| 0 Non-existent | The organisation does not recognise the
need for IT security. Responsibilities and
accountabilities are not assigned for ensuring security.
Measures supporting the management of IT security are
not implemented. There is no IT security reporting and
no response process to IT security breaches. There is a
complete lack of a recognisable system security
administration process.
|
| 1 (Initial/Ad Hoc) | The organisation recognises the need for
IT security, but security awareness depends on the
individual. IT security is addressed on a reactive basis
and not measured. IT security breaches invoke “finger
pointing” responses if detected, because responsibilities
are unclear. Responses to IT security breaches are
unpredictable.
|
| 2 (Repeatable but Intuitive) | RResponsibilities and
accountabilities for IT security are assigned to an IT
security co-ordinator with no management authority.
Security awareness is fragmented and limited. IT
security information is generated, but is not analysed.
Security solutions tend to respond reactively to IT
security incidents and by adopting third-party offerings,
without addressing the specific needs of the organisation.
Security policies are being developed, but inadequate
skills and tools are still being used. IT security reporting
is incomplete, misleading or not pertinent.
|
| 3 (Defined Process) | Security awareness exists and is
promoted by management. Security awareness briefings
have been standardised and formalised. IT security
procedures are defined and fit into a structure for security
policies and procedures. Responsibilities for IT security
are assigned, but not consistently enforced. An IT
security plan exists, driving risk analysis and security
solutions. IT security reporting is IT focused, rather than
business focused. Ad hoc intrusion testing is performed.
|
| 4 (Managed and Measurable) | Responsibilities for IT
security are clearly assigned, managed and enforced. IT
security risk and impact analysis is consistently
performed. Security policies and practices are completed
with specific security baselines. Security awareness
briefings have become mandatory. User identification,
authentication and authorisation are being standardised.
Security certification of staff is being established.
Intrusion testing is a standard and formalised process
leading to improvements. Cost/benefit analysis,
supporting the implementation of security measures, is
increasingly being utilised. IT security processes are coordinated
with the overall organisation security function.
IT security reporting is linked to business objectives.
|
| 5 Optimized | IT security is a joint responsibility of
business and IT management and is integrated with
corporate security business objectives. IT security
requirements are clearly defined, optimised and included
in a verified security plan. Security functions are
integrated with applications at the design stage and end
users are increasingly accountable for managing security.
IT security reporting provides early warning of changing
and emerging risk, using automated active monitoring
approaches for critical systems. Incidents are promptly
addressed with formalised incident response procedures
supported by automated tools. Periodic security
assessments evaluate the effectiveness of implementation
of the security plan. Information on new threats and
vulnerabilities is systematically collected and analysed,
and adequate mitigating controls are promptly
communicated and implemented. Intrusion testing, root
cause analysis of security incidents and pro-active
identification of risk is the basis for continuous
improvements. Security processes and technologies are
integrated organisation wide.
|
![[To top of Page]](../../../images/up.gif){kind=small}
