Cybersecurity is the effort to protect all attacks Information security deals with protecting your

that occur in cyberspace, such as phishing,
hacking, and malware. These attacks target data,
storage, and devices most frequently. The effort
of cybersecurity is to safeguard all of your digital,
connected systems, which can mean actively
combatting the attacks that target your
operation.
Cybersecurity Information Security organization’s information, whether that is digital
or analog. This usually means controlling access,
disclosures, and disruption. Think of it as the
foundation of creating safeguards around the
data and information that is essential to your
operation through the use of tools such as
encryption, two-​factor authentication, and facial
scans.

Focus and Scope Considerations

Information technology is a term that Information security deals with security issues
encompasses all of the technology and devices Information technology Information Security around your data to make sure it is protected from
that you use in the course of your operation. potential attacks.

Culture Requirements Purpose

Protect your data

Set Security North Star
(confidentiality and integrity)

Av
ty ail
ici a bi
e nt lit
y
th Minimize the risk of security
Au Outline Security Objectives
breaches
Inte
Non ion
diat

grit

Plan for digital security across

-​

Map to Business & Regulatory Reqs.

y
u

your whole organization

Rep

iality
Confident-​

Help with regulatory

Measure and Improve
compliance

Enforceable and Reviewable and

Comprehensive Business Goal Aware
Practical Updatable

Considerations
 Applicable Included Learn from Communication Training Measure,
Assessment Regulations and Review, &
Elements others Plans Objectives
Legal Update

Assess risks: Regulation and Regulation and Learn from Communication Training Plan: Metrics and
Legal: Legal: others: Plan: Updates:
focus on data, How is the policy
process, people, What regulations What regulations Research what How is the policy to be What KPIs and
and and legal and legal others have to be disseminated to Measures are
infrastructure, constraints need constraints need written, look for disseminated to the relevant reviewed.
determine to be followed. to be followed. commonality and the relevant parties Define the
sensitivity and applicability parties Update process
impact

Scope and Policy Statements Identify Scope Identify Policies Monitor

Identify Roles & Performance

Roles and Responsibilities Create JDs Populate Roles Monitor
Responsibilities Reviews

Establish
Access to Data Identify Data Classify Usage Monitor
Protections

Establish
Access Controls Identify Access Monitor
Controls

Identify Develop Implement

Change Management Review Monitor
Changes Change Plan Changes

Communications and Operations Identify Set Comms. Develop Publish

Monitor
Security Communication Cadence Comms Commsn

Identify Develop Practice

Incident Management and Response Monitor
Response Areas Response Plans Response Plans

Identify Secure Develop Secure Implement

Systems Security Monitor
Requirements Methodologies Secure Zones

Identify Release Develop Implement

Review and Release Process Monitor
Processes Processes Release Process
 Security Security
Policy Principles

Information Set the guiding

Information Privacy / Guidelines Data Asset Asset
Security principles for security Impact
Management (ISM) security within Security Documents Owners Register
Assessments
Define Scope the company Strategy
Set Direction
Provide Support
Outline Roles and
Responsibilities
A strategic plan to Ensures the A set of A list of data A list of assets
Set Staff Policy
protect the protection of documents to assets' owners within the
company's data, Personal guide the organization
assets, systems, Information company
and people Security
Assessments Report
(SAR)

Risk assessment and

Confidentiality
management

Authenticity Access Control Data Access Access Control

Control Guidelines

Integrity Data Protection Data Assessment

Non-​repudiation
Incidence Incident Management
response and and Response
Guidelines

Access Control Compliance

Availability Communications and

Operations Security
Guidelines

Ethical and Legal Change Management

Issues Guidelines