scope:

This document details the enterprise architecture and the framework of policies, processes and controls necessary to mitigate and manage security risks across the protective security range, including: a) Security governance b) Personnel security c) Information security d) Cyber security and e) Physical security. The guidelines contained in this standard do not provide detailed procedures at the technical or operational level. Where standards are not available at this level, organizations should formulate and implement procedures based on the high level guidance contained in this document and in accordance with better international and national practice.