chapter two

2 Establishing the foundation

 

This chapter covers

  • Implementing effective cybersecurity governance
  • Roles and responsibilities in securing your organization's digital identity
  • Risks associated with third-party vendors and supply chains

In this chapter, we will examine governance as a concept and discuss identity in cybersecurity to better understand what metrics we could effectively use to measure these concepts. To do that, we need a solid foundation based on an industry-trusted framework. It can be easy to get overwhelmed by the number of frameworks to choose from.

When starting out in cybersecurity conducting risk gap assessments, our team had to investigate several cybersecurity frameworks to choose one that we could consistently repeat—while adding value—to determine specific best practices and mitigation strategies to close those gaps. To measure cybersecurity effectively we need to use a framework that resonates with your organization. The concepts are shared among all cybersecurity frameworks so even if you choose a framework that better suits your needs, the concepts we will discuss in this book will remain consistent among all cybersecurity frameworks.

Let’s discover how these concepts form the foundation of cybersecurity through practical examples and scenario-based learning, ensuring your organization is prepared for the challenges ahead.

2.1 Governance

2.2 Organizational context

2.2.1 Organizational context metrics

2.2.2 Organizational context metrics exercise

2.3 Risk management strategy

2.3.1 Risk management metrics

2.3.2 Risk management metrics exercise

2.4 Roles, responsibilities, and authorities

2.4.1 Roles, responsibilities, and authorities metrics

2.4.2 Roles and responsibilities metrics exercise

2.5 Policy, processes, and procedures

2.5.1 Policy, processes, and procedures metrics

2.5.2 Policy, processes, and procedures metrics exercise

2.6 Oversight

2.6.1 Governance structure

2.6.2 Simulated governance structure

2.6.3 Governance exercise

2.6.4 Oversight metrics

2.6.5 Oversight metrics exercise

2.7 Cybersecurity supply chain risk management

2.7.1 Supply chain risk management practices

2.7.2 Cybersecurity supply chain risk management metrics

2.7.3 Supply chain risk management metrics exercise

2.8 Governance metrics

2.9 Answer to exercise 2.6.3

2.10 Summary