Who should assess our security practices when the team is too small to be independent?

Start

Every practice needs an assessor who does not run it

The rule is the internal audit rule applied to an assessment: no one assesses their own work. A small team does not make it optional. It changes where you look for the assessor.

• Then: List who owns and who runs each practice

Step

List who owns and who runs each practice

A practice is your own work if you own it, do it, manage the people who do it day to day, or wrote the procedure it follows. Where you can, also avoid someone rating a practice run by the person they report to. The Head of Information Security owns the programme and rates no practice they own or run.

• Then: Name a lead who runs none of the practices

Step

Name a lead who runs none of the practices

The assessment lead assigns assessors and decides each result, so the lead must be independent of every practice. Authority matters more than security knowledge: the standing to ask a manager for records by a date and to decide a level the manager disputes. An internal audit manager, a finance controls manager or a risk manager usually has it.

• Then: Is there a colleague outside security who runs none of them?

Decision

Is there a colleague outside security who runs none of them?

Someone from finance controls, risk or internal audit is usually the best choice. They know how the organisation works, can ask for a record and wait for it, and have no stake in the answer. What they lack is security detail, which a briefing on what each level needs supplies. The Head of Information Security or the owner may explain what a record is and where it is kept; they do not suggest a level.

• Yes: Assign that assessor and record it in the plan
• No, or not known: Do different people or teams run different practices?

Decision

Do different people or teams run different practices?

With two or more people in security, or a security team beside an IT team, people can rate each other's practices and never their own. Check the split against the list of who runs what: a swap only works where the practices are really divided.

• Yes: Assign that assessor and record it in the plan
• No, or not known: Is there a trusted peer in another organisation?

Decision

Is there a trusted peer in another organisation?

A single-person security function can arrange for a peer in the same sector to rate its practices while it rates theirs. Agree the scope, the model and the confidentiality terms in writing first. Using the same model on both sides keeps results comparable over time.

• Yes: Assign that assessor and record it in the plan
• No, or not known: Can you contract an external assessor?

Decision

Can you contract an external assessor?

An external assessor can rate just the practices no one inside can rate independently, or the whole programme. It fits where one person runs every practice or where a regulator or customer will rely on the result. Agree in writing that they have not designed, run or advised on what they rate in the last 12 months (the pack's default), and that they use your model.

• Yes: Assign that assessor and record it in the plan
• No: Self-assess, mark it, and cap it at Defined

Outcome

Assign that assessor and record it in the plan

Use the first option that gives an assessor who neither owns nor runs the practice, and name them against it in the assessment plan. The levels they give count in full, up to Managed where the evidence supports it.

Step

Self-assess, mark it, and cap it at Defined

Where none of the options works for a practice, its owner rates it. The result is marked self-assessed so the reader knows how far to rely on it, and it cannot be above Defined, because Managed needs a check by someone other than the person who does the work. The lead tells the sponsor. A later independent check of the evidence lifts the cap.

• Then: Over a third self-assessed, or one person runs every practice?

Decision

Over a third self-assessed, or one person runs every practice?

Count the self-assessed results against all results. The pack's target for this measure is none, and never more than a third. Above a third, or where one person runs every practice, the sponsor decides whether to commission an independent assessment, and records the decision (IT-3). If you have not finished assigning assessors, answer yes until you have.

• Yes, or not known: Propose an independent assessment to the sponsor
• No: Proceed, and count self-assessed results in the report

Outcome

Propose an independent assessment to the sponsor

The lead takes a proposal to the sponsor, who decides whether to commission an independent assessment instead of the internal one or as well as it. The plan records the decision and the reason, including a decision not to commission one.

Outcome

Proceed, and count self-assessed results in the report

The report's limits section states how many results are self-assessed, which practices they are, and why no one independent was available. Each stays capped at Defined until someone independent checks its evidence. The count of self-assessed results is also reported to the sponsor each quarter.