Compliance Framework
Compliance Driver
UNE Foreign Interference Requirements (Cth)
Classification
Level 1
University-wide concern. Impacts on reputation and funding.
Associated Legislation
Associated Standards
None
Associated Codes
None
Associated Information
Return to Top
Administrative Information
Administrative Body
Administrative Name
Administrative Address
Administrative Phone
Administrative Email
Administrative Website
Return to Top
General Introduction
VC Compliance Delegate
Chris Armstrong, Deputy Vice-Chancellor Research
Compliance Coordinator
Bonnie Mayes, Research Governance and Compliance Officer
Business Units Impacted
Overview
Australian universities rely on a regular flow of communication to and from security agencies to support their
strategies to mitigate the risk of foreign interference. The Australian Security Intelligence Organisation (ASIO)
assesses that espionage and foreign interference continue to pose a threat to Australia, its sovereignty and the
integrity of its national institutions.
Australia’s university sector is one of the sectors at risk in our community, given it is at the leading edge of policy,
research and scientific development. Its work leads to the development of proprietary and other sensitive
information critical to the development of new technologies, medicines, techniques and practices that are
fundamental to Australia’s social and economic prosperity.Compliance Obligations
Return to Top
Autonomous Sanctions Law
Description
Australian sanctions laws implement two types of sanctions frameworks: United Nations Security Council (UNSC) sanctions frameworks, which are binding under international law,
and Australian Autonomous sanctions frameworks, imposed and implemented by Australia as a matter of foreign policy. Australian sanctions law may impact on a range of activities by universities. The most common activities affected include: enrolling a student from a sanctioned country, employing a person from a sanctioned country, and collaborating with another person or entity (including a foreign university) from a sanctioned country.
Impacts
Responsible Manager
Chris Armstrong, Deputy Vice-Chancellor Research
Coordinating Officer
Bonnie Mayes, Research Governance and Compliance Officer
Coordinating Unit
Research Services
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
Risk Management Policy - Annexure 2 - Due Diligence to Counter Foreign Interference, Support Transparency in Foreign Relations, Conform with Autonomous Sanctions and Manage Risk of Modern Slavery Practices
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Foreign Influence Transparency Scheme
Description
The Foreign Influence Transparency Scheme Act 2018 establishes a requirement for the University to register certain activities if they are undertaken on behalf of a foreign principal or as part of a registrable arrangement.
Impacts
Responsible Manager
Chris Armstrong, Deputy Vice-Chancellor Research
Coordinating Officer
Faraz Hasan, Director of Research
Coordinating Unit
Office of the Deputy Vice-Chancellor (Research)
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
Risk Management Policy - Annexure 2 - Due Diligence to Counter Foreign Interference, Support Transparency in Foreign Relations, Conform with Autonomous Sanctions and Manage Risk of Modern Slavery Practices
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 1.1 - Governance and risk frameworks
Description
Universities have frameworks for managing their risks that address foreign interference threats to their university’s people, information and assets.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
Risk Management Policy - Annexure 2 - Due Diligence to Counter Foreign Interference, Support Transparency in Foreign Relations, Conform with Autonomous Sanctions and Manage Risk of Modern Slavery Practices
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 1.2 - Governance and risk frameworks
Description
Universities have accountable authorities responsible for managing foreign interference risk.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
Risk Management Policy - Annexure 2 - Due Diligence to Counter Foreign Interference, Support Transparency in Foreign Relations, Conform with Autonomous Sanctions and Manage Risk of Modern Slavery Practices
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 1.3 - Governance and risk frameworks
Description
Universities have policies and procedures that set out responsibilities and expected conduct for all those engaging in their university’s business to manage foreign interference risk.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
Risk Management Policy - Annexure 2 - Due Diligence to Counter Foreign Interference, Support Transparency in Foreign Relations, Conform with Autonomous Sanctions and Manage Risk of Modern Slavery Practices
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 1.4 - Governance and risk frameworks
Description
Universities have clear risk assessment and reporting frameworks available to all staff and students that guide decision-making for activities at risk of foreign interference.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
Risk Management Policy - Annexure 2 - Due Diligence to Counter Foreign Interference, Support Transparency in Foreign Relations, Conform with Autonomous Sanctions and Manage Risk of Modern Slavery Practices
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 1.5 - Governance and risk frameworks
Description
Universities have transparent escalation and reporting mechanisms for foreign interference-related matters.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
Risk Management Policy - Annexure 2 - Due Diligence to Counter Foreign Interference, Support Transparency in Foreign Relations, Conform with Autonomous Sanctions and Manage Risk of Modern Slavery Practices
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 2.1 - Communication, education and knowledge sharing
Description
Universities have communication plans and education programs that raise awareness and support mitigation of their foreign interference risks.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
None
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 2.2 - Communication, education and knowledge sharing
Description
Universities provide training to staff and students who are engaged in foreign collaboration or other partnership activities at risk of foreign interference.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
None
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 2.3 - Communication, education and knowledge sharing
Description
Universities participate in sector-wide counter foreign interference events and where appropriate, share experiences and leading practice, to learn from each other and build sector resilience.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
None
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 3.1 - Due diligence, risk assessments and management
Description
Universities require declaration of interest disclosures from staff who are at risk of foreign interference, including identification of foreign affiliations, relationships and financial interests.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
None
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 3.2 - Due diligence, risk assessments and management
Description
Universities conduct due diligence to inform decision-makers of foreign interference risks.
