Cybersecurity Compliance Decision Making

Solving a unique compliance problem is the driving reason for cybersecurity planning processes (e.g., How do I comply with NIST 800-171 R3?).

ComplianceForge created the Compliance Decision Making Process (CDMP) as a free guide to help compliance staff come up with viable Courses of Action (COA) based on:

1. Facts;
2. Assumptions; and
3. Contraints. 

5 Simple Steps To Compliance Decision Making

The CDMP is designed to be simple and efficient. It identifies sub-steps, as well as inputs and outputs associated with each step in the decision making process. The five (5) steps are:

Proactive Approach To Compliance Decision Making

Compliance with cybersecurity and date protection laws, regulations and contractual obligations requires a proactive approach to be efficient and effective. Proactive compliance can be thought of as having four (4) distinct components, which comes from the broader Military Decision Making Process (MDMP) used by the US military. The common military planning acronym associated with this is DIRT: 

1. Decisions;
2. Intent;
3. Risk; and
4. Triggers.

Getting to the point of making a sound decision is built off of multiple supporting processes. In this document, we co-op concepts from DIRT & MDMP with a cybersecurity compliance-focused Compliance Decision Making Process (CDMP). This document helps define a viable process to tackle compliance-related decision making to minimize risk and cost that your organization is exposed to with cybersecurity & data protection compliance efforts. 

Compliance Decisions

There are many compliance-related decisions that organizations face. Decisions are often “forks in the road” where there is a binary option to take one path or the other, but not both. This is where the decisions are expected to be based on compliance intent and risk analysis. Examples of decisions that impact compliance operations include:

• The organization accepts a contract to store, process and/or transmit Controlled Unclassified Information (CUI) as part of a contract with a third party (e.g., government, prime contractor, partner, etc.).
• Action is taken to restructure supporting business processes to support the broader corporate strategy.
• The organization’s CUI enclave is onsite in its own segmented environment. 

Compliance Intent

The compliance intent captures your organization’s executive leadership’s intent for compliance operations. Decisions should be formed, based on compliance intent. Compliance intent:

• Provides the basis for unity of effort throughout the organization to justify cost/changes necessary to comply.
• Is meant to support the organization’s broader mission and strategy.
• Allows stakeholders to gain insight into what is expected of them, what constraints apply, and most importantly, why the compliance operations are being conducted.

Understanding of Risk

A clear understanding of compliance intent directly influences risk analysis. Understanding the nuances of compliance-related risk can lead to better decision making and that can lead to proper technology alignment, less unexpected change, etc. Examples of understanding risk include:

• The organization must avoid business engagements with third parties that store/process/transmit CUI that are not able to obtain and maintain Level 2 Cybersecurity Maturity Model Certification (CMMC).
• While Security Protection Data (SPD) is unlikely to be designated as a CUI category by the US National Archives (NARA), the DoD is unlikely to alter its course that SPD must be protected in a manner that limits technology options.
• The majority of False Claims Act (FCA) submissions are made from insiders (often recently separated individuals), so compliance operations must have appropriate evidence of due diligence and due care to demonstrate the organization’s compliance efforts.

Compliance Triggers

Compliance operations are rarely static. Identifying triggers in the compliance landscape can refine risk management analysis and lead to proper decision making that stays inline with compliance intent. Examples of compliance triggers include:

• NIST released NIST SP 800-171 R3;
• DoD issues a class deviation to remain aligned with NIST SP 800-171 R2; and
• 32 CFR § 170.19(c)(2) designates External Service Providers (ESPs) as being considered in scope for CMMC requirements if it meets CUI Asset and/or Security Protection Asset (SPA) criteria (e.g., stores, processes and/or transmits CUI or Security Protection Data (SPD).

Risk Tolerance vs Risk Threshold vs Risk Appetite

The alternative to risk management is crisis management. The information on this page exists to provide practical risk management guidance for cybersecurity and data privacy practitioners, specifically focused on how to align risk appetite, risk tolerance and risk thresholds with an organization's strategic, operational and tactical business planning activities. What is presented is a holistic approach that has practical applications. There are a lot of terms in cybersecurity and three (3) of the top misused terms are:

1. Risk Tolerance;
2. Risk Threshold; and
3. Risk Appetite.

The concepts of risk appetite, risk tolerance and risk thresholds are not independent terms that are meant to stand by themselves, since they share a dependency that needs to be understood to create a coherent risk management strategy. Likewise, those terms are also directly linked to strategic, operational and tactical decision making. 

Organizations invest in cybersecurity and data privacy as a necessity. This necessity is driven in large part by statutory, regulatory and contractual requirements. It is also driven by the desire to protect the organization's brand from acts that would harm its public image. Regardless of the reason, the base expectation is that those charged with developing, implementing and governing the cybersecurity and data privacy functions are doing so in a reasonable manner that would withstand scrutiny that could take the form as an external auditor, regulator or prosecuting attorney. 

 

• What Is NIST CSF?

  The NIST Cybersecurity Framework (NIST CSF) is commonly used “cybersecurity best practice” for organ...

• Supply Chain Risk Management (SCRM) Plan

  Cybersecurity Supply Chain Risk Management (C-SCRM) is the process of identifying, assessing and mit...

• Efficient CMMC Scoping

  Determining the scope of controls (e.g., assessment boundary) is different than determining control...

• What Is NIST 800-171?

  NIST 800-171 focuses on protecting Controlled Unclassified Information (CUI) anywhere it is stored,...

---