Cyber security governance

A senior leadership skill. You can: - develop an effective cyber and information security governance framework that is integrated with overall organisational governance - prioritise issues affecting the organisation’s ability to meet security policies and follow standards - lead a continuous review process to ensure governance meets changing regulations, legislation and best practices - mitigate risks caused by unavoidable exceptions to the governance framework Examples of leadership using this skill: - escalating risks to the highest level in the organisation when governance issues do not have defined owners - persuading others to use their financial resources for changes needed to comply with the framework - helping stakeholders be aware of the risks that are caused when an exception is agreed

Quoted from the UK GDaD PCF.

Levels

1. Awareness: *Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level.* You can: Examples of leadership using this skill:

develop an effective cyber and information security governance framework that is integrated with overall organisational governance
prioritise issues affecting the organisation’s ability to meet security policies and follow standards
lead a continuous review process to ensure governance meets changing regulations, legislation and best practices
mitigate risks caused by unavoidable exceptions to the governance framework
escalating risks to the highest level in the organisation when governance issues do not have defined owners
persuading others to use their financial resources for changes needed to comply with the framework
helping stakeholders be aware of the risks that are caused when an exception is agreed
2. Working: *Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level.* You can: Examples of leadership using this skill:

develop an effective cyber and information security governance framework that is integrated with overall organisational governance
prioritise issues affecting the organisation’s ability to meet security policies and follow standards
lead a continuous review process to ensure governance meets changing regulations, legislation and best practices
mitigate risks caused by unavoidable exceptions to the governance framework
escalating risks to the highest level in the organisation when governance issues do not have defined owners
persuading others to use their financial resources for changes needed to comply with the framework
helping stakeholders be aware of the risks that are caused when an exception is agreed
3. Practitioner: *Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level.* You can: Examples of leadership using this skill:

develop an effective cyber and information security governance framework that is integrated with overall organisational governance
prioritise issues affecting the organisation’s ability to meet security policies and follow standards
lead a continuous review process to ensure governance meets changing regulations, legislation and best practices
mitigate risks caused by unavoidable exceptions to the governance framework
escalating risks to the highest level in the organisation when governance issues do not have defined owners
persuading others to use their financial resources for changes needed to comply with the framework
helping stakeholders be aware of the risks that are caused when an exception is agreed
4. Expert: *Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level.* You can: Examples of leadership using this skill:

develop an effective cyber and information security governance framework that is integrated with overall organisational governance
prioritise issues affecting the organisation’s ability to meet security policies and follow standards
lead a continuous review process to ensure governance meets changing regulations, legislation and best practices
mitigate risks caused by unavoidable exceptions to the governance framework
escalating risks to the highest level in the organisation when governance issues do not have defined owners
persuading others to use their financial resources for changes needed to comply with the framework
helping stakeholders be aware of the risks that are caused when an exception is agreed

Contains public sector information from the UK Government Digital and Data Profession Capability Framework (https://understand-digital-data-roles-skills.service.gov.uk/), licensed under the Open Government Licence v3.0. © Crown copyright.

Closest ESCO skills

establish an Information Security Management System (close match)
define security policies (narrow match)
manage IT security compliances (narrow match)

Contains ESCO v1.2.1 data (https://esco.ec.europa.eu/). © European Union. Reuse authorised under Commission Decision 2011/833/EU.

Role levels that expect this skill

Role level	Role	Band	Expected level
Cyber security manager	Cyber security manager	8a	Practitioner
Senior cyber security manager	Cyber security manager	8b	Practitioner
Head of cyber security	Cyber security manager	8c	Expert
Chief information security officer	Cyber security manager	8d	Expert