify that it meets enterprise guidelines and policies
  • Conduct risk analysis on system and document outcomes
  • Evaluate threats to the system and document findings
  • Compile and document human interactions with system
       
Element: Determine risk category
  • Conduct a risk assessment on the system and categorise risks
  • Conduct a risk assessment on human operations and interactions with the system and categorise risks
  • Match risk plans to risk categories
  • Determine and plan resources by risk categories
       
Element: Identify appropriate controls
  • Devise and put in place effective controls to manage risk
  • Design policies and procedures to cover user access of the system
  • Conduct training in the use of system-related policies and procedures
  • Monitor high-risk categories at specified periods
  • Categorise and record system breakdowns
       
Element: Include controls in the system
  • Develop security plan and procedures to include in management system
  • Develop security recovery plan
  • Implement system controls to reduce risks in human interaction with the system
       
Element: Monitor system tools and procedures
  • Review and monitor risks and controls using a management review process
  • Review risk analysis process based on security benchmarks from vendors, security specialists and organisational reviews
  • Plan to re-evaluate system and identify new threats and risks
       


Evidence Required

List the assessment methods to be used and the context and resources required for assessment. Copy and paste the relevant sections from the evidence guide below and then re-write these in plain English.

The evidence guide provides advice on assessment and must be read in conjunction with the performance criteria, required skills and knowledge, range statement and the Assessment Guidelines for the Training Package.

Overview of assessment

Critical aspects for assessment and evidence required to demonstrate competency in this unit

Evidence of the ability to:

implement and manage security functions on a system

conduct risk assessment

set up effective controls to manage risk

develop security plan and security recovery plan

monitor risks and controls

review risk-analysis process.

Context of and specific resources for assessment

Assessment must ensure access to:

site where system security may be implemented and managed

use of utility tools currently used in industry

organisational security policies

manufacturer recommendations

security standards

appropriate learning and assessment support when required

modified equipment for people with special needs.

Method of assessment

A range of assessment methods should be used to assess practical skills and knowledge. The following examples are appropriate for this unit:

verbal or written questioning to assess knowledge of security risks and options available in the operating environment

direct observation of candidate demonstrating management of system security in a range of complex situations

review of documentation prepared by candidate to manage system security.

Guidance information for assessment

Holistic assessment with other units relevant to the industry sector, workplace and job role is recommended, where appropriate.

Assessment processes and techniques must be culturally appropriate, and suitable to the communication skill level, language, literacy and numeracy capacity of the candidate and the work being performed.

Indigenous people and other people from a non-English speaking background may need additional support.

In cases where practical assessment is used it should be combined with targeted questioning to assess required knowledge.

Submission Requirements

List each assessment task's title, type (eg project, observation/demonstration, essay, assignment, checklist) and due date here

Assessment task 1: [title]      Due date:

(add new lines for each of the assessment tasks)

Assessment Tasks

Copy and paste from the following data to produce each assessment task. Write these in plain English and spell out how, when and where the task is to be carried out, under what conditions, and what resources are needed. Include guidelines about how well the candidate has to perform a task for it to be judged satisfactory.

Required skills

analytical skills to evaluate system security

communication skills to communicate clear concepts and solutions to complex issues

literacy skills to write reports

planning skills to:

develop a security plan

develop a security recovery plan

problem-solving skills to:

manage unpredictable problems involving participation in group solutions and analysis

resolve issues for a mixed mode environment of people and systems processes

research skills to identify, analyse and evaluate weaknesses and strengths of security systems

technical skills to use systems security methodologies and technologies.

Required knowledge

broad knowledge of general features of specific security technology

risk analysis techniques, with broad knowledge of their general features, and depth in security procedures

details of the client organisation

systems management and process control in relation to security

systems technologies, with broad knowledge of their general features and capabilities.

The range statement relates to the unit of competency as a whole. It allows for different work environments and situations that may affect performance. Bold italicised wording, if used in the performance criteria, is detailed below. Essential operating conditions that may be present with training and assessment (depending on the work situation, needs of the candidate, accessibility of the item, and local industry and regional contexts) may also be included.

System may include:

application service provider

applications

databases

gateways

internet service provider (ISP)

operating system

servers

wireless network access policies using mobile devices.

Threats may include:

denial of service and by-pass

eavesdropping

hackers

impersonation

manipulation

penetration

viruses.

Security plan may include:

alerts relating directly to the security objectives of the organisation

audits

privacy

standards:

archival

backup

network

theft

viruses.

Security may include:

AAA

Diameter

IPSec

LEAP

PKM

smart cards

SSL

tokens

WEP

WPA.

Copy and paste from the following performance criteria to create an observation checklist for each task. When you have finished writing your assessment tool every one of these must have been addressed, preferably several times in a variety of contexts. To ensure this occurs download the assessment matrix for the unit; enter each assessment task as a column header and place check marks against each performance criteria that task addresses.

Observation Checklist

Tasks to be observed according to workplace/college/TAFE policy and procedures, relevant legislation and Codes of Practice Yes No Comments/feedback
Evaluate the organisation’s system and verify that it meets enterprise guidelines and policies 
Conduct risk analysis on system and document outcomes 
Evaluate threats to the system and document findings 
Compile and document human interactions with system 
Conduct a risk assessment on the system and categorise risks 
Conduct a risk assessment on human operations and interactions with the system and categorise risks 
Match risk plans to risk categories 
Determine and plan resources by risk categories 
Devise and put in place effective controls to manage risk 
Design policies and procedures to cover user access of the system 
Conduct training in the use of system-related policies and procedures 
Monitor high-risk categories at specified periods 
Categorise and record system breakdowns 
Develop security plan and procedures to include in management system 
Develop security recovery plan 
Implement system controls to reduce risks in human interaction with the system 
Review and monitor risks and controls using a management review process 
Review risk analysis process based on security benchmarks from vendors, security specialists and organisational reviews 
Plan to re-evaluate system and identify new threats and risks 

Forms

Assessment Cover Sheet

ICANWK513A - Manage system security
Assessment task 1: [title]

Student name:

Student ID:

I declare that the assessment tasks submitted for this unit are my own work.

Student signature:

Result: Competent Not yet competent

Feedback to student

 

 

 

 

 

 

 

 

Assessor name:

Signature:

Date:

Assessment Record Sheet

ICANWK513A - Manage system security

Student name:

Student ID:

Assessment task 1: [title] Result: Competent Not yet competent

(add lines for each task)

Feedback to student:

 

 

 

 

 

 

 

 

Overall assessment result: Competent Not yet competent

Assessor name:

Signature:

Date:

Student signature:

Date: