The entity has partially met The entity substantially meets The entity meets all external The entity excels in meeting Reporting on external reporting obligations to external reporting obligations to reporting obligations within reporting obligations and uses security its portfolio minister, AGD and the portfolio minister, AGD and required timeframes to the annual reporting to drive other affected entities. Reporting other affected entities. The portfolio minister, AGD and other improvements, strengthen on the entity’s achievement of entity’s achievement of security affected entities through security culture and inform future security outcomes, outcomes, implementation of comprehensive reporting on planning. implementation of core core requirements, maturity of achievement of security requirements, maturity of security capability, key risks to outcomes, implementation of security capability, key risks to people, information and core requirements, maturity of people, information and personnel and mitigation security capability, key risks to personnel and mitigation strategies is substantially people, information and strategies is partial and ad hoc. captured in the annual security personnel and mitigation report. strategies. Key findings and trends are shared within the entity. Protective security provisions are Appropriate security obligation Provider contracts contain explicit The entity actively monitors and Security partially included in goods and clauses are included in the provisions to ensure audits service provider capability governance for service provider contracts. The majority of provider contracts. implementation of relevant to fully implement contractual contracted entity partially monitors service The entity substantially applies protective security requirements. protective security requirements. goods and providers’ adherence to contract processes to monitor service The entity uses processes to Where appropriate, the entity service provisions. provider adherence to contract monitor service providers’ supports contractors to achieve providers provisions. adherence to contract provisions security outcomes. and security obligations.
Reporting on security The entity has partially met external reporting obligations to its portfolio minister, AGD and other affected entities. Reporting on the entity’s achievement of security outcomes, implementation of core requirements, maturity of security capability, key risks to people, information and personnel and mitigation strategies is partial and ad hoc. The entity substantially meets external reporting obligations to the portfolio minister, AGD and other affected entities. The entity’s achievement of security outcomes, implementation of core requirements, maturity of security capability, key risks to people, information and personnel and mitigation strategies is substantially captured in the annual security report. The entity meets all external reporting obligations within required timeframes to the portfolio minister, AGD and other affected entities through comprehensive reporting on achievement of security outcomes, implementation of core requirements, maturity of security capability, key risks to people, information and personnel and mitigation strategies. Key findings and trends are shared within the entity. The entity excels in meeting reporting obligations and uses annual reporting to drive improvements, strengthen security culture and inform future planning. Security governance for contracted goods and service providers Protective security provisions are partially included in goods and service provider contracts. The entity partially monitors service providers’ adherence to contract provisions. Appropriate security obligation clauses are included in the majority of provider contracts. The entity substantially applies processes to monitor service provider adherence to contract provisions. Provider contracts contain explicit provisions to ensure implementation of relevant protective security requirements. The entity uses processes to monitor service providers’ adherence to contract provisions and security obligations. The entity actively monitors and audits service provider capability to fully implement contractual protective security requirements. Where appropriate, the entity supports contractors to achieve security outcomes.
govsec05-annexa-security-governance.docx