Strategy and Planning

Strategy and planning are essential for formulating a security plan and making it a reality. Knighthood assists our customers in selecting the level that best suits their needs.

Enhanced

• Protective security considerations are fully integrated into your business strategy and planning cycles.
• Business strategies, security plans, and ongoing reviews are informed by up-to-date, evidence-based data to analyse threats, understand trends, and conduct forecasting.
• Continuous improvement work helps efficiently identify, assess, and action opportunities to enhance security planning.
• Your business continuity programme is planned and improved regularly. Exercises are conducted to ensure preparedness for disruption and embed continuity in your culture and practice.

Managed

• Your security planning should addresses the protection of people, information, and assets within your premises
• Plans demonstrate clear awareness and agreement about acceptable levels of security risk.
• Security plans are reviewed every two years to ensure relevance to risk profile and sustainability
• Executive team and relevant governance bodies regularly review tolerance for security risk and may drive out-of-cycle changes.
• Each area of your organisation is effectively represented when security plans are developed.
• Plans are flexible to accommodate changes in the wider business environment or assurance activity results.
• Security planning is well informed by access to historic data and root cause analysis to identify solutions to systemic security issues.
• Progress against security plan is tracked and reported to executive team and relevant governance bodies.
• Business continuity management programme is in place to enable critical functions to continue to the fullest extent possible during a disruption.
• Periodically test and review business continuity programme and other important risk mitigation.
• Security plan is communicated and accessible to those who need it.
• Plan is used to determine security objectives and supports broader organisational goals.
• Plan to increase security levels at a time of heightened threat.

Basic

• Protective security risks and needs are considered when developing strategies and business plans, though not well informed by analysis or recent threat and risk assessments.
• Security plan is approved at an appropriate level of seniority, though may not be up to date.
• Plan effectively mitigates some key risks.
• People responsible for security planning are appropriately skilled, but may not have all the time or support to ensure plans are robust.
• Security planning is not subject to central coordination or guidance, so improvement activity is inconsistently and/or inefficiently applied.
• Basic business continuity programme in place.
• Ad-hoc plan to increase security levels at a time of heightened threat.

Informal

• Some security risks and requirements are considered when strategies and business unit plans are developed, but not widespread or consistent.
• Organisation has some understanding of protective security issues but is doing little to address them.
• Security planning is ad-hoc. Plans are partially developed and implemented but may not be current or comprehensive.
• Tolerance levels for protective security are not specified.
• No documented business continuity programme in place.
• No plan to increase security levels at a time of heightened threat.