Governance (IG) clients beyond it the organisation influence at national or international standards level A2 Policy & Standards Understands the need for policy and standards to achieve Information Security (IS) With supervision and aligned with business objectives, authors or provides advice on IS policy or standards Without supervision, advances business objectives through development or interpretation of a range of IS policies or standards A recognised expert in IS policy and standard development 1. 2. A3 Information Security Strategy Understands the purpose of IS strategy to realise business benefits Contributes to development or implementation of IS strategy under supervision Influences investment decisions or risk appetites through contribution to development or implementation of IS strategy A recognised expert in IS strategy development or implementation 1. 2.
A4 Innovation & Business Improvement Is aware of business benefits of good IS Applies IS to achieve business objectives with some supervision Supports realisation of strategic business benefits through innovative application of IS Develops and promotes new concepts for business improvement through IS which are widely adopted across the public sector or an industry sector 1. 2. A5 Information Security Awareness & Training Understands the role of security awareness and training in maintaining information security Materially contributes to improving security awareness with some supervision Delivers or manages the delivery of training on multiple aspects of IS A recognised authority on the development of IS Awareness & Training 1. 2. A6 Legal & Regulatory Environment Is aware of major pieces of legislation relevant to IS and of regulatory bodies relevant to the sector in which they work Understands applicable legislation and regulations relating to IS in the context of own or client organisations Influences business practices affecting IS through the application of legislation and regulations Is an authority on an area of legislation or regulation relevant to IS 1. 2.
A7 Third Party Management Is aware of the need for organisations to manage the information security of third parties With supervision, contributes to developing or maintaining compliance by third parties to contracting authority's IS policies and standards Enhances organisational IS through broad influence on third party management Advances best practice in third party management with respect to information security 1. 2. B1 Risk Assessment Demonstrates awareness of the causes of information risk and their implications Understands how to produce risk assessments Produces complex risk assessments that influence senior risk owners, managers or other stakeholders Influences development of risk assessment methodologies across and beyond an organisation 1. 2. B2 Risk Management Demonstrate awareness of techniques to manage information risk Contributes to management of risks to information systems with supervision Advises management on information risk across a business unit or organisation Advances the practice of information risk management across the public sector or an industry sector or internationally 1. 2.
D2 Security Testing Is aware of the role of testing to support IA Effectively applies testing methodologies, tools or techniques with some supervision Provides assurance on the security of a product or process through effective testing Advances assurance standards across a product range, technology or industry sector through rigorous security testing 1. 2. E1 Secure Operations Management Is aware of the need for secure management of information systems Monitors the application of SyOPs with some supervision Manages the development of SyOPs for use across multiple information systems or manages compliance with them An authority on Security Operations Management, working across the public sector or an industry sector 1. 2. E2 Secure Operations & Service Delivery Is aware of the need for Information systems and services to be operated securely Effectively applies SyOPs with some supervision Develops SyOPs for use across multiple information systems or maintains compliance with them Influences SyOPs used across the public sector or an industry sector 1. 2.
E3 Vulnerability Assessment Is aware of the need for vulnerability assessment to maintain Information Security Obtains and acts on vulnerability information in accordance with Security Operating Procedures Ensures that information risk managers respond appropriately to relevant vulnerability information Is an authority on the use or impact of vulnerability assessments across the public sector or an industry sector 1. 2. F1 Incident Management Is aware of the benefits of managing security incidents Contributes to security incident management Manages security incidents Is an authority on security incident management across the public sector or an industry sector 1. 2. F2 Investigation Is aware of the basic principles of investigations Contributes to investigations into security incidents Leads investigations into security incidents or manages a team of investigators or provide skills support Is an authority on security investigations 1. 2. F3 Forensics Is aware of the capability of forensics to support Contributes to forensic activities, with some Manages forensic capability or provides skilled Is an authority on forensics 1.
investigations supervision support 2. G1 Audit and Review Understands basic techniques for testing compliance with security criteria (policies, standards, legal and regulatory requirements) Audits compliance with security criteria in accordance with an appropriate methodology Influences senior information risk owners or business managers through information risk driven auditing Advances the influence of security auditing across the public sector or across an industry sector 1. 2. H1 Business Continuity Planning Understands how Business Continuity Planning and Management contributes to information security Contributes to the definition of business continuity processes to maintain information security Leads definition or implementation of business continuity processes to maintain information security across a business unit or organisation Is an authority on information security aspects of Business continuity 1. 2.
H2 Business Continuity Management Understands how Business Continuity Planning and Management contributes to information security Contributes to the definition of business continuity processes to maintain information security Leads definition or implementation of business continuity processes to maintain information security across a business unit or organisation Is an authority on information security aspects of Business continuity 1. 2. I1 Research Not defined Not defined Not defined Not defined 1. 2. I2 Academic Research Not defined Not defined Not defined Not defined 1. 2. I3 Applied Research Understands the fundamental concepts of applied research but does not yet have the knowledge Performs research activities under supervision Leads research tasks, working independently and coaching others Acknowledged as a leader in the research community 1. 2.
specific business or functional areas. EMRG Emerging Technology Monitoring Not defined Not defined Not defined Monitors the market to gain knowledge and understanding of currently emerging technologies. 1. 2. BSMO Business Modelling Understands the purpose and benefits of modelling Conversant with techniques covering full range of modelling situations. Conducts advanced modelling activities for significant change programmes and across multiple business functions Produces models in support of business strategy. 1. 2. REQM Requirements Definition & Management Uses established techniques as directed to identify current problems and elicit, specify and document business functional, data and requirements for simple subject areas Defines scope and business priorities for small-scale changes and may assist in larger scale scoping exercises. Facilitates scoping and business for change initiatives of medium-size and complexity. Facilitates scoping and business priority-setting for change initiatives of medium size and complexity. 1. 2.
with clearly defined boundaries. DESN Systems Design Undertakes complete design of simple applications using simple templates and tools. Specifies user/system interfaces, and translates logical designs into physical designs taking account of target environment, performance requirements and existing systems. structures and tools for systems which meet business needs. Specifies and designs large or complex systems. 1. 2. NTDS Network Design Not defined Not defined Not defined Produces outline system designs and specifications, and overall architecture, topologies, configuration databases and design documentation of networks and networking technology within the organisation. 1. 2.