- [Instructor] In order to maximize
your information security program's effectiveness
you'll need to make sure it grows and changes
in response to its environment.
And the best way to do that
is by establishing an annual program of work.
Operating your program will demand a lot of your attention.
Without excellent planning,
prioritization, and execution,
you'll be so busy responding to problems
there won't be time available
to make useful changes to your own program.
The context in which your program operates
will change constantly due to forces
such as new organizational goals and objectives,
changes in the way the organization serves its customers
and generates revenue,
new legal and regulatory requirements,
changes in the threat landscape,
and the size and structure of your organization.
The best way I have found to keep up
is to make and follow an annual program of work.
This calender-driven program
will weave together three distinct workflows.
The first one is designed
to fully prepare you for annual budgeting.
The second workflow
is for conducting annual risk management activities.
And the third workflow
is for regularly reporting the progress you make
managing your top risks.
Many of the events in these workflows
only happen once each year
but in a particular sequence.
There are annual events
that are scheduled in a particular month.
These are budgeting and risk management activities.
And based on my approach there are many tri-annual events,
meaning they happen three times each year,
each one in a particular month.
I don't know when your annual budgeting exercise happens,
so I'm going to follow a generic fiscal calendar.
Once you see what's happening
you can adjust this timeline
to match up with your organizational calendar.
So now let's step through your annual program of work.
In the first month of each fiscal year
you'll conduct an annual review
of the structure of your information security program.
You'll look at the types of controls you have
and their sources
and you'll see if the design of your program
will set you up for success in the coming year.
Also, make a tri-annual update
to your cyber security scorecard
to capture all the progress you've made
doing risk reduction activities.
Now let's take a look at month two of your fiscal year.
Whereas last month you updated your scorecard,
this month you'll publish it to your stakeholders
as part of your tri-annual communication activity.
The goal is to show progress
managing information security risks.
You'll also perform your annual review
of processes for measuring information risks.
Here are the minimum questions you should ask
as part of that review.
Do you need to revise target scores
for any of your controls?
Am I measuring cyber risk in the right ways?
Am I measuring cyber risk in the right places?
Do I need any new controls?
And do I need to remove or revise any current controls?
Be sure to consult with your team and stakeholders
to make sure you don't overlook anything.
In month three you'll conduct your annual review
of processes for understanding information risks.
Here are the minimum questions you should ask.
Should you change how you are analyzing your data?
Do you need to revise the questions
you are trying to answer with your analysis?
Should you bring in any other statistical calculations?
Should you try any new data visualization techniques?
And are there new ways
to understand your leadership landscape?
In month four you'll conduct an annual review
or fur process for managing information risks,
and here are the minimum questions you should ask.
Are there any newer or better ways
to generate options for risk reduction?
What about new ways to estimate costs or benefits?
And are there new formats for proposals you should be using?
In month five
you'll perform your tri-annual scorecard update
to capture all the progress
from your risk reduction activities
since the last time you reported.
And you'll also begin
your annual measurement of information risks
by revising your project plan and updating your methods
based on the last three months of review.
In month six you'll publish the tri-annual scorecard
to all your stakeholders
and you'll continue the annual measurements of risk.
In month seven
you'll complete your annual risk measurements.
In month eighth you'll analyze
the risk measurements you did over the last three months
to understand your new risk posture.
During month nine make your tri-annual scorecard update
with progress from current risk reduction activities
and prepare annual proposals for new risk management efforts
based on the annual risk measurement you just analyzed.
In month 10 communicate your tri-annual scorecard update
showing progress since the last time you reported,
and get support from your boss and other key stakeholders
for your new risk management proposals.
In month 11 create your annual budget requests
for submission into the next budgeting cycle.
And in month 12, of course, take your holiday.