ISC2 Information Systems Security Management

Leadership acts through documents that people actually follow. You write and maintain policy tiers, and draft or review the agreements that bind employees, suppliers and partners, from acceptable use to service levels and confidentiality terms.

• Policy architecture and who approves what
• Writing policy that people read and apply
• Exceptions, waivers and policy lifecycle
• Employment, acceptable use and confidentiality agreements
• Service level agreements and operational level agreements
• Memoranda of understanding and interconnection agreements
• Measuring policy compliance

You build A policy set and agreement templates for a company bringing on a managed service provider.

A program lives on its people and its funding. You build a team structure, hire and retain, set a budget the business will support, report with metrics that tell a story, and influence executives who do not think in security terms.

• Organizing the security team and its skills
• Hiring, developing and retaining people
• Building and defending a security budget
• Metrics and reporting for executives
• Influence without authority
• Managing change and resistance

You build A budget proposal and an executive dashboard for a security program, with the case for each line.

Security added late costs more and works less well. You embed security in project management, in the lifecycle of the systems the organization builds and buys, and in change processes, from business case to retirement.

• Security in project and portfolio management
• Requirements and risk reviews at project gates
• Systems development and acquisition lifecycle
• Change management and release approval
• Mergers, acquisitions and divestitures
• Decommissioning and data disposition

You build A security gate model for the project portfolio, with required evidence at each gate.

Leaders decide how much risk the organization accepts. You set risk appetite, run assessments across business units, keep a risk register that executives use, and choose among treatments with a business case, not a technical argument.

• Risk appetite, tolerance and capacity
• Enterprise risk assessment across business units
• Quantitative and qualitative methods for leaders
• Risk registers, ownership and escalation
• Risk treatment decisions and business cases
• Risk reporting to executives and the board

You build An enterprise risk register and a board-level risk report with treatment recommendations.

Much of the organization’s risk now sits with its suppliers. You tier vendors by exposure, assess them before and after contract, write security terms into agreements, and plan for the failure or compromise of a critical provider.

• Tiering suppliers by criticality and data access
• Pre-contract due diligence and questionnaires
• Security terms, audit rights and exit clauses
• Continuous monitoring of third parties
• Software and hardware supply chain risk
• Concentration risk and contingency for supplier failure

You build A third-party risk program with tiers, assessment steps and standard contract clauses.

Leaders do not run the console, but they decide what it watches. You govern monitoring, vulnerability management and threat intelligence, choose between in-house and outsourced operations, and measure whether operations reduce risk.

• Operating model: in-house, hybrid and managed
• Governing monitoring and detection coverage
• Vulnerability management as a program
• Threat intelligence requirements and consumption
• Service levels and metrics for operations
• Operational maturity and improvement

You build A security operations service model with coverage targets, metrics and a sourcing decision.

In a crisis, the leader’s work is decisions, not keystrokes. You build the incident management program, set escalation and authority, coordinate legal, communications and executives, and run the review that changes the program afterward.

• Incident management program and playbooks
• Severity, escalation and decision authority
• Working with legal counsel and law enforcement
• Crisis communication to staff, customers and regulators
• Managing evidence and preserving privilege
• Post-incident review and program change

You build An incident management program with severity levels, decision authority and a communications plan.

Resilience is planned long before it is needed. You run a business impact analysis, set recovery objectives with the business, build continuity and recovery plans, and exercise them until the gaps appear.

• Business impact analysis and recovery objectives
• Business continuity strategy and plan structure
• Disaster recovery strategies and sites
• Crisis management teams and decision-making
• Exercises: tabletop, walkthrough, full interruption
• Maintaining plans as the business changes

You build A continuity and recovery plan for one critical business process, with an exercise scenario and findings.

Leaders carry legal and ethical exposure that practitioners do not. You work through the laws that govern security and privacy, run investigations and handle evidence, build a compliance program, and hold to ethical standards under pressure.

• Legal frameworks for security, privacy and breach notification
• Liability, due care and the duties of leadership
• Investigations, digital evidence and admissibility
• Building and auditing a compliance program
• Working with auditors and regulators
• Professional ethics and conflicts of interest
• International operations and conflicting laws

You build A compliance program plan with a legal obligations map and an investigation protocol.

Bring leadership, risk, operations, resilience and law into one plan. You assess a sample organization, set priorities, cost and staff the work, and present a program that executives can fund and defend.

• Assessing the current program
• Setting priorities and sequencing the work
• Costing and staffing the plan
• Defining measures of progress
• Handling objections from executives
• Presenting to a board

You build A board-ready security program plan with priorities, costs, staffing and measures.