Security and Resilience — Protective Security — Guidelines for an Enterprise Protective Security Architecture and Framework (Draft for Comments)

Applicable to any organization, this document provides guidance for establishing an enterprise protective security architecture and framework covering security governance, personnel security, information security, cybersecurity, and physical security. Organizations should define security responsibilities, policies, processes, and controls based on risk management; conduct personnel suitability and ongoing assessments, information classification and access control, network system authorization and monitoring, and physical protection of assets and facilities; and integrate security requirements into facility planning, emergency procedures, and decommissioning management. Organizations should establish maturity models and continual improvement mechanisms to enhance cross-domain risk prevention and control and protection of critical assets.