This objective, and the other similar ‘Approach For‘ objectives, simply state what has to be in your Agreed Ways Of Working for the Product Delivery Organisation. You may want to include more, but you cannot be missing any of these and still run a secure Product Delivery Organisation.

Security incidents, whether leading to customer data breaches or not, impact the whole Organisation’s risk management and likely must be reported to your national regulator for information rights. As the person who manages Organisation risk within the scope of the Product Delivery Organisation, the Head Of Product Delivery Organisation is accountable for security incidents being recorded.