Independent Security Review of the 2011 eCensus Solution

The ABS requires the services of an assessor who has been registered under DSD's Infosec-Registered Assessor Program (I-RAP) to assist the ABS with assess the eCensus system, which ABS has contracted IBM Australia to develop.

The Assessor will be required to review the application design, identify security risks in the design and development, and identify and report to the ABS, any areas of non-compliance with ASCI-33. The Assessor will have experience in assessing complex systems and providing clear written advice to clients on any areas of system non-compliance during the systems design and development, the reason for non-compliance and recommended approaches that may restore the system to compliance. The assessor will have experience working with the clients third party contractors and have sound communication skills and high level technical skills on system security compliance. The assessor will also be required to oversee the decommissioning of the hardware to verify that storage devices are cleansed according to the requirements of ACSI-33.

The Consultancy is to be provided on a time and materials basis and will be non exclusive (ie the ABS may engage other consultants to undertake similar or the same work if required). The services will be required in two stages. The first stage will involve the infrastructure and application build for testing in the period January 2010 to February 2010 and stage two will involve the implementation phase March to May 2010.