What is the most overlooked step in a cybersecurity plan?

Security & GRCSecurity Strategy & Roadmap
3.3k viewscircle icon1 Upvotecircle icon8 Comments
Sort by:
Senior Information Security Manager in Software4 years ago

Testing, and that the plan must be regularly updated.
Regularly could mean quarterly or more often.

Lightbulb on3
Director of Technology in Government4 years ago

Overlooking physical security in your CyberSecurity plan could leave a major gap in your CyberSecurity posture.

Lightbulb on1
CIO / Managing Partner in Manufacturing5 years ago

Getting senior executives fully on board and understanding it.

Fractional CIO in Services (non-Government)5 years ago

Communicating it in a way that makes sense to your people.

VP, Director of Cyber Incident Response in Finance (non-banking)5 years ago

This is an excellent question.  I think it's the maintenance of the plan itself.  Because even if you document the plan, and the processes to address the response, each security incident is unique enough that it will require you to update the processes involved.  So the moment you publish your plan, it's already out of date!

1 Reply
no title4 years ago

Absolutely. I would say actually following it, and keeping it up to date and current, are the biggest challenges. Too many organizations create a plan, the stick it on a shelf until the next annual audit rolls around. It does you no good if you don't actually follow through from the plan.

Lightbulb on2

Content you might like

If you get hired by an SMB and you’re the company’s first/only security practitioner, where should you start? (Should you focus on SANS top 20 controls? Or start with the NIST framework?)

Read More Comments

How does your organization handle security team involvement in change requests submitted to CAB/RAB — specifically in relation to formal security review and approval?

Always required – Security must formally review and approve every change request.

Required for security-impacting changes – Security reviews only changes flagged as having potential security implications. Please comment : Who decides which changes require security review and which do not ? Is this determination manual or automated? How do you avoid gaps or oversights in this process ?100%

Not required – Security does not review changes submitted CAB/RAB by other teams.

Risk-based or automated – Security involvement is determined by a tiered model or automated risk scoring within ITSM.

View Results

Which tech conference do you intend to attend in person next year or have already participated in this year, and what motivated your choice?

Read More Comments

Has anyone drafted an SOW for a cloud-based SIEM with setup, migration, and maintenance? I’m working on a FedRAMP-authorized SIEM SOW, migrating from on-prem Splunk, covering data, searches, alerts, dashboards, and models.  Scope includes Environment Setup:  Cloud provisioning, configuration, testing. Connectors/Parsers: Custom data source integration. Content Development: Rules, use cases, threat feeds. Performance Tuning: Query/index optimization. Runbooks: Operational procedures. Also required: 24x7 support, maintenance, lifecycle and application management, role-based training, and documentation.  Must comply with NIST SP 800-53, CJIS, and FedRAMP Moderate+. Goal: Secure, scalable SIEM for rapid deployment. I may be missing elements, so suggestions are welcome. Please share redacted SOWs or tips if possible.

Lines of business other than IT should give input on how the security awareness & training program is designed.

Strongly agree11%

Agree69%

Neutral14%

Disagree3%

Strongly disagree

View Results