PSPF Maturity Self-Assessment Model Security governance Outcome: Each entity manages security risks and supports a positive security culture in an appropriately mature manner ensuring clear lines of accountability, sound planning, investigation and response, assurance and review processes and proportionate reporting. Table PSPF Maturity Self-Assessment Model – Security governance Ad Developing Managing Embedded hoc Description Partial: Some PSPF core and Substantial: The majority of PSPF Full: All PSPF core and supporting Excelled: All PSPF core and supporting supporting requirements are core and supporting requirements requirements are implemented, requirements are implemented, implemented although are not well are implemented, broadly managed integrated into business practices and effectively integrated and exceeding understood across the entity. and understood across the entity. effectively disseminated across the security outcomes. Entity’s Security outcomes are not being Entity is largely meeting security entity. Entity meets security implementation of better-practice achieved in some areas. outcomes. outcomes. guidance drives achieving high performance. Role of The accountable authority is partially The accountable authority The accountable authority The accountable authority has an accountable aware of protective security substantially applies protective consistently applies protective integrated, continuous-improvement authority requirements across the entity. security requirements across the security policy across the entity, approach to security management Partial understanding, assessment entity. Security risks and risk determines the entity’s tolerance for across the entity. Security risk and management of security risks to tolerances are identified and are security risks, promotes sound risk management is a significant priority the entity’s people, information and substantially managed, monitored or management processes and ensures for the entity and is identified and assets. Security is dealt with in an ad reassessed on a regular basis. Security appropriate governance aligned to business objectives. The hoc manner. risk decisions and shared risks that arrangements are in place to protect entity identifies and operates within affect other entities are substantially the entity’s people, information and agreed and defendable risk tolerances managed and communicated to assets. In medium to large entities, that actively inform business affected entities. the management committee oversees decisions. Formal risk management and reviews risk profile and ensures processes and initiatives to connect underpinning procedures are security risk management and consistent and adaptable to changes operations are in place. The entity in the risk environment. Security risk promotes inter-entity collaboration to decisions and shared risks that affect improve management of security risk other entities are understood and decisions and shared risks that affect communicated in a timely manner. other entities. Where appropriate, the entity provides best-practice advice to other entities in its area of expertise.
PSPF Maturity Self-Assessment Model Security governance Outcome: Each entity manages security risks and supports a positive security culture in an appropriately mature manner ensuring clear lines of accountability, sound planning, investigation and response, assurance and review processes and proportionate reporting. Table PSPF Maturity Self-Assessment Model – Security governance Ad hoc Developing Managing Embedded Description Partial: Some PSPF core and supporting requirements are implemented although are not well understood across the entity. Security outcomes are not being achieved in some areas. Substantial: The majority of PSPF core and supporting requirements are implemented, broadly managed and understood across the entity. Entity is largely meeting security outcomes. Full: All PSPF core and supporting requirements are implemented, integrated into business practices and effectively disseminated across the entity. Entity meets security outcomes. Excelled: All PSPF core and supporting requirements are implemented, effectively integrated and exceeding security outcomes. Entity’s implementation of better-practice guidance drives achieving high performance. Role of accountable authority The accountable authority is partially aware of protective security requirements across the entity. Partial understanding, assessment and management of security risks to the entity’s people, information and assets. Security is dealt with in an ad hoc manner. The accountable authority substantially applies protective security requirements across the entity. Security risks and risk tolerances are identified and are substantially managed, monitored or reassessed on a regular basis. Security risk decisions and shared risks that affect other entities are substantially managed and communicated to affected entities. The accountable authority consistently applies protective security policy across the entity, determines the entity’s tolerance for security risks, promotes sound risk management processes and ensures appropriate governance arrangements are in place to protect the entity’s people, information and assets. In medium to large entities, the management committee oversees and reviews risk profile and ensures underpinning procedures are consistent and adaptable to changes in the risk environment. Security risk decisions and shared risks that affect other entities are understood and communicated in a timely manner. The accountable authority has an integrated, continuous-improvement approach to security management across the entity. Security risk management is a significant priority for the entity and is identified and aligned to business objectives. The entity identifies and operates within agreed and defendable risk tolerances that actively inform business decisions. Formal risk management processes and initiatives to connect security risk management and operations are in place. The entity promotes inter-entity collaboration to improve management of security risk decisions and shared risks that affect other entities. Where appropriate, the entity provides best-practice advice to other entities in its area of expertise.
pspf-govsec-05-reporting-security.DOCX