What to do at this stage
- 01
Connect each major protection objective to a risk identified in the preliminary assessment.
- 02
Describe how the proposed layers work together, including detection and response.
- 03
Compare indicative cost and operational implications before seeking the strategy decision.
Questions to work through
- Why is each protection layer needed?
- Will the concept work with the intended operation?
- Which assumptions underpin the business case?
A public facility might combine welcoming public areas with controlled staff zones and a response process, rather than placing the same controls at every doorway.
A common trap
A list of security products does not by itself explain how the protection concept will work.
Suggested resources
Selected for their likely use at this stage. Resource associations are guidance, not a compliance crosswalk.
Five Cybersecurity Strategies for Boards and Executives
A short guide for boards and executives on cyber risk priorities and organisational resilience.
View in the SRMBOK shopSRMBOK Guide to Secure ICT Enclaves — free A3 poster
A free A3 poster explaining four security environments, device access and information-release gates. A conceptual reference for discussions and design, with colour and monochrome editions.
View in the SRMBOK shopGuide to Physical Security Specifications
A guide to consistent physical security specifications, covering threat postures, access, barriers, locks, alarms and secure containers across multiple sites.
View in the SRMBOK shopSRMBOK Security Plan Templates
Adapt three editable security and risk treatment plans, with worked examples for enterprise and operational planning.
View in the SRMBOK shopSRMBOK Template 13.7 Property Selection and Security Planning Checklist
An editable property selection checklist covering the site, building, access, security systems and emergency provisions.
View in the SRMBOK shopSRMBOK Business Case Template
Prepare a business case for security measures, setting out the problem, proposed response and required resources.
View in the SRMBOK shopSRMBOK Guide to Governance
Guidance on integrating security risk management into governance, accountability and organisational decision-making.
View in the SRMBOK shopSRMBOK Guide to DISP
An independent planning guide for the Australian Defence Industry Security Program (DISP), covering governance, personnel, premises, ICT architecture and acceptance tests. Not an official approval or application pack.
View in the SRMBOK shopKeep the whole life cycle in view
Security Risk Management Life Cycle Wall Charts
Keep the whole life cycle in view, from initiation to change and disposal.
View in the SRMBOK shopGuide to the Security Risk Management Life Cycle
The full 16-stage SRMBOK life cycle guide, with decision gates, return paths, checklists, worked examples and a diagnostic worksheet.
View in the SRMBOK shopThese practical prompts are editorial guidance for the navigator. Consult the published SRMBOK life cycle guide and charts for the full method. About this edition and its sources.