PERFORMANCE MEASURES KEY FOCUS AREA ACTIVITIES BASELINE Resource Enabling / OUTPUTS TARGET DATA Required Condition INDICATOR / TARGET DATE Designate a senior staff member (in The profile, post and job description the case of a government department, should comply with the criteria as given at least at the level of director) as in the State Security Agency (SSA) security manager for that institution to position paper Managers in “Security manage the security function at the Government Bodies” and SSA said institution; provided that the head guidance document Profile “Guideline – of the institution may, with the of a Security Manager”. approval of the Agency, appoint a staff member at a lower level as security manager. Establish a security component or Determine the size and functions of the support structure for the Security security component in consultation with Manager. SSA. Establish a security committee for the representatives (on senior Security institution, comprising management level) from all main MISS) business functions or structures of the institution. Ensure that a security threat and risk identification of all critical assets, (i.e. assessment is conducted of the systems and services of the institution by the security committee institution; (according to SSA guidelines in this identification of the categories of regard). information held by the institution that Information require protection against disclosure; identification of security threats Standards against the institution; identification of security vulnerabilities; Minimum recommendations to address the identified vulnerabilities Ensure and oversee the development, Assign the responsibility to develop the implementation and maintenance of security policy and directives to the an internal security policy, as well as security manager and the security directives in connection therewith, for committee. Ensure that the security that institution that complies with all policy assigns pertinent security the requirements of the Minimum responsibilities and/or duties to specific Information Security Standards. officials, and that it provides for disciplinary and remedial steps in
KEY FOCUS AREA ACTIVITIES / OUTPUTS PERFORMANCE MEASURES BASELINE DATA Resource Required Enabling Condition TARGET DATE INDICATOR / TARGET Minimum Information Security Standards (i.e. MISS) Designate a senior staff member (in the case of a government department, at least at the level of director) as security manager for that institution to manage the security function at the said institution; provided that the head of the institution may, with the approval of the Agency, appoint a staff member at a lower level as security manager. The profile, post and job description should comply with the criteria as given in the State Security Agency (SSA) position paper “Security Managers in Government Bodies” and SSA guidance document “Guideline – Profile of a Security Manager”. Establish a security component or support structure for the Security Manager. Determine the size and functions of the security component in consultation with SSA. Establish a security committee for the institution, comprising representatives (on senior management level) from all main business functions or structures of the institution. Ensure that a security threat and risk assessment is conducted of the institution by the security committee (according to SSA guidelines in this regard). identification of all critical assets, systems and services of the institution; identification of the categories of information held by the institution that require protection against disclosure; identification of security threats against the institution; identification of security vulnerabilities; recommendations to address the identified vulnerabilities Ensure and oversee the development, implementation and maintenance of an internal security policy, as well as directives in connection therewith, for that institution that complies with all the requirements of the Minimum Information Security Standards. Assign the responsibility to develop the security policy and directives to the security manager and the security committee. Ensure that the security policy assigns pertinent security responsibilities and/or duties to specific officials, and that it provides for disciplinary and remedial steps in