Protective Security Governance Requirements

The Protective Security Requirements (PSR) set out the government’s mandatory requirements and management requirements related to security governance.

Mandatory requirements

There are 10 mandatory requirements relating to security governance that agencies must follow.

They include:

1. establishing a structure for governing security within their agency
2. appointing a member of senior management as the Chief Security Officer (CSO)
3. adopting a risk management approach
4. developing a set of protective security policies, plans and protocols to meet their specific business needs
5. having an annual review and assurance system in place
6. providing staff, including contractors, with information and security awareness training
7. establishing procedures for reporting and investigating security incidents and taking corrective action
8. ensuring contracted providers comply with the PSR and any agency-specific protective security protocols
9. adhering to any security provisions in relevant multilateral or bilateral agreements
10. establishing a Business Continuity Management (BCM) programme.

Management requirements

The PSR provides further information for agencies on topics such as developing agency protective security policies, plans and procedures and security awareness training.

For more information, refer to the management requirements for security governance.