The entity has partially met external The entity substantially meets The entity meets all external The entity excels in meeting reporting Reporting on reporting obligations to its portfolio external reporting obligations to the reporting obligations within required obligations and uses annual reporting security minister, AGD and other affected portfolio minister, AGD and other timeframes to the portfolio minister, to drive improvements, strengthen entities. Reporting on the entity’s affected entities. The entity’s AGD and other affected entities security culture and inform future achievement of security outcomes, achievement of security outcomes, through comprehensive reporting on planning. implementation of core implementation of core requirements, achievement of security outcomes, requirements, maturity of security maturity of security capability, key implementation of core capability, key risks to people, risks to people, information and requirements, maturity of security information and personnel and personnel and mitigation strategies is capability, key risks to people, mitigation strategies is partial and substantially captured in the annual information and personnel and ad hoc. security report. mitigation strategies. Key findings and trends are shared within the entity. Protective security provisions are Appropriate security obligation Provider contracts contain explicit The entity actively monitors and Security partially included in goods and clauses are included in the majority of provisions to ensure implementation audits service provider capability to governance for service provider contracts. The entity provider contracts. The entity of relevant protective security fully implement contractual contracted partially monitors service providers’ substantially applies processes to requirements. The entity uses protective security requirements. goods and adherence to contract provisions. monitor service provider adherence processes to monitor service Where appropriate, the entity service to contract provisions. providers’ adherence to contract supports contractors to achieve providers provisions and security obligations. security outcomes.
Reporting on security The entity has partially met external reporting obligations to its portfolio minister, AGD and other affected entities. Reporting on the entity’s achievement of security outcomes, implementation of core requirements, maturity of security capability, key risks to people, information and personnel and mitigation strategies is partial and ad hoc. The entity substantially meets external reporting obligations to the portfolio minister, AGD and other affected entities. The entity’s achievement of security outcomes, implementation of core requirements, maturity of security capability, key risks to people, information and personnel and mitigation strategies is substantially captured in the annual security report. The entity meets all external reporting obligations within required timeframes to the portfolio minister, AGD and other affected entities through comprehensive reporting on achievement of security outcomes, implementation of core requirements, maturity of security capability, key risks to people, information and personnel and mitigation strategies. Key findings and trends are shared within the entity. The entity excels in meeting reporting obligations and uses annual reporting to drive improvements, strengthen security culture and inform future planning. Security governance for contracted goods and service providers Protective security provisions are partially included in goods and service provider contracts. The entity partially monitors service providers’ adherence to contract provisions. Appropriate security obligation clauses are included in the majority of provider contracts. The entity substantially applies processes to monitor service provider adherence to contract provisions. Provider contracts contain explicit provisions to ensure implementation of relevant protective security requirements. The entity uses processes to monitor service providers’ adherence to contract provisions and security obligations. The entity actively monitors and audits service provider capability to fully implement contractual protective security requirements. Where appropriate, the entity supports contractors to achieve security outcomes.
pspf-govsec-05-reporting-security.DOCX