(a) Universities conduct due diligence on partners and personnel.
(b) Universities assess the potential of technology and/or research.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
None
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 3.3 - Due diligence, risk assessments and management
Description
Universities apply a comprehensive approach to their due diligence.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
None
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 3.4 - Due diligence, risk assessments and management
Description
Universities have approval, audit and continuous evaluation of due diligence processes.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
None
Protocol
None
Procedure
None
Guideline
None
Other Websites
Return to Top
Guidelines - 4.1 - Cybersecurity
Description
Universities understand and proportionately mitigate cyber business risks, using techniques like threat models where possible, to inform their cybersecurity strategy.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
Information and Communication Technology Facilities and Services Rule
Information Security Rule
Policy
Information and Communications Infrastructure Rule
Information Security Policy
Patch and Vulnerability Management Framework
Research Data Management Policy
Terms of Reference (Vice-Chancellor approved) - Cyber Security Program Steering Committee
Terms of Reference (Vice-Chancellor approved) - Data and Information Governance and Strategy Committee
Terms of Reference (Vice-Chancellor approved) - Information Technology Governance Committee
Protocol
None
Procedure
None
Guideline
Cyberethics at UNE Guidelines for Students on Online Behaviour
Other Websites
Return to Top
Guidelines - 4.2 - Cybersecurity
Description
Universities implement a cybersecurity strategy that treats cybersecurity as a whole-of-organisation human issue and incorporates an appropriate controls framework.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
Information and Communication Technology Facilities and Services Rule
Information Security Rule
Policy
Information and Communications Infrastructure Rule
Information Security Policy
Patch and Vulnerability Management Framework
Research Data Management Policy
Terms of Reference (Vice-Chancellor approved) - Cyber Security Program Steering Committee
Terms of Reference (Vice-Chancellor approved) - Data and Information Governance and Strategy Committee
Terms of Reference (Vice-Chancellor approved) - Information Technology Governance Committee
Protocol
None
Procedure
None
Guideline
Cyberethics at UNE Guidelines for Students on Online Behaviour
Other Websites
Return to Top
Guidelines - 4.3 - Cybersecurity
Description
Universities participate in communities of best practice, which share cyber intelligence and lessons across the sector and government.
Impacts
Responsible Manager
Radha Thomas, Director Governance and University Secretary
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Director Governance and University Secretary
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
Information and Communication Technology Facilities and Services Rule
Information Security Rule
Policy
Information and Communications Infrastructure Rule
Information Security Policy
Patch and Vulnerability Management Framework
Research Data Management Policy
Terms of Reference (Vice-Chancellor approved) - Cyber Security Program Steering Committee
Terms of Reference (Vice-Chancellor approved) - Data and Information Governance and Strategy Committee
Terms of Reference (Vice-Chancellor approved) - Information Technology Governance Committee
Protocol
None
Procedure
None
Guideline
Cyberethics at UNE Guidelines for Students on Online Behaviour
Other Websites
Return to Top
PACT Regulations
Description
On 1 April 2024, the Australian Government activated changes to the Migration Regulations 1994 (the Migration Regulations) made through the Migration Amendment (Protecting Australia’s Critical Technology) Regulations 2022 and the Migration Amendment (Postgraduate Research in Critical Technology—Student Visa Conditions) Regulations 2022 (collectively â€~the PACT Regulations’).
The changes to the Migration Regulations:
- created a Public Interest Criterion 4003B (PIC 4003B) where the Minister for Home Affairs can refuse to grant certain visas if there is an unreasonable risk of unwanted transfer of critical technology by the visa applicant
- created visa condition 8208, requiring Student (subclass 500) visa holders to obtain approval from the Minister for Home Affairs before undertaking a new critical technology-related course in the postgraduate research sector
- provided grounds for the cancellation of a visa where the Minister for Home Affairs is satisfied that there is an unreasonable risk of unwanted transfer of critical technology by the visa holder.
These regulations ensure that Australia remains a destination and partner of choice for international research and collaboration, while safeguarding our research, science, ideas, information and capabilities.
Impacts
Responsible Manager
Chris Armstrong, Deputy Vice-Chancellor Research
Coordinating Officer
Faraz Hasan, Director of Research
Coordinating Unit
Office of the Deputy Vice-Chancellor (Research)
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
None
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
None
Protocol
None
Procedure
None
Guideline
None
Other Websites
Critical technology - enhanced visa screening measures
Return to Top
Security of Critical Infrastructure
Description
The Security of Critical Infrastructure Act 2018 provides a framework for managing risks relating to critical infrastructure, which can include assets owned by, operated by or related to universities. The framework includes obligations regarding asset registration, data management, cyber security and incident reporting.
Impacts
Responsible Manager
Meredith Parry, Chief Operating Officer
Coordinating Officer
Radha Thomas, Head Records Policy and Governance
Coordinating Unit
Office of the Chief Operating Officer
Oversight Committee/Group
None
Business Units Impacted
Obligation Framework
Associated Legislation
Associated Standard
None
Associated Code
None
Associated Information
None
Management Tools
Rule
None
Policy
None
Protocol
None
Procedure
None
Guideline
None
Other Websites
Compliance Overview