Protective Security Roles & Responsibilities

Purpose

Use this guidance to plan and assign protective security responsibilities. It covers the roles within your organisation and across government, and security policies.

Who this is for

Chief Executives, Chief Security Officers, security practitioners, and contractors offering protective security advice.

Security policy at your organisation

Why security policy matters

Protective security measures create the operational environment for government business to be conducted safely and securely. Effective security management protects people, information, and assets from risk.

Protective security principles

A security environment must:

• Safeguard people and clients from foreseeable risks
• Enable the appropriate sharing of official information
• Prevent the compromise of confidentiality, integrity, and availability of official information and assets
• Ensure the delivery of essential business regardless of disruptions

Security should be integrated into the organisation’s culture, practices, and operational plans. Managers should understand that risk management and good security practices are fundamental. An effective security plan requires a systematic and coordinated approach: identify and assess the risk environment, then develop the plan.

Security policy document

Knighthood approves, promulgates, and implements a security policy that sets out management’s approach to security and its commitment to it.

The policy must be based on a robust risk analysis, support agency operations and business continuity, and be practical and cost-effective. It should contain guidance on security roles and responsibilities, clear definitions of security processes, more detailed guidance for individual sites, systems, or services where necessary, definitions of responsibility for protectively marked material (digital or hard copy), and an ongoing user awareness and education programme.

Review and evaluation

Review the policy after significant security incidents, the introduction of new vulnerabilities, or changes to the agency’s functions, structure, or technical infrastructure.

Measure the policy’s effectiveness by the nature, number, and impact of recorded security incidents; the cost and impact of security controls; and user compliance.

Roles and responsibilities

Knighthood is responsible for all aspects of security, including its capacity to function, the safeguarding of official resources and information held on trust, and the safety of employees and clients. A security structure with clear roles and responsibilities is in place.

Chief Security Officer

Knighthood designates a senior person as the CSO, answerable to the CEO with free access to them on security matters. In most cases the role is part-time, added to an existing role.

The CSO’s responsibilities include:

• Oversight of agency protective security
• Circulating and implementing policy
• Providing guidance
• Managing and reporting security incidents
• Implementing a security awareness programme
• Liaising with security agencies

Depending on the assignment, the CSO may or may not hold operational responsibility for corporate services such as HR or finance. Depending on customer size, risk profile, and the amount of protectively marked material and equipment, Knighthood may create a specialist protective security unit or appoint specialist security personnel.

Security committees

A cross-functional Security Reference Group (SRG), or an existing Risk and Audit Committee, coordinates security controls. The committee focuses on:

• Agreement on security roles and responsibilities
• Integrating protective security into risk management
• Audit and assurance processes
• Methodologies and processes for security
• Coordinating the implementation of specific security controls
• Reviewing security incidents and recommending process improvements
• Supporting customer-wide security initiatives