The challenges of shifting project priorities can leave organizations with a reactive security posture that is difficult to manage. Unfortunately, the consequences of not having a defined security plan, effective process management, and meaningful metrics can stall progress or even diminish the organization’s security posture. A defined multi-year security roadmap helps an organization identify short and long term goals, measure performance, and ultimately demonstrate results.
Approach
VioPoint understands the importance of having a defined plan for security. We work with clients to collect important data inputs (both qualitative and quantitative in nature) and develop project-based roadmaps that help them achieve incremental increases in maturity over time.
Security roadmaps rely on factors that will vary based on the individual needs of an organization. An effective security roadmap helps identify low hanging fruit, establish quick wins, and quantify the organization’s tolerance for improvement over time. VioPoint incorporates several core elements into our security roadmap approach and uses established risk frameworks to incorporate relevant data into the plan:
- Results and inputs from previous compliance assessments or audits
- Results from previous risk assessments
- Organizational culture
- Business objectives and strategy
- Reasonableness of implementation
- Resources and staffing levels
Using risk, compliance, and stakeholder qualitative input, VioPoint will map a current state maturity level against high-level control domains. By leveraging a maturity based approach, VioPoint can identify the activities that are reasonable for year one of the roadmap…as well as areas where improvement is needed for years two and beyond.
Results
VioPoint’s approach to developing an Information Security Roadmap provides both strategic and tactical recommendations that are based on identified risks to the organization (both perceived and measured). These recommendations are blended to provide an incremental approach to security projects and activities over a multi-year timeframe. This approach helps ensure that the organization can absorb the change necessary to create a security aware and focused environment that is capable of meeting the ongoing security and regulatory requirements.
