Security management structures and The CSO is appointed and key security The CSO is empowered to investigate, Role of the CSO is highly visible and Management responsibilities are partially in place. responsibilities are substantially respond to and report on security central to delivering on strategic structures and Responsibility for designated security assigned. Security risk and incident incidents. Clearly defined security business priorities and objectives. A responsibilities roles, protective security planning reporting is occurring across the roles and responsibilities exist with security governance oversight and management of security entity and response processes are skilled personnel appointed by the function is operational. Security is practices are ad hoc. Incident centrally managed in the majority of CSO and empowered to make security fully integrated into entity operations, reporting is by exception with partial cases. The importance of security and decisions for their entity. A actively managed, monitored and staff awareness of obligations. developing a strong security culture is governance oversight function is drives improvements. Security Incident response processes are substantially recognised by the established (where appropriate to procedures and practices are robust informal and not centrally managed. leadership. The majority of personnel entity size). Entity’s cycle of action, and of proven effectiveness. The CSO Security is partially prioritised by attend periodic security awareness evaluation and learning is evident in ensures personnel resources are leadership with partial employee and and skills development training. response to security incidents. deployed to support the maintenance contractor awareness. Personnel are knowledgeable of of effective protective security; security incident reporting obligations appointing skilled personnel according with reporting processes published to business needs. Comprehensive and accessible. Security is integral to approach to managing security the entity’s business and informs incidents including investigating to decision-making. Leadership is determine root causes and inform actively engaged and visibly prioritises security improvements and education good security practices with a strong programs. security culture evident within the entity. Personnel’s attendance and All personnel are trained annually on understanding of regular education security policy and procedures and programs that inform and assist their take responsibility for implementation understanding of security-related within their area of responsibility. processes and obligations is Security culture is underpinned by monitored. continuous improvement and accountability.
Management structures and responsibilities Security management structures and responsibilities are partially in place. Responsibility for designated security roles, protective security planning and management of security practices are ad hoc. Incident reporting is by exception with partial staff awareness of obligations. Incident response processes are informal and not centrally managed. Security is partially prioritised by leadership with partial employee and contractor awareness. The CSO is appointed and key security responsibilities are substantially assigned. Security risk and incident reporting is occurring across the entity and response processes are centrally managed in the majority of cases. The importance of security and developing a strong security culture is substantially recognised by the leadership. The majority of personnel attend periodic security awareness and skills development training. The CSO is empowered to investigate, respond to and report on security incidents. Clearly defined security roles and responsibilities exist with skilled personnel appointed by the CSO and empowered to make security decisions for their entity. A governance oversight function is established (where appropriate to entity size). Entity’s cycle of action, evaluation and learning is evident in response to security incidents. Personnel are knowledgeable of security incident reporting obligations with reporting processes published and accessible. Security is integral to the entity’s business and informs decision-making. Leadership is actively engaged and visibly prioritises good security practices with a strong security culture evident within the entity. Personnel’s attendance and understanding of regular education programs that inform and assist their understanding of security-related processes and obligations is monitored. Role of the CSO is highly visible and central to delivering on strategic business priorities and objectives. A security governance oversight function is operational. Security is fully integrated into entity operations, actively managed, monitored and drives improvements. Security procedures and practices are robust and of proven effectiveness. The CSO ensures personnel resources are deployed to support the maintenance of effective protective security; appointing skilled personnel according to business needs. Comprehensive approach to managing security incidents including investigating to determine root causes and inform security improvements and education programs. All personnel are trained annually on security policy and procedures and take responsibility for implementation within their area of responsibility. Security culture is underpinned by continuous improvement and accountability.