⚖️ Regulations, Standards, and Legislation
- SOX (Sarbanes-Oxley): Enforces financial record-keeping and reporting requirements for public companies to prevent fraud. Learn more about SOX compliance on SEC's Sarbanes-Oxley page.
- HIPAA (Health Insurance Portability and Accountability Act): Protects the privacy and security of healthcare data, including Protected Health Information (PHI). Learn more about HIPAA on HHS.gov.
- GDPR (General Data Protection Regulation): Regulates data privacy and grants individuals rights over their personal data in the European Union. Learn more about GDPR on GDPR Info.
- GLBA (Gramm-Leach-Bliley Act): Requires financial institutions to protect personal financial information and disclose their data-sharing practices. Learn more about GLBA on FTC's GLBA page.
- Due Care: Acting responsibly and taking reasonable steps to protect assets and data, similar to what a prudent person would do in similar circumstances. Learn more about due care in cybersecurity on ISACA.
- Due Diligence: The ongoing process of maintaining and verifying controls to ensure compliance and security. This includes regular audits, risk assessments, and monitoring. Learn more about due diligence on CSO Online.
🌐 ISO & Cloud Frameworks
- ISO 27001: Specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). Learn more about ISO 27001 on ISO's official page.
- ISO 27701: Extends ISO 27001 to include privacy-specific requirements, helping organizations manage Personally Identifiable Information (PII). Learn more about ISO 27701 on ISO's official page.
- ISO 27017: Provides guidelines for information security controls specifically for cloud services. Learn more about ISO 27017 on ISO's official page.
- CSA CCM (Cloud Controls Matrix): A cybersecurity control framework for cloud computing, developed by the Cloud Security Alliance (CSA). Learn more about CSA CCM on CSA's official page.
- SOC 2/SOC 3: Attestation reports that evaluate a service provider's controls related to security, availability, processing integrity, confidentiality, and privacy. Learn more about SOC 2 and SOC 3 on AICPA's official page.
🏛 Governance Roles and Structures
- Board of Directors: Ensures enterprise risk strategy and oversight.
- CISO: Leads security strategy implementation.
- IAO (Information Assurance Officer): Maintains integrity of security programs.
- IAM (Identity & Access Management): Manages user access controls.
- Steering Committees: Align departments and strategy on security posture.
📜 Governance Documents
-
Policies: High-level rules that define acceptable
behavior and organizational expectations. Examples include:
- Acceptable Use Policy (AUP): Defines how employees can use company resources. Learn more about AUPs on SANS Institute.
- BYOD (Bring Your Own Device): Outlines security requirements for personal devices used for work. Learn more about BYOD policies on CSO Online.
-
Standards: Specific mandatory rules for
configurations and implementations. For example:
- Password Standards: Define password complexity, expiration, and reuse policies. Learn more about password standards on NIST SP 800-63B.
- Encryption Standards: Specify algorithms and key lengths for securing data. Learn more about encryption standards on NIST FIPS 197.
- Guidelines: Recommended best practices to achieve security objectives. For example:
-
Procedures: Step-by-step instructions for
consistent task execution. Examples include:
- Backup Procedures: Define how and when data backups are performed.
- Patch Management Procedures: Outline the process for applying software updates.
-
Plans: Frameworks for handling specific
scenarios, such as:
- IRP (Incident Response Plan): Details how to detect, respond to, and recover from security incidents. Learn more about IRPs on CISA.
- DRP (Disaster Recovery Plan): Focuses on restoring IT systems after a disaster. Learn more about DRPs on IBM.
- BCP (Business Continuity Plan): Ensures critical business functions continue during disruptions. Learn more about BCPs on Ready.gov.
🔁 Change Management
Control and review of system and process modifications:
- Normal changes: Planned updates, requiring approval.
- Standard changes: Low risk, preapproved (e.g., password resets).
- Emergency changes: For immediate threats, retroactively documented.
⚙️ Configuration Management
- Baseline Configuration: Secure starting point for systems.
- Asset Inventory: Track what systems are in place and how they're configured.
- Version Control: Documented change tracking and rollback capability.
- KPIs: Indicators like rollback frequency, emergency change count.
🤖 Automation & Orchestration
- Scripting: Reduces manual steps and repeatability errors.
- CI/CD Integration: Security checkpoints in development pipelines.
- Vulnerability Management: Auto-assigning tickets and triggering scans.
- SOAR (Security Orchestration, Automation, and Response): Coordinates toolchains for alert triage and response.