How mature is our security programme?

Defined needs

A role description or appointment, approved by management, that names the person accountable for security, their reporting line and their authority.

Managed adds

Their objectives are reviewed each year against results by the person they report to, and where a review found the role needed to change, it was changed and the record says why.

The level the evidence supports

Defined needs

A security report to the board or its equivalent at least every quarter, and minutes that record the decisions taken on it.

Managed adds

The report's measures have targets, and the decisions and actions it leads to are tracked to closure and reported back.

The level the evidence supports

Defined needs

Written security objectives for the year, approved by management, each with an owner, a date and how it will be measured.

Managed adds

Progress is reported at least each quarter, and an objective that will be missed leads to a recorded decision.

The level the evidence supports

Defined needs

A policy set, each policy approved at the level its tier requires, with an owner and a review date, published where staff can read it.

Managed adds

Reviews are measured as on time or late and reported, and policy breaches and exceptions are used to revise the policies.

The level the evidence supports

Defined needs

Records of acknowledgement for the policies staff must follow, taken on joining, after each material change and once a year, as the Security Policy Management(opens in a new tab) pack (P04, PF-09) sets.

Managed adds

The acknowledgement rate is measured and reported, and those who have not acknowledged are followed up to a deadline.

The level the evidence supports

Defined needs

A written risk method, a register in which every risk has an owner and a rating made by that method, and a review of the register at the interval the method sets.

Managed adds

Treatment progress and risks outside appetite are measured and reported, and where the reviews found the method wrong, it was changed and the record says why.

The level the evidence supports

Defined needs

An appetite statement approved by the approver, and a decision recorded at the right level for every risk outside it: treat, or accept with the reason.

Managed adds

Appetite is reviewed each year, and the number of risks outside it, and their age, is reported to management each quarter.

The level the evidence supports

Defined needs

An exception register in which every exception has a risk owner, an approver at the level its rating requires, compensating controls and an expiry date.

Managed adds

Expired and renewed exceptions are counted and reported, and an exception renewed more than the rules allow goes to the next level up.

The level the evidence supports

Defined needs

A supplier register in which every supplier with access to data or systems has a tier, and the contracts of the highest tier carry the security clauses the tier requires.

Managed adds

The share of high-tier suppliers whose contracts carry the required clauses is measured, and gaps are closed at renewal to a plan.

The level the evidence supports

Defined needs

An assessment on record before contract for every supplier in the highest tiers, and a periodic review at the interval the tier sets.

Managed adds

Overdue reviews are counted and reported, and assessment findings are tracked to closure with the supplier.

The level the evidence supports

Defined needs

A register of the security obligations that apply, each with an owner and the date it was last confirmed, including whether NIS2, DORA or the GDPR apply and in which role.

Managed adds

The register is reviewed at least each year and whenever the business changes, and a new obligation reaches the register within a set time.

The level the evidence supports

Defined needs

A check against each obligation at least each year, with gaps recorded and assigned.

Managed adds

Gaps are tracked to closure and reported, and the checks are made by someone other than the obligation's owner.

The level the evidence supports

Defined needs

A written definition for every reported metric, a named owner, and data quality checks recorded before each report.

Managed adds

Metrics are reviewed each year against the decisions they serve, and failed data checks are used to fix their sources.

The level the evidence supports

Defined needs

A planned assessment or internal audit at least each year, its findings in a tracker with owners and dates, and closure checked by someone other than the action owner.

Managed adds

Overdue findings are counted and reported to management, and where an assessment showed the method failed, it was improved and the record says why.

The level the evidence supports

Defined needs

An inventory of devices, software and cloud services, each with an owner, kept current by a set process.

Managed adds

Completeness is checked against another source, such as network discovery or purchasing records, and differences are measured and fixed.

The level the evidence supports

Defined needs

A classification scheme approved by management, handling rules for each level, and records showing information is labelled and handled by them.

Managed adds

Handling is checked on a sample at a set interval, and the results are reported and used to change the rules or the training.

The level the evidence supports

Defined needs

Scan coverage of the in-scope assets on record, and a written prioritisation method applied to every finding.

Managed adds

Coverage is measured against the inventory and reported, and where the measures showed a gap, the method was adjusted and the record says why.

The level the evidence supports

Defined needs

Written remediation deadlines by priority, records showing fixes against them, and a deferral approved as an exception whenever a deadline is missed.

Managed adds

Fixes within deadline are measured and reported, and fixes are verified by a rescan before closure.

The level the evidence supports

Defined needs

A written process with approval before access, and records showing leavers' access removed within the time it sets.

Managed adds

Removal times are measured and reported, and where a removal was late, the process was changed and the record says why.

The level the evidence supports

Defined needs

Access reviews of the in-scope systems at the interval the procedure sets, with removals made and recorded.

Managed adds

Completion and removal rates are measured and reported, and reviews are checked by someone other than the reviewer.

The level the evidence supports

Defined needs

A list of privileged accounts with an owner and approval for each, separate accounts for privileged work, and strong authentication on them.

Managed adds

Privileged activity is logged and reviewed, and the number of privileged accounts is measured and reported.

The level the evidence supports

Defined needs

A training plan by audience, records of completion, and additional training for roles at higher risk.

Managed adds

Completion is measured and followed up, and the plan is changed each year from incidents and risks.

The level the evidence supports

Defined needs

A written measure of behaviour, such as the reporting rate of suspicious emails, collected at a set interval.

Managed adds

The measure has a target, it is reported, and where it showed a problem, the programme was changed in response.

The level the evidence supports

Defined needs

A backup schedule for critical data, a copy protected from the systems it backs up, and records of restore tests at the interval set.

Managed adds

Restore success and time are measured and reported, and failed restores lead to recorded changes.

The level the evidence supports

Defined needs

Written configuration baselines for the main system types, and records showing new systems are built to them.

Managed adds

Drift from the baseline is detected and measured, and the baselines are reviewed at a set interval.

The level the evidence supports

Defined needs

A list of the systems whose logs are collected, central collection protected from change, and retention as the organisation has decided.

Managed adds

Missing log sources are detected and reported, and the list is reviewed when systems change.

The level the evidence supports

Defined needs

Written criteria for the alerts that must be reviewed, a response time, and records of triage.

Managed adds

Triage times and missed alerts are measured and reported, and the criteria are tuned from incidents and false positives.

The level the evidence supports

Defined needs

An approved incident procedure with severity levels and named roles, and incident records that follow it.

Managed adds

Response measures are reported, and post-incident reviews lead to changes that are tracked to closure.

The level the evidence supports

Defined needs

A record of which regimes apply, a written way of deciding whether to report, named people with tested access to each authority's channel, and records of decisions made.

Managed adds

Decisions and reports on time are measured, and readiness is re-checked at a set interval.

The level the evidence supports

Defined needs

An exercise programme, at least one exercise held in the evidence window, and its lessons recorded with owners.

Managed adds

Lessons are tracked to closure and reported, and the programme varies scenarios and participants from year to year.

The level the evidence supports

Defined needs

A list of critical services with recovery time objectives agreed by their business owners, and a recovery plan for each.

Managed adds

The objectives are reviewed each year, and plans are updated after each test or real recovery.

The level the evidence supports

Defined needs

Recovery tests at the interval set, with the time achieved recorded against the objective.

Managed adds

Results are reported, and every missed objective leads to a recorded change.

The level the evidence supports