Description Partial: Some PSPF core and Substantial: The majority of PSPF Full: All PSPF core and supporting Excelled: All PSPF core and supporting requirements are core and supporting requirements are implemented, supporting requirements are implemented although are not requirements are implemented, integrated into business practices implemented, effectively well understood across the broadly managed and and effectively disseminated integrated and exceeding security entity. Security outcomes are understood across the entity. across the entity. Entity meets outcomes. Entity’s not being achieved in some Entity is largely meeting security security outcomes. implementation of better-practice areas. outcomes. guidance drives achieving high performance. Role of The accountable authority is The accountable authority The accountable authority The accountable authority has an accountable partially aware of protective substantially applies protective consistently applies protective integrated, authority security requirements across the security requirements across the security policy across the entity, improvement approach to entity. Partial understanding, entity. Security risks and risk determines the entity’s tolerance security management across the assessment and management of tolerances are identified and are for security risks, promotes sound entity. Security risk management security risks to the entity’s substantially managed, monitored risk management processes and is a significant priority for the people, information and assets. or reassessed on a regular basis. ensures appropriate governance entity and is identified and Security is dealt with in an ad hoc Security risk decisions and shared arrangements are in place to aligned to business objectives. manner. risks that affect other entities are protect the entity’s people, The entity identifies and operates substantially managed and information and assets. In within agreed and defendable risk communicated to affected medium to large entities, the tolerances that actively inform entities. management committee oversees business decisions. Formal risk and reviews risk profile and management processes and ensures underpinning procedures initiatives to connect security risk are consistent and adaptable to management and operations are changes in the risk environment. in place. The entity promotes Security risk decisions and shared inter-entity collaboration to risks that affect other entities are improve management of security understood and communicated in risk decisions and shared risks a timely manner. that affect other entities. Where appropriate, the entity provides best-practice advice to other entities in its area of expertise.
Description Partial: Some PSPF core and supporting requirements are implemented although are not well understood across the entity. Security outcomes are not being achieved in some areas. Substantial: The majority of PSPF core and supporting requirements are implemented, broadly managed and understood across the entity. Entity is largely meeting security outcomes. Full: All PSPF core and supporting requirements are implemented, integrated into business practices and effectively disseminated across the entity. Entity meets security outcomes. Excelled: All PSPF core and supporting requirements are implemented, effectively integrated and exceeding security outcomes. Entity’s implementation of better-practice guidance drives achieving high performance. Role of accountable authority The accountable authority is partially aware of protective security requirements across the entity. Partial understanding, assessment and management of security risks to the entity’s people, information and assets. Security is dealt with in an ad hoc manner. The accountable authority substantially applies protective security requirements across the entity. Security risks and risk tolerances are identified and are substantially managed, monitored or reassessed on a regular basis. Security risk decisions and shared risks that affect other entities are substantially managed and communicated to affected entities. The accountable authority consistently applies protective security policy across the entity, determines the entity’s tolerance for security risks, promotes sound risk management processes and ensures appropriate governance arrangements are in place to protect the entity’s people, information and assets. In medium to large entities, the management committee oversees and reviews risk profile and ensures underpinning procedures are consistent and adaptable to changes in the risk environment. Security risk decisions and shared risks that affect other entities are understood and communicated in a timely manner. The accountable authority has an integrated, approach to security management across the entity. Security risk management is a significant priority for the entity and is identified and aligned to business objectives. The entity identifies and operates within agreed and defendable risk tolerances that actively inform business decisions. Formal risk management processes and initiatives to connect security risk management and operations are in place. The entity promotes inter-entity collaboration to improve management of security risk decisions and shared risks that affect other entities. Where appropriate, the entity provides best-practice advice to other entities in its area of expertise. improvement
govsec05-annexa-security-governance.docx