Publishing and copyright information

The BSI copyright notice displayed in this document indicates when the document was last issued.

The following BSI references relate to the work on this document:
Committee reference SSM/1
Draft for comment 14/30285865 DC

Publication history

First published, June 2015

Foreword

Publishing information

This British Standard is published by BSI Standards Limited, under licence from The British Standards Institution, and came into effect on 30 June 2015. It was prepared by Technical Committee SSM/1, Societal security management. A list of organizations represented on this committee can be obtained on request to its secretary.

Use of this document

As a guide, this British Standard takes the form of guidance and recommendations. It should not be quoted as if it were a specification or a code of practice and claims of compliance cannot be made to it.

Presentational conventions

The guidance in this standard is presented in roman (i.e. upright) type. Any recommendations are expressed in sentences in which the principal auxiliary verb is “should”.

Commentary, explanation and general informative material is presented in smaller italic type, and does not constitute a normative element.

Contractual and legal considerations

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

Introduction

Security management is a vitally important strategic capability for a modern organization that supports the achievement of the organization’s objectives by protecting the organization’s reputation and financial well-being. Indeed, beyond simply reacting to threats and risks, effective security management proactively supports both the capture and exploitation of opportunity and competitive or service delivery advantage.

As a management discipline, security management is best delivered when it follows a lifecycle process as shown in Figure 1.

The application of the processes in Figure 1 to the various security domains might not all reside in any one area of the organization. Indeed, there are many different ways in which responsibilities can be split across a larger organization. Increasingly, good practice in security management acknowledges the need for close alignment between related security disciplines and, indeed, with other disciplines that rely upon, or are relied upon by, security, such as governance, resilience, risk management, business continuity and disaster recovery, asset management and crisis management. To achieve this, especially where convergence of these disciplines is not adopted as a corporate objective, a common understanding of the challenges in achieving security management is needed to ensure that all efforts are complementary.

Successful security is not done “to” the organization “by” a security function. It needs to be embedded in the organization’s strategy and processes, such that security is done “by” the organization, which is supported by the security function. Everyone has a role to play in ensuring effective security within the organization.

Security management is one of the major responses to the risks identified by the organization. By definition, therefore, as every organization’s risk appetite varies, it follows that the security management undertaken by the organization is bespoke. Security management does not necessarily involve either significant technology adoption and/or significant capital or revenue expenditure.

1 Scope

This British Standard gives guidance on security management for any organization, whether large or small, public or private, to support its viability, productivity, reputation, sustainability and, ultimately, success. The standard clarifies the basic principles of security management and demonstrates how security can be embedded in an organization.

An organization might already have implemented security solutions that have addressed some or all of its requirements, and this standard can be used to assist in the monitoring and review of the organization’s security management and to determine how it might be improved.

2 Terms and definitions

3 Understanding the organization’s context

3.1 General

3.2 External context

3.3 Internal context

3.4 Deriving requirements for security management

4 Developing the security framework

4.1 General

4.2 Commitment to security management

4.3 Communication and awareness

4.4 Organization structure and roles and responsibilities

4.5 Security advice

5 Security risk assessment

5.1 General

5.2 Asset identification

5.3 Security threat and risk analysis

5.4 Risk register

6 Implementing security solutions

6.1 General

6.2 Avoidance

6.3 Transfer/sharing

6.4 Elimination

6.5 Mitigation

6.6 Tolerance/acceptance

7 Implementing the security programme

7.1 Programme management and accountability

7.2 Security policies

7.3 Security programme

8 Security solutions

8.1 General

8.2 Physical security

8.3 Technical security

8.4 Manned security

8.5 Information security

8.6 Procedural security

8.7 Asset management

8.8 Personnel security

8.9 Security in procurement

9 Monitoring the security programme and solutions

9.1 General

9.2 Security monitoring and reporting

9.3 Regular reassessment of risks

9.4 Reviewing the security framework

9.5 Exercising and testing

9.6 Auditing

9.7 Management consideration of monitoring and review results

Bibliography

BS 16000:2015

Security management. Strategic and operational guidelines

Current

Published:

30 Jun 2015