PSR A Risk Based Approach Presentation PDF.PDF.pdf

UNCLASSIFIED
Protective Security
Requirements
A Risk Based Approach
UNCLASSIFIED

What is the PSR?
“.…a new framework of New Zealand
Protective Security Requirements which
provides clear guidance and support for
State sector departments to achieve
improved security standards…..”

What does it look like?
Tier 1:
Tier 3:
PSR Cabinet Paper
Detailed protocols for
and Directive on the
governance, personnel
security of government
security, physical security
business
and information security
(including the NZISM).
Tier 2:
Tier 4:
Overarching security
Agencies’ own policies
policies and 29 core
and procedures
requirements

Risk based approach
Protective Security
for the Agency
The starting point for
Protective
Protective
an agency’s protective
security policy
security planning
security – their security
RISK ASSESSMENT
planning, policies and
procedures – is a risk
Protective security
assessment
procedures

How did we get here?
Deliver a more
Open source website
Out of date,
accessible framework
standards
Outreach function and
Lack of
engagement to lift security
awareness,
Update standards
capability
Lack of support for
‘Living documents’ – tools
agencies
and templates
Enhance outreach
Security is not
Training for government
seen a
agencies
business enabler
High profile
breaches
Cross-government
initiatives
Assurance reporting

A closer look at the
PSR risk based
approach….

Open source website
Open source website
Outreach function and engagement
to lift security capability
‘Living documents’ – tools and
templates
Training for government agencies
Assurance reporting
www.protectivesecurity.govt.nz

Outreach and engagement
o Support in understanding and
Open source website
implementing the PSR
Outreach function and engagement
o 36 mandatory agencies + voluntary
to lift security capability
agencies
‘Living documents’ – tools and
o Facilitators in completing the Capability
templates
Maturity Model and the PSR Roadmap
Training for government agencies
o Emphasis on effective and accountable
governance
Assurance reporting
o Collaboration across agencies

Tools and templates
CMM Element
Agency / Unit
Target
Current
Open source website
Leadership and culture


Executive commitment, governance oversight
Optimized
Basic
Management structure, roles, responsibilities
Optimized
Basic +
Outreach function and engagement
to lift security capability
Monitoring and assurance
Optimized
Core
Organisation culture and behaviour
Managed
Core
Education and communications
Optimized
Core +
‘Living documents’ – tools and
Planning, policies and protocols


templates
Strategy development, delivery
Managed
Basic
Policies, processes, procedures
Managed
Basic
Risk management
Optimized
Core +
Training for government agencies
Incident management
Optimized
Core +
Security dimensions


Personnel security
Core +
Basic
Assurance reporting
Information security
Managed +
Core +
Physical security
Optimized
Core +

Tools and templates
Open source website
Outreach function and engagement
to lift security capability
‘Living documents’ – tools and
templates
Training for government agencies
Assurance reporting

PSR Training
o Additional support for implementation
Open source website
o Introductory courses
Outreach function and engagement
to lift security capability
o Specific physical security, personnel
security and information security
‘Living documents’ – tools and
templates
courses
o Emphasis on holistic approach to
Training for government agencies
protective security
o Providing agencies with the tools and
Assurance reporting
information to take ownership

Assurance Reporting
o PSR Agency Self-Assessment Report
Open source website
o March 2016 – Creating the new baseline
o Chief Executive accountability
‘Living documents’ – tools and
templates
o Based on tools departments will be
familiar with
Outreach function and engagement
to lift security capability

- The Capability Maturity Model
Training for government agencies
           - 29 Core Requirements
           - PSR Roadmap
Assurance reporting
o Ability to seek further evidence if
necessary

What difference does
it make?

What will success look like?
o Trust and confidence: Ministers and public
o Risks can be mitigated, but not eliminated.
Minimize the likelihood, be prepared for the impact,
and react accordingly
o Governance – accountability and ownership at the
top
o Ability to adapt to changes in the threat
environment
o Strong security culture with all personnel
o All boats rising

Where to from here?

Questions?