"Industry Best Practices" For Cybersecurity & Privacy Documentation

Cybersecurity & Privacy Documentation - Editable, Scalable & Affordable

While policies and standards are designed to describe WHY something is required and WHAT needs to be done, many companies fail to create documentation to address HOW the policies and standards are actually implemented. When you "peel back the onion" and want to build an audit-ready cybersecurity and privacy program, there is a need to address "the how" for certain topics, such as vulnerability management, risk management, vendor management and incident response. We did the heavy lifting and created several program-level documents to address this need!

Written Information Security Documentation Starts with Policies & Standards Based on Industry-Recognized Best Practices

A single negligent breach can close your business forever, because your liability insurance may not cover professional negligence if you are unable to provide evidence that you took reasonable steps to prevent a breach or other cybersecurity-related incident. Without the ability to prove steps were taken to ensure due care and due diligence were applied to your business operations, you may be considered negligent in a lawsuit and be fully exposed to fines, penalties and damages.

This is where ComplianceForge can help, since we have the information security solutions that your company needs to be able to prove evidence of due care and due diligence with industry-accepted best practices for IT security. From IT security policies, to risk assessments, to vendor management solutions, we can help you keep your company secure! Documentation serves as the foundational building blocks for your cybersecurity and privacy program. Without properly-scoped policies to address your applicable statutory, regulatory and contractual obligations, your associated standards and procedures will likely be inadequate to meet your compliance needs. The requires a holistic approach to right-sizing your cybersecurity program to meet your organization's specific compliance and security requirements.

Concept of Operations (CONOPS) Provides Program-Level Guidance

A Concept of Operations (CONOPS) is a user-oriented guidance document that describes the mission, operational objectives and overall expectations from an integrated systems point of view, without being overly technical or formal. A CONOPS is meant to:

• Benefit stakeholders by establishing a baseline “operational concept” to establish a conceptual, clearly-understood view for everyone involved in the scope of operations described by the CONOPS.
• Record design constraints, the rationale for those constraints and to indicate the range of acceptable solution strategies to accomplish the mission and any stated objectives.
• Contain a conceptual view that illustrates the top-level functionality in the proposed process or system.

Several ComplianceForge documents are essentially CONOPS documents, where CONOPS are more conceptual than procedures and are focused on providing program-level guidance. A CONOPS straddles the territory between an organization's centrally-managed policies/standards and its decentralized, stakeholder-executed procedures, where CONOPS serves as expert-level guidance that is meant to run a specific function. Examples of where a CONOPS is useful for providing program-level guidance:

• Risk management (e.g., Risk Management Program (RMP))
• Vulnerability management (e.g., Vulnerability & Patch Management Program (VPMP))
• Incident response (e.g., Integrated Incident Response Program (IIRP))
• Business Continuity / Disaster Recovery (e.g., Continuity of Operations Plan (COOP))
• Secure Engineering (e.g., Security & Privacy By Design (SPBD))
• Pre-production testing (e.g., Information Assurance Program (IAP))
• Supply Chain Risk Management (SCRM) (e.g., Cybersecurity Supply Chain Risk Management Program Strategy & Implementation Plan (C-SCRM SIP))

Your organization’s Subject Matter Experts (SMEs) are expected to use a CONOPS as a tool to communicate user needs and system characteristics to developers, integrators, sponsors, funding decision makers and other stakeholders.

Which Product Is Right For You?

Our documentation is meant to address your requirements from strategic concepts all the way down to day-to-day deliverables you need to demonstrate compliance with common statutory, regulatory and contractual obligations.

Give us a call or send us an email - we are happy to help you find the right solution for your needs!

Procedures Operationalize Policies & Standards - This Is A Key Concept To Being Both Secure & Compliant

We leverage the Operationalizing Cybersecurity Planning Model in creating a practical view towards implementing cybersecurity requirements. Organizations are often not at a loss for a set of policies, but executing those requirements often fall short due to several reasons. Standardized Operating Procedures (SOPs) are where the rubber meets the road for Individual Contributors (ICs), since these key players need to know (1) how they fit into day-to-day operations, (2) what their priorities are and (3) what is expected from them in their duties. When looking at it from an auditability perspective, the evidence of due diligence and due care should match what the organization's cybersecurity business plan is attempting to achieve.

The central focus of any procedures should be a Capability Maturity Model (CMM) target that provides quantifiable expectations for People, Processes and Technologies (PPT), since this helps prevent a “moving target” by establishing an attainable expectation for “what right looks like” in terms of PPT. Generally, cybersecurity business plans take a phased, multi-year approach to meet these CMM-based cybersecurity objectives. Those objectives, in conjunction with the business plan, demonstrate evidence of due diligence on behalf of the CISO and his/her leadership team. The objectives prioritize the organization’s service catalog through influencing procedures at the IC-level for how PPT are implemented at the tactical level. SOPs not only direct the workflow of staff personnel, but the output from those procedures provides evidence of due care.

The diagram below helps show the critical nature of documented cybersecurity procedures in keeping an organization both secure and compliant:

Policies, Standards, Function-Specific Guidance & Procedures - How Our Products Support Each Other

The following diagram helps demonstrate the layered nature of cybersecurity documentation. Policies & standards set the stage for teams/departments to create and implement programs that are function-specific.

For example:

• A policy on risk will define management's intent to manage risk (RA section of NIST 800-53);
• One of the standards supporting the risk policy might require an annual risk assessment (RA-3);
• Products such as the Risk Management Program (RMP) provide the middle-ground between the policy/standard and the actual deliverable risk assessment to provide risk-specific guidance on concepts such as acceptable risk, the methodology of risk management the organization aligns to, who within the organization can sign off on various levels of risk, etc. 

If you would like to know more about how this works, please contact us and we'd be happy to further explain how our documentation links together to create comprehensive, linked cybersecurity and privacy documentation.