PSPF Maturity Self-Assessment Model Security governance Outcome: Each entity manages security risks and supports a positive security culture in an appropriately mature manner ensuring clear lines of accountability, sound planning, investigation and response, assurance and review processes and proportionate reporting. Table PSPF Maturity Self-Assessment Model – Security governance Ad hoc Developing Managing Embedded Description Partial: Some PSPF core and supporting requirements are implemented although are not well understood across the entity. Security outcomes are not being achieved in some areas. Substantial: The majority of PSPF core and supporting requirements are implemented, broadly managed and understood across the entity. Entity is largely meeting security outcomes. Full: All PSPF core and supporting requirements are implemented, integrated into business practices and effectively disseminated across the entity. Entity meets security outcomes. Excelled: All PSPF core and supporting requirements are implemented, effectively integrated and exceeding security outcomes. Entity’s implementation of better-practice guidance drives achieving high performance. Role of accountable authority The accountable authority is partially aware of protective security requirements across the entity. Partial understanding, assessment and management of security risks to the entity’s people, information and assets. Security is dealt with in an ad hoc manner. The accountable authority substantially applies protective security requirements across the entity. Security risks and risk tolerances are identified and are substantially managed, monitored or reassessed on a regular basis. Security risk decisions and shared risks that affect other entities are substantially managed and communicated to affected entities. The accountable authority consistently applies protective security policy across the entity, determines the entity’s tolerance for security risks, promotes sound risk management processes and ensures appropriate governance arrangements are in place to protect the entity’s people, information and assets. In medium to large entities, the management committee oversees and reviews risk profile and ensures underpinning procedures are consistent and adaptable to changes in the risk environment. Security risk decisions and shared risks that affect other entities are understood and communicated in a timely manner. The accountable authority has an integrated, continuous-improvement approach to security management across the entity. Security risk management is a significant priority for the entity and is identified and aligned to business objectives. The entity identifies and operates within agreed and defendable risk tolerances that actively inform business decisions. Formal risk management processes and initiatives to connect security risk management and operations are in place. The entity promotes inter-entity collaboration to improve management of security risk decisions and shared risks that affect other entities. Where appropriate, the entity provides best-practice advice to other entities in its area of expertise.
Security planning Security planning is ad hoc. The security plan is partially developed and implemented but may not be current or comprehensive. A security plan is endorsed, captures entity’s goals and strategic objectives, key threats, risks, vulnerabilities and details of security risk tolerances and risk mitigation strategies. The plan is consistently applied across the entity in the majority of instances. A security plan is endorsed by accountable authority and captures entity’s goals and strategic objectives, key threats, risks, vulnerabilities and details of security risk tolerances and risk mitigation strategies. The plan is regularly reviewed and informs entity’s decision-making. The plan is used to determine the security objectives and clearly supports the broader business goals. The security plan is communicated and accessible across the entity. The security plan is comprehensive in identifying goals, strategic objectives, key threats, risks, vulnerabilities, risk tolerances and risk mitigations. The security plan influences executive management decision-making and planning. The entity continuously adapts the security plan in response to emerging or changing risks and threat levels. Security maturity monitoring The entity partially monitors security maturity performance of its security capability and risk culture against the goals and strategic objectives identified in the entity security plan. Security capability and risk culture is addressed in the security plan. The performance and progress against the security plan’s goals and strategic objectives is substantially monitored regularly. Consistent and defined approach to monitoring the entity’s security performance, which is tailored to the entity’s risk environment. The entity has clearly defined security goals and objectives in the security plan. Performance is tracked and measured to assess security capability and risk culture maturity. The entity proactively engages in ongoing monitoring and improvement of security capability and culture through long-term planning to predict and prepare for security challenges. Performance data is captured analysed and informs change.
Reporting on security The entity has partially met external reporting obligations to its portfolio minister, AGD and other affected entities. Reporting on the entity’s achievement of security outcomes, implementation of core requirements, maturity of security capability, key risks to people, information and personnel and mitigation strategies is partial and ad hoc. The entity substantially meets external reporting obligations to the portfolio minister, AGD and other affected entities. The entity’s achievement of security outcomes, implementation of core requirements, maturity of security capability, key risks to people, information and personnel and mitigation strategies is substantially captured in the annual security report. The entity meets all external reporting obligations within required timeframes to the portfolio minister, AGD and other affected entities through comprehensive reporting on achievement of security outcomes, implementation of core requirements, maturity of security capability, key risks to people, information and personnel and mitigation strategies. Key findings and trends are shared within the entity. The entity excels in meeting reporting obligations and uses annual reporting to drive improvements, strengthen security culture and inform future planning. Security governance for contracted goods and service providers Protective security provisions are partially included in goods and service provider contracts. The entity partially monitors service providers’ adherence to contract provisions. Appropriate security obligation clauses are included in the majority of provider contracts. The entity substantially applies processes to monitor service provider adherence to contract provisions. Provider contracts contain explicit provisions to ensure implementation of relevant protective security requirements. The entity uses processes to monitor service providers’ adherence to contract provisions and security obligations. The entity actively monitors and audits service provider capability to fully implement contractual protective security requirements. Where appropriate, the entity supports contractors to achieve security outcomes.
Security governance for international sharing The entity has access to foreign government information and assets and partially understands and implements handling and protection requirements agreed in international agreements and arrangements to which Australia is a party. The entity has access to foreign government information and assets. There is substantial awareness, through training and accessibility of applicable agreements, of the level of handling protection requirements agreed in international agreements and arrangements to which Australia is a party. The entity has access to foreign government information and assets and consistently applies handling protection requirements agreed in international agreements and arrangements to which Australia is a party. Alternatively, the entity is confident it does not access any information or assets that would be governed by international agreements or arrangements to which Australia is a party. Where an entity has access to foreign government information and assets, it actively implements and monitors handling requirements agreed in international agreements and arrangements to which Australia is a party – and these are consistently applied. The entity proactively contributes to, and identifies, opportunities to evolve multilateral, bilateral agreements and arrangements to which Australia is a party on sharing and protection of information and assets.
Separating personnel Partial ad hoc processes are in place to ensure that separating personnel have their access to Australian Government resources withdrawn and are informed of their ongoing security obligations. Separating personnel, in the majority of cases, understand their ongoing security obligations and have their access to Australian Government resources withdrawn. Systems and processes are substantially developed to verify consistency of separating personnel practices across the entity. The entity has in place systems and processes to ensure that all separating personnel understand their ongoing security obligations, particularly where they have had access to sensitive and security classified information and resources during their employment. Separating personnel have their access to Australian Government resources withdrawn within an appropriate timeframe. The entity has proactively implemented systems and processes that are reviewed regularly for separating personnel. Access to Australian Government resources is withdrawn from personnel on separation. The entity ensures separating personnel are debriefed and provided a comprehensive understanding of their ongoing security obligations. Information of security concern about separating personnel is shared with relevant stakeholders, including internally, where appropriate. Risk assessments are undertaken, where appropriate.