Security planning is ad hoc. The A security plan is endorsed, captures A security plan is endorsed by The security plan is comprehensive in Security security plan is partially developed entity’s goals and strategic objectives, accountable authority and captures identifying goals, strategic objectives, planning and implemented but may not be key threats, risks, vulnerabilities and entity’s goals and strategic objectives, key threats, risks, vulnerabilities, risk current or comprehensive. details of security risk tolerances and key threats, risks, vulnerabilities and tolerances and risk mitigations. The risk mitigation strategies. The plan is details of security risk tolerances and security plan influences executive consistently applied across the entity risk mitigation strategies. The plan is management decision-making and in the majority of instances. regularly reviewed and informs planning. The entity continuously entity’s decision-making. The plan is adapts the security plan in response used to determine the security to emerging or changing risks and objectives and clearly supports the threat levels. broader business goals. The security plan is communicated and accessible across the entity. The entity partially monitors security Security capability and risk culture is Consistent and defined approach to The entity proactively engages in Security maturity performance of its security addressed in the security plan. The monitoring the entity’s security ongoing monitoring and improvement maturity capability and risk culture against the performance and progress against the performance, which is tailored to the of security capability and culture monitoring goals and strategic objectives security plan’s goals and strategic entity’s risk environment. The entity through long-term planning to predict identified in the entity security plan. objectives is substantially monitored has clearly defined security goals and and prepare for security challenges. regularly. objectives in the security plan. Performance data is captured Performance is tracked and measured analysed and informs change. to assess security capability and risk culture maturity.
Security planning Security planning is ad hoc. The security plan is partially developed and implemented but may not be current or comprehensive. A security plan is endorsed, captures entity’s goals and strategic objectives, key threats, risks, vulnerabilities and details of security risk tolerances and risk mitigation strategies. The plan is consistently applied across the entity in the majority of instances. A security plan is endorsed by accountable authority and captures entity’s goals and strategic objectives, key threats, risks, vulnerabilities and details of security risk tolerances and risk mitigation strategies. The plan is regularly reviewed and informs entity’s decision-making. The plan is used to determine the security objectives and clearly supports the broader business goals. The security plan is communicated and accessible across the entity. The security plan is comprehensive in identifying goals, strategic objectives, key threats, risks, vulnerabilities, risk tolerances and risk mitigations. The security plan influences executive management decision-making and planning. The entity continuously adapts the security plan in response to emerging or changing risks and threat levels. Security maturity monitoring The entity partially monitors security maturity performance of its security capability and risk culture against the goals and strategic objectives identified in the entity security plan. Security capability and risk culture is addressed in the security plan. The performance and progress against the security plan’s goals and strategic objectives is substantially monitored regularly. Consistent and defined approach to monitoring the entity’s security performance, which is tailored to the entity’s risk environment. The entity has clearly defined security goals and objectives in the security plan. Performance is tracked and measured to assess security capability and risk culture maturity. The entity proactively engages in ongoing monitoring and improvement of security capability and culture through long-term planning to predict and prepare for security challenges. Performance data is captured analysed and informs change.
pspf-govsec-05-reporting-security.DOCX