Untitled

• Lecture is about governance and strategic planning for spring 2024-25.
• Yogi Berra: “You got to be careful if you don't know where you're going, because you might not get there."

The Role of Planning

• Planning is the sequence of actions intended to achieve specific goals during a defined period of time, and then controlling the implementation of these steps.
• Without specific and detailed planning, organizational units would attempt to meet objectives independently, with each unit being guided by its own initiatives and ideas, resulting in an inefficient use of resources.
• Organizational planning, when conducted by the appropriate segments of the organization, provides a coordinated and uniform script that increases efficiency and reduces waste and duplication of effort by each organizational unit.
• Organizational planning should make use of a top-down process.
• The organization's leadership chooses the direction and initiatives that the entire organization should pursue.
• The primary goal of the planning process is the creation of detailed plans = systematic directions for how to meet the organization's objectives.

Precursors to Planning

• Mission Statement explicitly declares the business of the organization and its intended areas of operations.
• Vision Statement is an idealistic expression of what the organization wants to become; Vision statement expresses where the organization wants to go, while the mission statement describes how it to get there.
• Values Statement: By establishing a formal set of organizational principles and qualities in a values statement, as well as benchmarks for measuring behavior against these published values, an organization makes its conduct and performance standards clear to its employees and the public.
• RWW's mission statement: "Random Widget Works designs and manufactures quality widgets and associated equipment and supplies for use in modern business environments".
• RWW's vision statement: Random Widget Works will be the preferred manufacturer of choice for every business's widget equipment needs, with an RWW widget in every gizmo in use; Vision statements aren't meant to express the probable, only the possible.
• RWW's values: Random Widget Works values commitment, honesty, integrity, and social responsibility among its employees and is committed to providing its services in harmony with its corporate, social, legal, and natural environments.

Strategic Planning

• Strategic planning is the process of defining and specifying the long-term direction (strategy) to be taken by an organization, and the allocation and acquisition of resources needed to pursue this effort; it's a 3-step process.
• An organization identifies a goal for an area of improvement or a need for a new capability, and then it documents the current progress toward accomplishing that goal{where are we now?}
• Next, leadership articulates where the organization seeks to be with regard to the goal{where are we going?}
• Plans can be made for how to achieve that goal {how will we get there?}

Top-Down Strategic Planning

• Strategic plans formed at the highest levels of the organization are used to create the overall corporate strategy.
• As lower levels of the organizational hierarchy are involved, these high-level plans are evolved into more detailed, more concrete planning.
• Higher-level plans are translated into more specific plans for intermediate layers of management, and high-level goals are translated into lower-level goals and objectives.
• That layer of strategic planning by function is then converted into tactical planning and provides direction for the operational plans.
• After an organization develops a general strategy, it must create an overall strategic plan by extending that general strategy into specific strategic plans for major divisions.
• Each level of each division translates those goals into more specific goals for the level below.
• An example of the strategy; To provide the highest-quality, most cost-effective widgets in the industry.
• An example of the goals: increasing revenue by 10 percent annually, increasing market share by 5 percent annually and decreasing expenses by 5 percent annually.

Example

• Chief operations officer (COO) could derive a different strategic statement and its corresponding goals that focus more on his or her specific responsibilities.
• Strategy: To provide the highest-quality, industry-leading widget development manufacture, and delivery world wide.
• Goals: To reduce the cost of manufacture by 10 percent per year through the development of improved production methods, reduce the cost of distribution and inventory management by 10 percent per year through improved ordering methods with just-in-time delivery to our largest customers, and improve the quality of products through research and development of better and more efficient product design and materials acquisition

Planning Levels

• Once the organization's overall strategic plan is translated into strategic goals for each major division or operation, the next step is to translate these strategic goals into objectives that are specific, measurable, achievable, and time-bound.
• Strategic plans are used to create tactical plans, which are in turn used to develop operational plans

Information Security Governance

• The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise's resources are used responsibly.
• An approach to information security strategic guidance from a board of directors or senior management perspective that seeks to integrate the three components of information security governance, risk management, and regulatory compliance (GRC).
• Security programs designed and managed as a technical specialty in the IT department are less likely to be effective.
• A broader view of InfoSec encompasses all of an organization's information assets, including IT assets.
• Valuable commodities must be protected regardless of how the information is processed, stored, or transmitted, and with a thorough understanding of the risks to, and the benefits of, the information assets.
• Outcomes desired by Strategic alignment of InfoSec with business strategy, risk management by executing appropriate measures, resource management by effective use of InfoSec knowledge, performance measurement by using InfoSec governance metrics, and value delivery by optimizing InfoSec investments.

ITGI Approach to Information Security Governance

• InfoSec governance includes accountabilities and methods undertaken by directors and executive management to provide strategic direction, objective establishment, progress measurement, risk practice verification, and asset usage validation.
• ITGI recommends board supervision of InfoSec objectives by promoting awareness, verifying alignment with strategies, mandating comprehensive programs, and requiring management reports.

NCSP Industry Framework for Information Security Governance

• NCSP developed framework, "Information Security Governance: A Call to Action," encouraging public and private sectors to build information security governance programs into corporate governance structures.
• NCSP uses the IDEAL model of governance which includes the steps Inititating, Diagnosing, Establishing, Acting, and Learning.

Responsibilities and Functional Roles Examples

• Oversee overall corporate security posture and brief board
• Set security policy, procedures, program, and training
• Respond to security breaches
• Be responsible for annual audit coordination
• Implement, audit, and assess compliance
• Communicate policies and training
• Implement policy and report vulnerabilities

Frameworks

• 2007 - CERT division of Carnegie Mellon University's Software Engineering Institute released an implementation guide for its trademarked governing for enterprise security (GES) program
• ISO/IEC 27014: 2013 - governance of information security
• NCSC Cyber Assessment Framework (CAF) provides a systematic and comprehensive approach to assessing the extent to which cyber risks to essential functions are being managed by the organization responsible