Division 4.2.3 The measures to prevent and mitigate the impact of incidents affecting the security of the systems shall cover the following domains:

1. (a)

   human resource security;

2. (b)

   access control;

3. (c)

   cryptographic controls;

4. (d)

   physical and environmental security;

5. (e)

   operations security;

6. (f)

   communications security;

7. (g)

   system acquisition, development and maintenance;

8. (h)

   information security incident management;

9. (i)

   compliance.

Application of these security measures may be limited to the parts of the organisation that are relevant for the online collection system. For instance, human resources security may be limited to any staff that has physical or logical access to the online collection system, and physical/environmental security may be limited to the building(s) hosting the system.