Risk Management Roadmap for Enterprise SecurityNavigate Cybersecurity Risks with this Comprehensive Step-by-Step Risk Management RoadmapCybersecurity is a process, not a destination.Develop better risk assurance in this day of modern cybersecurity in four phases. This four-phase risk management roadmap represents a comprehensive and ongoing path to security assurance, designed to be executed over a period of years (not days or months). The value of a robust cybersecurity program is immeasurable, but the process to get there has been tried, tested, and now recorded here for you by Aerstone’s NSA-Certified cybersecurity experts for over 20 years. Phase I: ScopingThese steps by themselves represent significant security enhancements to the environment, and collectively prepare your organization to achieve an optimized level of risk assurance.R1. Appoint CISO and Designated Authorizing Official (DAO) rolesProvides a single corporate point of leadership for cybersecurity as a whole, and the risk management process specifically.MilestonesRJob descriptions writtenRStaff identified or hired to fill rolesRPeople formally appointed in writing (can be contracted)Reference: NIST 800-37R2. Familiarize yourself with the Risk Management Framework (RMF)The RMF provides an excellent approach for evaluating and managing risk.MilestonesRCISO and DAO complete read-through of NIST 800-37RWritten policy memo signed by CISO, delegating RMF management process to DAOReference: NIST 800-37R3. Do a thorough data meta-analysis to determine what kinds and quantities of data are processed and stored by the enterpriseDetermines risk associated with data loss, data corruption, or unintended data exposure. MilestonesRData types categorized and documented, including PII, PHI, etc.Reference: NIST 800-37R4. Determine legal and practical compliance requirementsDetermines the cybersecurity standards against which the organization will be assessed, taking 5-year business strategy into account.MilestonesRList of compliance requirements createdReference: VariousR5. Implement formal system authorization processAllows the appointed DAO to accept system-specific risk on behalf of the organization.MilestonesRWritten policy memo signed by DAORDepartment and project leads briefed on processReference: NIST 800-37Phase II: Planning & PreparationThese steps by themselves represent significant security enhancements to the environment, and collectively prepare your organization to achieve an optimized level of risk assurance.R6. Complete a full inventory of IT hardware Facilitates drawing security boundaries.MilestonesRInventory of all networked hardwareReference: NIST 800-37R7. Complete a full inventory of IT softwareProvides a single corporate point of leadership for cybersecurity as a whole, and the risk management process specifically.MilestonesRInventory of all software, by geographic location, including COTS, free, and shadow ITReference: CIS-18R8. Write policy documents Creates a set of documents that provide proper guidance to the organization for cybersecurity maintenance.MilestonesRControl family policy documents created for each of the control families.Reference: NIST 800-53R9. Assess and implement core enterprise security servicesEnsures that solutions for key security capabilities (e.g., event management, malware protection, vulnerability scanning, etc.) are all available.MilestonesREnterprise systems available for malware detection, vulnerability scanning, enterprise logging, etc.Reference: CIS-18R10. Group all hardware and software into authorization packages Divides the entire IT infrastructure into mission-specific bundles based on risk, and allows identification of core packages that will be inherited by other packages downstream.MilestonesRAll systems documented with package owners assignedRCategorize each package based on the impact of a loss in C-I- ARComplete system security plans (SSPs) for all packagesReference: FIPS-199Phase III: System Assessment based on RMFFollowing the Risk Management Framework (RMF), at the end of this phase your organization will gain an excellent understanding of the residual risk you’re accepting, with responsible parties identified and assigned for all critical systems.R11. Assign security controls based on package categorizationEnsures an appropriate set of security controls are chosen for each package.MilestonesRSecurity control set documented for each systemReference: NIST 800-53R12. Implement the assigned security controls for each packageEnsures an appropriate set of security controls are chosen for each package.MilestonesRSecurity control set implemented for each systemReference: NIST 800-53R13. Test the assigned security controls for each package, and document the resultsEnsures that an appropriate set of security controls are validated for each package.MilestonesRSecurity control set confirmed for each systemRTest artifacts collected and storedReference: NIST 800-53R14. Authorize each systemEnsures that the DAO signs off on residual risk.MilestonesRATO granted for each systemRPlan of Action & Milestones (POA&Ms) created for each systemReference: NIST 800-53Phase IV: Implement security enhancements based on best practicesThese steps by themselves represent significant security enhancements to the environment, and collectively prepare your organization to achieve an optimized level of risk assurance.R15. Implement continuous monitoring (conmon) mechanismSupports continuous authorization of enterprise systems.MilestonesRAutomated conmon solution online and availableRcATO process defined and communicatedRSystems transitioned to cATOReference: NIST 800-137R16. Implement workforce training as defined by policy documentsEnsures that an appropriate set of security controls are implemented for each package.MilestonesRTraining courses implementedRTraining scheduled definedReference: NIST 800-53R17. Implement a change management mechanismMitigates the risk of unanticipated impacts to confidentiality, integrity, and especially availability.MilestonesRChange management process implementedReference: NIST 800-137R18. Develop an automated risk assessment mechanismMitigates the risk of unanticipated impacts to confidentiality, integrity, and especially availability.MilestonesRRisk-based escalation process implementedReference: NIST 800-137R19. Schedule penetration tests for a subset of Internet-facing and high-impact systemsMitigates the risk of unanticipated impacts to confidentiality, integrity, and especially availability.MilestonesRPenetration testing resources identified (internal/external)RPentests conducted on critical systems on a regular cadenceReference: CIS-18R20. Revisit standards-based compliance on the required cadenceEnsures ongoing compliance with required statutes.MilestonesRTest/audit calendar developedReference: VariousFree Download: Risk Management RoadmapCybersecurity is not for the faint of heart. Use this guide to elevate, maximize, and maintain a high level of risk assurance at your organization, starting today. GET YOUR FREE DOWNLOAD HERE
