Unit of competency
Modification History
Release 1 |
This version first released with CPP Property Services Training Package Release 9.0. Supersedes and is equivalent to CPPSEC5004A Prepare security risk management plan. Updated to meet the Standards for Training Packages. |
Application
This unit specifies the skills and knowledge required to develop comprehensive security risk management plans based on the principles of ISO 31000:2018 Risk management – Guidelines (ISO 31000). It includes identifying and evaluating security risks and existing control measures, developing action plans to identify and manage risks, designing risk treatment options and testing them in the field as part of a security risk management strategy.
This unit is suitable for those using a broad range of cognitive, technical and communication skills to select and apply methods and technologies to analyse information and provide solutions to sometimes complex problems.
Legislative, regulatory or certification requirements apply in some states and territories to the provision of advice on security solutions, strategies, protocols and procedures. For further information, check with the relevant regulatory authority.
Pre-requisite Unit
None.
Unit Sector
Security/Risk management
Elements and Performance Criteria
Elements describe the essential outcomes. |
Performance criteria describe what needs to be done to demonstrate achievement of the element. |
||
1 |
Evaluate security risks and controls. |
1.1 |
Access and interpret key requirements of legislation, regulations and Australian standard ISO 31000 to understand and comply with requirements for developing security risk management plans. |
1.2 |
Clarify client security requirements and operating environment in consultation with relevant persons. |
||
1.3 |
Source and review information to identify security risks. |
||
1.4 |
Clearly distinguish and confirm acceptable and unacceptable security risks. |
||
1.5 |
Set priorities for risk treatment and assurance of controls. |
||
1.6 |
Highlight and specify risks that are high priority to ensure appropriate controls are developed. |
||
1.7 |
Evaluate existing controls to determine impact on risk occurrence and implement required modifications. |
||
2 |
Plan risk management strategies. |
2.1 |
Develop and document action plans that identify tasks, activities and resources required to achieve security risk management objectives. |
2.2 |
Select security risk control measures based on assessed type, nature, cause and degree of risk associated with identified security risks. |
||
2.3 |
Incorporate actions to respond to contingencies when planning risk management strategies. |
||
2.4 |
Establish communication and reporting arrangements to maintain currency of action plans in consultation with relevant persons. |
||
3 |
Design security risk treatment options. |
3.1 |
Assess client’s operating environment to confirm potential and real security risks. |
3.2 |
Select feasible risk treatment options and conduct research to confirm implications for controlling whole or part of security risks. |
||
3.3 |
Document and cost recommended risk treatment options to ensure compatibility with nature of risk and client requirements. |
||
3.4 |
Consult with relevant persons to verify suitability of recommended risk treatment options and obtain required approvals. |
||
3.5 |
Test risk treatment options in the field and analyse results to verify effectiveness of treatments in the security context. |
||
4 |
Finalise and present security risk management plan. |
4.1 |
Finalise and document comprehensive security risk management plan in the required format according to workplace requirements. |
4.2 |
Check security risk management plan to ensure analysis and recommendations are clear, coherent and consistent with client requirements, and based on the principles of ISO 31000. |
||
4.3 |
Present risk management plan to relevant persons within agreed timeframes and explain identified security risks and treatments to enhance understanding and acceptance of recommendations. |
||
4.4 |
Implement procedures to monitor and review security risk management activities to ensure continuous improvement. |
||
4.5 |
Complete and secure risk management plan in a manner that facilitates future retrieval and maintains client confidentiality according to workplace and regulatory requirements. |
Foundation Skills
As well as the foundation skills explicit in the performance criteria of this unit, candidates require:
- oral communication skills to negotiate client agreement
- writing skills to prepare succinct and logically structured security risk management plans
- numeracy skills to apply statistical methods and present statistical data.
Unit Mapping Information
Supersedes and equivalent to CPPSEC5004A Prepare security risk management plan.
Links
Companion volumes to this training package are available at the VETNet website - https://vetnet.gov.au/Pages/TrainingDocs.aspx?q=6f3f9672-30e8-4835-b348-205dfcf13d9b