Implementing an Information Security Program

Introduction

• Protect against cyber attacks
• What you should know
• Information security overview
• Cybersecurity overview
• Cyber resilience overview
• Risk management overview

1. Information Security Program Goals

• Achieve your customers’ expectations
• Cyber-attack and failure resilience
• Compliance with laws and regulations
• Support executives and the BOD

2. Information Security Program Components

• Essential functions of a program
• Determine your role
• Build a team
• The need for management
• The need for leadership

3. Structure an Information Security Program

• Sources of controls
• Organize around cyber resilience
• Design an information security program

4. Measure Information Risks

• Plan to measure information risks
• Use a data-driven cyber risk management method
• Understand the 0 to 10 scale
• Set target scores for each control
• Decide where to measure information risk
• Create a score key for experts
• Prepare to collect scores from experts
• Set up a score collection workflow
• Collect scores from your systems

5. Understand Information Risks

• The questions that drive us
• Determine resilience
• Determine the top five risks
• Understand the leadership landscape

6. Manage Information Risks

• Generate ideas to manage top risks
• Estimate costs
• Estimate benefits
• Prepare proposals

7. Demonstrate Compliance and Progress

• Communicate with executives
• Communicate with stakeholders
• Communicate with auditors

8. Use a Workflow to Organize Work

• Determine measurement frequency
• Build on baseline measurements
• Construct an annual program of work

Conclusion

• Next steps