Security Policies, Processes, & Procedures

Policies, processes, and procedures are essential for setting expectations and developing strategies for achieving security. Knighthood assists customers in selecting the level that best fits their needs.

Enhanced

As part of your continuous improvement programme for security, your people and relevant service providers actively contribute to optimising processes and procedures. You have tools in place to facilitate this.
Issues and emerging risks relating to contracting and contract management processes are analysed and mitigations strategies are put in place to improve existing and future contracts.

Managed

You have security policies, processes, and procedures in place to protect people, information, and assets.
Policies and procedures are easy to access and understood.
You review security policies at least every two years, and periodically review processes and procedures to ensure they remain appropriate.
Security management processes are embedded, consistently followed, and deliver the outcomes you expect.
Your procurement contracts include standard terms and conditions relating to security.
Your policies and procedures include aspects on working with external suppliers where relevant.
People from across your organisation contribute to designing security management policies, processes, and procedures.
You proactively scan your environment for relevant changes and emerging threats, amending security policies, processes, and procedures when appropriate.
You set and apply evidence-based performance measures for your security management processes, and performance targets are consistently met.
Your security management processes and procedures are supported by automation when that makes them more effective and efficient.
You have documented and effective procedures in place to ensure that proposed changes to processes, or new processes, are assessed for their impact on security management requirements.

Basic

You have elements of protective security policy in place, but they’re not yet sufficiently supported by documented processes and procedures.
Where security management processes do exist, they usually perform as expected. However, process discipline may be lax.
You occasionally review security policies, usually in response to an incident or prompt.
When applicable, your procurement contracts identify requirements for protecting people, information, and assets.
Levels of due diligence on the security policies and measures of external suppliers vary across your organisation.
You have a limited or inconsistent process in place for considering how new processes, or changes to existing ones, will affect security management.

Informal

You have no documented protective security management policies, processes, or procedures in place.
Undocumented processes tend to change depending on the situation at the time or who is following them; and the purpose and value of these informal processes may be unclear.
Protective security needs may be considered when business processes are developed or reviewed, but you can’t be confident this happens.
You don’t ask external suppliers for information about their security policies and measures before you share sensitive information with them.
Security is not considered in procurement decisions or factored into supply contracts for products or services.