Article | TREND NO. 3
Elevate your cybersecurity program: Integrating program management and governance
Aug 01, 2024 · Authored by Jim Kearney, Ayo Ogunwale
In today's ever evolving cyber landscape, it has never been more critical to build strong security safeguards. In the face of increasingly complex cyber threats, businesses need to have proactive solutions in place to protect their assets and maintain regulatory compliance requirements. This article dives into the intersection of governance and program management providing impactful methods for elevating your cybersecurity program. Embedding security by design, proof of concept validation, and continuous monitoring into your cybersecurity program improves resilience and effectiveness.
Method 1: Security by design
Value-add project example: Security by design can add value to organizations that are implementing new systems to achieve business goals.
Security by design involves incorporating security throughout the lifecycle of your systems. By integrating least privileged access concepts, such as separation of duties and privileged access management support, from the beginning, management can create a strong cybersecurity foundation in systems. To create an effective cybersecurity program, it is vital to incorporate security at every stage of system implementation activities thereby proactively defending against potential security threats.
Ensuring that security considerations are part of the initial design phases helps reduce risks after implementation. For instance, incorporating security in user stories and adopting secure pipeline agile methodologies can ensure that security is included throughout the developmental stages. This approach aligns with The National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF), which emphasizes the importance of identifying and protecting critical infrastructure.
Understanding your data and potential threats to your system allows your organization to create proactive defenses. Techniques such as whiteboarding sessions can help address security challenges before they escalate. Proactive defense approaches can be applied to regulatory compliance, data governance and incident response.
Integrating security early in the project lifecycle often results in more resilient and cost-effective measures. It prevents the need for expensive upgrades of security measures later in the system lifecycle. This approach ensures that potential vulnerabilities are addressed before they can be exploited, reducing the risk of costly security breaches.
Method 2: Proof of concept validation
Value-add project example: Proof of concept validation is an effective method when implementing emerging or new technologies (e.g., artificial intelligence) to identify or predict long-term challenges and long-term costs.
Rolling out enterprise-wide governance programs can be challenging. Implementing proof of concept (POC) validation can help test the effectiveness of new governance activities on a smaller scale before a full-scale deployment.
This process involves stress-testing the value and effectiveness of new governance activities using a variety of scenarios or use cases.
After POC, management should refine the approach based on results and feedback. This might involve updating criteria, conducting training sessions and ensuring all stakeholders are aligned with the new governance activities. This methodology aligns with best practices outlined by (ISC)2 a leader in training standards for cybersecurity professionals.
Once validated, these activities can be scaled across the enterprise, to ensure their effectiveness. Management should continue to encourage employee and/or customers feedback and refine the program as needed, keeping security in mind.
Method 3: Continuous monitoring
Value-add project example: Continuous monitoring is influential when cybersecurity program management requires impactful, real-time leadership reporting (e.g., dashboards).
Continuous monitoring is essential for modern cybersecurity practices. Adopting ongoing assurance practices can help organizations ensure that their security controls remain effective against evolving threats.
Tools like security orchestration, automation and response (SOAR) platforms help automate security governance processes making real-time monitoring and response to security incidents more efficient.
Key performance indicators (KPIs) and key risk indicators (KRIs) for security are ideal for continuous monitoring. Establishing tolerance thresholds can help organizations measure their security posture and respond proactively to any potential threat or deviation. NIST's "Guide for Applying the Risk Management Framework to Federal Information Systems" (NIST Special Publication 800-37) provides a comprehensive framework for ongoing monitoring for KPIs and KRIs.
The Project Management Institute cited in their “Pulse of the Profession” survey that approximately 28% of projects are deemed failures in relation to budget, timeline, or failure to meet goals. Improving your cybersecurity program through security by design, proof of concept validation and continuous monitoring not only enhances resilience but also builds confidence in programmatic accountability. Consider how these methods can be applied to your projects.
For more insights and detailed guidance, connect with a Baker Tilly internal audit or cybersecurity professional.
Sources
[1] The NIST Cybersecurity Framework (CSF) 2.0, National Institute of Standards and Technology, 2024
[2] (ISC)2 CISSP Common Body of Knowledge (CBK), ISC2
[3] NIST Special Publication 800-37, National Institute of Standards and Technology, 2018
[4] SEC Cybersecurity Rule, U.S. Security and Exchange Commission, 2023
[5] Security Orchestration, Automation and Response (SOAR), Gartner
[6] PMI Statistic, PMI's Pulse of the Profession, 2017
Other articles in this series
Top five cybersecurity and IT audit trends that most impact an organization’s ability to respond to today’s challenges
This article highlights the top five cybersecurity and IT audit trends that organizations are currently impacted by and the response mechanisms they can utilize to combat security threats.
How to build an effective IT audit team during a time of skilled resourcing shortages
Explore strategies to staffing and building a high-performing IT audit team, including the advantages and benefits to co-sourcing and outsourcing.
The rise of proactive assurance, and why it’s here to stay
Through proactive assurance, internal audit can add immediate and tangible value to an organization.
Vendor-risk management: Evolving a healthy vendor ecosystem
This article discusses the right of organizations to be concerned about their vendor ecosystem from a risk perspective and the external factors that drive the decision-making process for leaders in risk, legal, operations, finance and information security.
Related sections
- Financial Services
- Government Contractors
- Healthcare & Life Sciences
- Higher Education
- Not-for-Profit
- Technology
- Risk Advisory
- Asset Management
- Banking & Capital Markets
- Behavioral Health
- Community Banks
- Consumer Lending
- Credit Unions
- Dental Practices
- Hospitals & Health Systems
- Insurance
- Insurtech
- Life Sciences
- Senior Services
- Cybersecurity
- Internal Audit
- IT Audit Solutions