How To Build A Cybersecurity Program

In general, point solutions generally are not effective. The same holds true for cybersecurity. The best approach to being both secure and compliant is to manage cybersecurity and privacy requirements as an ongoing program.

Technology is generally considered a cost-center in most companies, since the department does not generate revenue. For CIOs / CISOs / CTOs / IT Directors, the challege is to demonstrate maximum value to the company, so that technology budgets are protected. From the IT security side of things, having proper documentation is part of an overall risk management strategy. Having comprehensive IT security policies, standards, guidelines and procedures can provide evidence of due care and due diligence, which is crucial if your company is ever breached or sued for the loss of sensitive customer data.

Key Takeaways - How To Build A Cybersecurity Program

Building cybersecurity documentation from scratch typically costs $200K to $500K plus in labor when accounting for senior practitioner time.
ComplianceForge products provide the same documentation for a fraction of the cost. Typically saving 80 to 90% compared to internal development.
A complete cybersecurity program requires policies, standards, procedures, risk assessments, incident response plans and more.
Hiring a consultant to write custom documentation costs $150 to $400 per hour. And still takes months to complete.
ComplianceForge products are delivered same-day in editable formats, giving you a massive head start.

Cybersecurity Program Development

It All Starts With The Business

Vision, Mission & Strategy

High-level business guidance is a necessity to create a viable IT security program. This executive-level direction establishes the big picture goals that IT security capabilities will need to enable.

Defined Maturity Level Target

Many companies define a maturity state target for their IT security programs. Maturity levels help quantify risk – lesser mature programs will inherently accept greater risk than more mature programs. These maturity levels are commonly defined by ISO 15504-2, COBIT, or CMMI for Services frameworks.

Multi-Year Business Plan

When you tie in a targeted maturity level with an understanding the company’s vision, mission and strategy, you can clearly develop a business plan that makes IT security a strategic asset to enable growth and minimize risk to the company.

Cybersecurity Policies & Standards

From the perspective of a company’s IT security program, what brings it all together is the policies and standards. This documentation provides the management, operational and technical direction for IT security technologies and activities.

Cybersecurity Procedures

Procedures are where “the rubber meets the road” for IT security. Procedures enact the requirements called out in the IT security policies and standards to create a formal method to do something.

Working together, this program documentation helps create evidence of due care and due diligence - critical to proving your company took reasonable precautions to prevent a cybersecurity incident!

Due Diligence Considerations

Defined maturity targets influence business planning.
Business plans document milestones to meet maturity targets.
Business plans provide scoping for the IT security program.
Business plans establish evidence of due care.
Procedures establish evidence of due care.

Due Care Considerations

Procedures direct the workflow for staff to follow.
Managing exceptions to standards documents the management of risk.
Evidence of procedures being followed establishes evidence of due diligence.

Common Questions

Frequently-Asked Questions

Here are answers to common questions about building a cybersecurity program:

Where should a cybersecurity program start?

A cybersecurity program should start with business direction, not tools. A practical sequence begins with an executive vision, mission and strategy, then sets a defined maturity target, builds a multi-year business plan, and documents policies and standards before you write procedures. Each step builds on the one before it, so your procedures end up enacting requirements that trace back to leadership's goals.

How do you build a cybersecurity program without hiring a CISO?

You can build a cybersecurity program without a full-time CISO by having executive leadership set direction and using outside expertise and templates for the rest. Leadership still needs to define the vision, maturity target and business plan. Framework-aligned documentation templates cover policies, standards and procedures. If you want ongoing oversight, some ComplianceForge partners, such as Logos Systems, offer virtual or fractional CISO services.

Why should cybersecurity be managed as a program instead of point solutions?

Cybersecurity works best as an ongoing program because point solutions generally aren't effective on their own. A program ties security to executive direction, a maturity target and a business plan, then carries that direction through policies, standards and procedures. Proper documentation is part of an overall risk management strategy, because it helps prove your company took reasonable precautions if it's ever breached or sued over lost customer data.

Why does a cybersecurity program need a maturity target?

A maturity target gives a cybersecurity program a measurable goal, so leadership knows what good looks like and can fund it over time. Organizations often use models such as COBIT or CMMI to define the target. Less mature programs inherently accept greater risk. Combining the target with company strategy produces a multi-year business plan that makes IT security a strategic asset rather than only a cost center.

How much does it cost to build cybersecurity documentation in-house?

Building cybersecurity documentation in-house usually costs far more than buying templates, mostly in staff labor. ComplianceForge products typically save 80 to 90 percent compared to internal development, and we estimate that internal labor for a full documentation set runs into the hundreds of thousands of dollars. The cost comes from time spent researching framework requirements, drafting, reviewing and maintaining policies, standards and procedures.