Security planning is ad hoc. The A security plan is endorsed, A security plan is endorsed by The security plan is Security security plan is partially captures entity’s goals and accountable authority and comprehensive in identifying planning developed and implemented but strategic objectives, key threats, captures entity’s goals and goals, strategic objectives, key may not be current or risks, vulnerabilities and details of strategic objectives, key threats, threats, risks, vulnerabilities, risk comprehensive. security risk tolerances and risk risks, vulnerabilities and details of tolerances and risk mitigations. mitigation strategies. The plan is security risk tolerances and risk The security plan influences consistently applied across the mitigation strategies. The plan is executive management entity in the majority of instances. regularly reviewed and informs and planning. The entity entity’s decision-making. The plan continuously adapts the security is used to determine the security plan in response to emerging or objectives and clearly supports changing risks and threat levels. the broader business goals. The security plan is communicated and accessible across the entity. The entity partially monitors Security capability and risk culture Consistent and defined approach The entity proactively engages in Security security maturity performance of is addressed in the security plan. to monitoring the entity’s security ongoing monitoring and maturity its security capability and risk The performance and progress performance, which is tailored to improvement of security monitoring culture against the goals and against the security plan’s goals the entity’s risk environment. The capability and culture through strategic objectives identified in and strategic objectives is entity has clearly defined security long-term planning to predict and the entity security plan. substantially monitored regularly. goals and objectives in the prepare for security challenges. security plan. Performance is Performance data is captured tracked and measured to assess analysed and informs change. security capability and risk culture maturity.
Security planning Security planning is ad hoc. The security plan is partially developed and implemented but may not be current or comprehensive. A security plan is endorsed, captures entity’s goals and strategic objectives, key threats, risks, vulnerabilities and details of security risk tolerances and risk mitigation strategies. The plan is consistently applied across the entity in the majority of instances. A security plan is endorsed by accountable authority and captures entity’s goals and strategic objectives, key threats, risks, vulnerabilities and details of security risk tolerances and risk mitigation strategies. The plan is regularly reviewed and informs entity’s decision-making. The plan is used to determine the security objectives and clearly supports the broader business goals. The security plan is communicated and accessible across the entity. The security plan is comprehensive in identifying goals, strategic objectives, key threats, risks, vulnerabilities, risk tolerances and risk mitigations. The security plan influences executive management and planning. The entity continuously adapts the security plan in response to emerging or changing risks and threat levels. Security maturity monitoring The entity partially monitors security maturity performance of its security capability and risk culture against the goals and strategic objectives identified in the entity security plan. Security capability and risk culture is addressed in the security plan. The performance and progress against the security plan’s goals and strategic objectives is substantially monitored regularly. Consistent and defined approach to monitoring the entity’s security performance, which is tailored to the entity’s risk environment. The entity has clearly defined security goals and objectives in the security plan. Performance is tracked and measured to assess security capability and risk culture maturity. The entity proactively engages in ongoing monitoring and improvement of security capability and culture through long-term planning to predict and prepare for security challenges. Performance data is captured analysed and informs change.