The New Heightened Cybersecurity Leadership Imperative: A National Standard Demands Greater Governance

Purpose & objective

The purpose of this presentation, with a designated moderator facilitating a discussion with the nation’s foremost experts in cybersecurity measurement and improvement, is to demonstrate successful methods of cybersecurity improvement. We must address the cybersecurity challenges and provide a path for improvement at the highest levels of leadership. Panelists will present their cybersecurity improvement approaches, showing evidence of success by focusing on the people, processes, technology, and planning needed to increase leadership, oversight, and expectations.

Outline

The outline of the presentation will focus on content and activities centered around setting up cybersecurity governance to establish and monitor the organization’s cybersecurity risk management strategy, expectations, and policy.

The specific tactics used to engage the audience include panelists topics centered around these content areas, allocating approximately 8 minutes for each.

Organizational Context: The organization’s mission is understood and informs cybersecurity risk management. Internal and external stakeholders are determined, and their needs and expectations regarding cybersecurity risk management are understood. Expectations and legal, regulatory, and contractual requirements surrounding the organization’s cybersecurity risk management decisions are understood.

Risk Management Strategy - The organization’s priorities, constraints, risk tolerance, need statements, and assumptions are established, communicated, and used to support operational risk decisions. Senior leaders agree on cybersecurity objectives and use them for measuring and managing risk and performance. A strategic direction that describes appropriate risk response options is established and communicated. Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.

Cybersecurity Supply Chain Risk Management - Organizational stakeholders identify, establish, manage, monitor, and improve cybersecurity supply chain risk management processes. Policies and procedures require provenance records for all acquired technology products and services. Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle. Leaders require periodic risk reporting about how acquired components are proven untampered and authentic.

Roles, Responsibilities, and Authorities - Cybersecurity roles, responsibilities, and authorities are established and communicated to foster accountability, performance assessment, and continuous improvement. Organizational leadership is responsible and accountable for cybersecurity risk and encourages a risk-aware, ethical, and continually improving culture. Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization’s cybersecurity strategy. The Leader’s expectations are shared, and the cybersecurity risk strategy is monitored.

Policies, Processes, and Procedures - Policies, processes, and procedures for managing cybersecurity risks are established based on organizational context, cybersecurity strategy, and priorities and are communicated and enforced. Personnel must acknowledge the receipt of policies when first hired, annually, and whenever a policy is updated. Policies are updated to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements).

Oversight - Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy. Measurements are collected about how well the risk management strategy and risk results are helping leaders make decisions and achieve organizational objectives. Key performance indicators (KPIs) are reviewed to ensure that organization-wide policies and procedures achieve goals. Metrics on cybersecurity risk management with senior leadership are collected and communicated.

Supporting research

Supporting research will include ten years of the U.S. Department of Commerce, NIST, Cybersecurity Framework and their journey to achieve cybersecurity improvement (https://www.nist.gov/cyberframework), with our focus being solely on how that applies to K-12 Education.