Security management structures The CSO is appointed and key The CSO is empowered to Role of the CSO is highly visible Management and responsibilities are partially security responsibilities are investigate, respond to and report and central to delivering on structures and in place. Responsibility for substantially assigned. Security on security incidents. Clearly strategic business priorities and responsibilities designated security roles, risk and incident reporting is defined security roles and objectives. A security governance protective security planning and occurring across the entity and responsibilities exist with skilled oversight function is operational. management of security practices response processes are centrally personnel appointed by the CSO Security is fully integrated into are ad hoc. Incident reporting is managed in the majority of cases. and empowered to make security entity operations, actively by exception with partial staff The importance of security and decisions for their entity. A managed, monitored and drives awareness of obligations. developing a strong security governance oversight function is improvements. Security Incident response processes are culture is substantially recognised established (where appropriate to procedures and practices are informal and not centrally by the leadership. The majority of entity size). Entity’s cycle of robust and of proven managed. Security is partially personnel attend periodic security action, evaluation and learning is effectiveness. The CSO ensures prioritised by leadership with awareness and skills development evident in response to security personnel resources are deployed partial employee and contractor training. incidents. Personnel are to support the maintenance of awareness. knowledgeable of security effective protective security; incident reporting obligations appointing skilled personnel with reporting processes according to business needs. published and accessible. Security Comprehensive approach to is integral to the entity’s business managing security incidents and informs decision-making. including investigating to Leadership is actively engaged determine root causes and inform and visibly prioritises good security improvements and security practices with a strong education programs. security culture evident within the entity. Personnel’s attendance All personnel are trained annually and understanding of regular on security policy and procedures education programs that inform and take responsibility for and assist their understanding of implementation within their area security-related processes and of responsibility. Security culture obligations is monitored. is underpinned by continuous and accountability.
Management structures and responsibilities Security management structures and responsibilities are partially in place. Responsibility for designated security roles, protective security planning and management of security practices are ad hoc. Incident reporting is by exception with partial staff awareness of obligations. Incident response processes are informal and not centrally managed. Security is partially prioritised by leadership with partial employee and contractor awareness. The CSO is appointed and key security responsibilities are substantially assigned. Security risk and incident reporting is occurring across the entity and response processes are centrally managed in the majority of cases. The importance of security and developing a strong security culture is substantially recognised by the leadership. The majority of personnel attend periodic security awareness and skills development training. The CSO is empowered to investigate, respond to and report on security incidents. Clearly defined security roles and responsibilities exist with skilled personnel appointed by the CSO and empowered to make security decisions for their entity. A governance oversight function is established (where appropriate to entity size). Entity’s cycle of action, evaluation and learning is evident in response to security incidents. Personnel are knowledgeable of security incident reporting obligations with reporting processes published and accessible. Security is integral to the entity’s business and informs decision-making. Leadership is actively engaged and visibly prioritises good security practices with a strong security culture evident within the entity. Personnel’s attendance and understanding of regular education programs that inform and assist their understanding of security-related processes and obligations is monitored. Role of the CSO is highly visible and central to delivering on strategic business priorities and objectives. A security governance oversight function is operational. Security is fully integrated into entity operations, actively managed, monitored and drives improvements. Security procedures and practices are robust and of proven effectiveness. The CSO ensures personnel resources are deployed to support the maintenance of effective protective security; appointing skilled personnel according to business needs. Comprehensive approach to managing security incidents including investigating to determine root causes and inform security improvements and education programs. All personnel are trained annually on security policy and procedures and take responsibility for implementation within their area of responsibility. Security culture is underpinned by continuous and accountability.
govsec05-annexa-security-governance.docx