Show Notes
Developing an effective cybersecurity policy is a fundamental stepping stone when creating a comprehensive cybersecurity plan. Like any other corporate policy, they are a roadmap that defines what is in scope and establishes the baseline for ‘good’ cybersecurity practices.
A key challenge for leaders, however, is getting key stakeholder input. Traditional policies are often written in silos – in ways that are not clear to the audience they are meant to influence. Stakeholder contributions and their understanding of the language and purpose of the policy/s is an essential phase when implementing cybersecurity processes and awareness. Without them, it will not influence the business.
In this podcast, Nick Frost, Co-Founder and Director at CRMG, is joined by Simon Lacey, Principal Consultant at CRMG. Together they discuss the following:
• The lifecycle of a cybersecurity policy • The questions you should ask when creating or reviewing existing policies • Who you should get involved (stakeholders) within the organisation and the language to use to engage the business • Language and crafting – translating cybersecurity requirements to those who aren’t in cybersecurity
For more information visit www.crmg-consult.com.
More from Cyber Risk Fundamentals
How to Fast-Track Your Cybersecurity Journey with a No-Nonsense Gap Assessment by CRMG
The emergence and rapid growth of online retail is a great example of how businesses can move most of their operations online. Even businesses that don’t sell their products or services online are now benefiting from increased customer engagement and interaction from using digital platforms. However, while moving online has many benefits and opportunities to scale, it also creates many vulnerabilities and opportunities for cybercriminals.
The pace and scale at which we create and share data is greater than ever before. With such an abundance of information, data ownership is a real challenge for organisations, with many finding it too difficult to determine the data they own, and who is responsible for what. Once organisations assign data owners who understand what they are accountable for, how to manage risk to their data, and buy-in to the responsibility of being an owner, they can truly be an asset to the business - and a critical step in cybersecurity. In this podcast, Nick Frost, Co-Founder & Director at CRMG and Simon Lacey, Principal Consultant at CRMG, discuss why organisations that define data owners will be in a stronger position with their information security than those that don’t. Nick and Simon also share examples of how to identify and assign data owners, and how to get buy-in from the people who own data, and essentially the risk.
The pace and scale at which we create and share data is greater than ever before. With such abundance of information, data ownership is a real challenge for organisations, with many finding it too difficult to determine the data they own, and who is responsible for what.
Since the outbreak of COVID-19, there has been a period of major transition and organisations have had to quickly adapt to weather the storm. Many businesses have managed to remain operational but with all-new working processes. Organisations have adopted enterprise-wide remote working which likely required the rapid adoption of technology and a much greater reliance on existing or new digital infrastructure.