Section Menu

Maturing Your Cybersecurity Program

posted by James Boyd on Thursday, June 8, 2023 in SHAZAM Blog

Ransomware, data breaches and other cyber threats continue to have significant impacts on financial institutions. As cybercriminals continue to find new ways to attack, it’s necessary for organizations to continually assess their cybersecurity programs and mature their cyber risk mitigation controls to reduce their risk. Regulators, clients, business partners and cyber insurance carriers all demand specific cybersecurity controls be in place and maintained. In addition, an increasing number of federal and state cybersecurity and privacy laws and industry standards require compliance.

For small- and medium-sized businesses, providing the necessary level of security is a daunting task. However, by using some simple cybersecurity management tools, your organization can establish a continuous maturity process.

Consider implementing the following tools to accomplish your cybersecurity management goals and continue to mature your cyber defenses.

Control Catalog

Your institution can use a cyber control catalog to document and organize your cybersecurity controls, including the risk mitigation controls you put in place to protect your systems and information. Controls can be technical, such as data encryption, or administrative, such as a password policy. A control catalog lists all your cyber controls, identifies how your institution implements those controls, who’s responsible for them, and identifies the laws, regulations, and contract obligations requiring those controls. This is a great tool to provide assurance of compliance to auditors and examiners.

Here are two helpful examples of control catalogs to use as a basis for developing your own control catalog:

Security Controls Packet

You likely receive various questionnaires to complete regarding your security controls as new laws and best practices may require your clients to perform due diligence on your organization’s risk management practices. These questionnaires take time to respond to one at a time. A security controls packet should contain cybersecurity program information that’s ready to share with clients and other third parties. By creating a security controls packet containing an overview of your cyber program, results from penetration tests, SOC audit reports, etc., you can form a standard response to these third-party requests instead of responding to each questionnaire individually.

Cyber Maturity Assessment

A cyber maturity assessment should be completed regularly (typically annually) to measure your current level of maturity and track your level of defense over time. Over the last few decades, cybersecurity standards have emerged, including:

ISO 27001
CIS Critical Security Controls
NIST Cybersecurity Framework

These standards identify common security controls that your institution can implement to protect your systems and information. By using a rating system such as the Capability Maturity Model, you can rate your level of maturity for each of the controls in these frameworks, which will help you identify weaknesses in your cyber defenses.

Security Roadmap

In order to mature your program continuously, consider adding new controls and making improvements to existing controls. A security roadmap is a tool to outline your objectives for control improvements or new controls. A roadmap should outline which security objectives are priorities so you can properly align resources. Roadmaps should also outline requirements and high-level steps for completing each objective, as well as a reasonable timeline for completing each high-level step.

Cybersecurity can seem like a daunting task, but by using these cybersecurity program management tools, you’ll have an organized plan to continue to defend against cybercrime.

About the Author

As vice president of information security, James Boyd is responsible for developing and maintaining SHAZAM’s security program. An active technology and cyber security professional with over 20 years’ experience, he’s earned designat ... read entire bio

SHAZAM, Inc. and ITS, Inc. provide this blog for general informational purposes only. Our blog may be shared by a direct link wherein the content remains as originally presented and has not been altered. SHAZAM, Inc. and ITS, Inc. assume no responsibility for errors or omissions in the contents on the blog. By using this blog, reader agrees that the information published does not constitute nor is a substitute for legal advice which should only be sought from a qualified, licensed attorney.