SECURITY MANAGEMENT Produce security risk assessments

Transcription

1 1 of 6 level: 6 credit: 20 planned review date: March 2007 sub-field: purpose: Security This unit standard is for people who work, or intend to work, as security managers or security consultants, and who need to produce security risk assessments. People credited with unit standard are able to: - establish the context for the security risk assessment; - identify security risks; - analyse security risks; - evaluate security risks; - document and present security risk assessment. entry information: accreditation option: moderation option: Open. Evaluation of documentation and visit by NZQA, industry and teaching professional in the same field from another provider. A centrally established and directed national moderation system has been set up by the ElectroTechnology Industry Training Organisation. special notes: 1 This unit standard is based on the principles and processes identified in AS/NZS 4360:1999, Risk Management, applied in the context of security risks. 2 Legislation relevant to this unit standard includes: Building Act 1991; Companies Act 1991; Employment Relations Act 2000; Fire Service Act 1975; Health and Safety in Employment Act 1992; Privacy Act 1993; Private Investigators and Security Guards Act 1974; Resource Management Act For assessment in countries other than New Zealand, the equivalent legislation in force in that country may be used.

2 2 of 6 3 Definitions Analysis - the systematic examination and organisation of information. Assessment - the analysis and evaluation of data to establish facts, value, and credibility. Client - the person(s), or entity who contracts the task. Evaluation - the examination and comparison of information against accepted or required standards and/or other criteria to determine its value and relevance. Organisation - a company, firm, enterprise or association, or other legal entity or part thereof, whether incorporated or not, public or private, that has its own function(s) and administration. Procedure - a way of acting or progressing, especially an established method. Risk - the chance of something happening that will have an impact upon objectives, measured in terms of consequences and likelihood. Risk assessment - the overall process of risk analysis and risk evaluation. Risk evaluation - the process used to determine risk management priorities by comparing the level of risk against predetermined standards, target risk levels, or other criteria. Risk management - the systematic application of policy, practice and procedure to the task of identifying, analysing, assessing, treating and monitoring risk. Security - the protection of people, activities, and assets including information, from loss, damage, or harm. Security consultant - a person providing independent professional security advice. Security investigation - a planned and directed process used to establish facts relevant to security. Security manager - a person appointed to manage security in an organisation. Security measures - strategies, systems and resources used to ensure security. 4 evidence of two fully documented risk assessments is required.

3 3 of 6 Elements and Performance Criteria element 1 Establish the context for the security risk assessment. 1.1 The strategic environment in which the organisation operates and key stakeholders are identified. 1.2 The organisational capabilities, goals and objectives, and strategies to achieve them are identified. 1.3 The scope and boundaries for the project are identified. scope and boundaries - project objectives, time, resources, special studies, extent and comprehensiveness, relationship to other projects. 1.4 The criteria against which the security risks are to be evaluated are specified. 1.5 A logical framework to facilitate subsequent identification and analysis of security risks is defined. 1.6 Key contacts in the organisation for the purpose of the project are identified. element 2 Identify security risks. 2.1 Identification includes a comprehensive list of events and potential threats relevant to the risk assessment. 2.2 Identification includes possible causes and scenarios for each of the identified events. 2.3 Identification demonstrates use of relevant tools and techniques.

4 4 of 6 typical tools and techniques - checklists, records of past events, flow charts, system analysis, scenario analysis, interviews, consultation, past surveys and assessments, security investigations. element 3 Analyse security risks. 3.1 Analysis identifies and evaluates existing security measures. examples of measures - management, technical systems, procedures. 3.2 Analysis establishes the likelihood of occurrence, and the consequences of each event in the context of the identified measures. 3.3 Analysis combines consequences and likelihood to produce a level of risk. analysis may involve calculations and statistical analysis, and/or subjective estimates reflecting the belief that particular events or outcomes may occur. 3.4 Analysis includes consideration of the effect of changes in assumptions and data. element 4 Evaluate security risks. 4.1 Evaluation prioritises the risks in accordance with pre-established evaluation criteria, and where appropriate, identifies low risk categories requiring no further treatment. element 5 Document and present security risk assessment.

5 5 of Documentation and presentation are appropriate to the nature of the project and meet client expectations. documentation and presentation - evidence of care in presentation; substance, credibility, and clarity are not compromised by deficient spelling, punctuation or grammar; the meaning of technical terms is clear to recipients or is explained; client expectations may include - timeliness, content, clarity, conciseness, complexity, level, medium. 5.2 Content meets professional standards. standards include - content is structured in a logical and coherent sequence; there are no substantive omissions or errors of fact; assumptions, comment, inferences, conclusions and recommendations are distinguished from fact; conclusions and recommendations are unbiased; conclusions and recommendations are consistent with the brief or objectives, facts, analysis, and evaluation; relevant legal and regulatory requirements are satisfied. 5.3 Measures to ensure the security of the documentation and presentation are consistent with their content and client needs. Comments on this unit standard Please contact the ElectroTechnology Industry Training Organisation marilynb@etito.co.nz if you wish to suggest changes to the content of this unit standard. Please Note Providers must be accredited by the Qualifications Authority or a delegated interinstitutional body before they can register credits from assessment against unit standards or deliver courses of study leading to that assessment. Industry Training Organisations must be accredited by the Qualifications Authority before they can register credits from assessment against unit standards. Accredited providers and Industry Training Organisations assessing against unit standards must engage with the moderation system that applies to those standards.

6 6 of 6 Accreditation requirements and an outline of the moderation system that applies to this standard are outlined in the Accreditation and Moderation Action Plan (AMAP). The AMAP also includes useful information about special requirements for providers wishing to develop education and training programmes, such as minimum qualifications for tutors and assessors, and special resource requirements. This unit standard is covered by AMAP 0003 which can be accessed at