Information security incident notification form

Use this form to report an information security incident – including a data breach and/or malicious cyber-attack on your information and communication technology (ICT) systems.

You’re required to notify us of incidents that involve personal and/or health information about clients and their families, along with related program data, held by your organisation for the services you are contracted to provide for DCJ.

This information will be forwarded to the DCJ response team so that we can assist your organisation. Your lead DCJ contract manager will also be notified.

All form fields are required unless marked (optional).

Section 1 - Organisation details

Organisation name

Trading name or legal name

Australian Business Number(ABN)

List the DCJ programs/services your organisation delivers

What date did you detect or become aware of the incident?(dd/mm/yyyy)

Briefly describe what occurred (optional).

List any DCJ ICT systems your organisation interfaces with or uses; for example, CHIMES, PACS, CIMS, ChildStory, HOMES.If none, write ‘None’.

Is personal and/or health information of DCJ clients affected?

Please provide details regarding the impact on DCJ clients' personal information.

Your organisation’s contact person for this incident

Contact person's name

Contact person's position

Contact person's phone number

Contact person's email address

Confirm contact person’s email address

Your lead DCJ contract manager's details (optional)

Contract manager’s name

Contract manager’s number

Contract manager’s email address

Confirm contract manager’s email address

Section 2. Incident management and data security questionnaire (optional)

Answer as many of the following questions as possible.

Our interest in this information is to assist you in managing the incident and understanding the personal and health information about clients and their families, along with related program data, held by your organisation for the services you’re contracted to provide for DCJ.

Note that any of these questions you’re unable to answer at this stage will be followed up by the DCJ response team. Complete what you can and send the form so that we receive notice of the incident within 48 hours.

At this stage, what do you know about what happened?

What DCJ data does your organisation collect and manage for programs? Our interest in this information is to assist you in managing the incident and understanding the personal and health information about clients and their families, along with related program data, held by your organisation for the services you’re contracted to provide for DCJ.

Where is the DCJ data stored? For example, in client information systems, client physical files, laptops, email accounts, or other places the data may be stored.

Based on your investigation so far, is there any evidence the DCJ data on your systems may have been accessed as part of this incident?

If an account or system has been compromised, what level of access did the account or system have? For example, Admin account.

Outline the type of information that may have been accessed and by whom?

What evidence sources are available? For example, did you retain the emails? Do you retain any computer or VPN logs? If relevant, what level of Microsoft 365 licence do you have?

Do you consider that the incident has been contained, and what actions have you taken to contain the incident? For example, reset passwords, implemented multi-factor authentication (MFA), or other actions?

What are the next steps for your investigation into the incident?

Will you use an external agency to assist with the mitigation steps and/or investigation? If not, what steps will be taken?

Does your organisation have insurance to cover data breaches?

Terms and conditions consent

I confirm that I have read and understood the privacy notice and consent to the information I have provided in this form being used for the purposes of managing the information security incident being notified.