RealTime Information Technology

View Original

5 FOUNDATIONS OF A SOLID CYBERSECURITY PLAN

Deidre Frith

5 FOUNDATIONS OF A SOLID CYBERSECURITY PLAN

  • Identify - Define your business assets and what you need to protect.

  • Protect - Operate securely and actively protect your valuable information.

  • Detect - Observe and alert on bad behaviors and other indicators of compromise.

  • Response - Guide your actions with your response plans.

  • Recovery - A safety net is imperative for a solid Continuity and Disaster Recovery Plan.

CRAFTING A SOLID CYBERSECURITY PROCESS

The first steps in crafting a solid cybersecurity process for your business fall under the IDENTIFY domain: perform a Risk Assessment, a Vulnerability Assessment, and an Impact Analysis on your business to help document your business risks. 

Let’s dig into this a bit. Beware, lots of links ahead!

Here is a great resource that you’ve already paid for with your tax dollars – the NIST Small Business Cybersecurity corner, https://www.nist.gov/itl/smallbusinesscyber. NIST has a roadmap, https://www.us-cert.gov/sites/default/files/c3vp/smb/DHS-SMB-Road-Map.pdf to help visualize the journey to improved cybersecurity for your business. This guide covers the five foundations discussed earlier in a user-friendly format -https://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.7621r1.pdf.  

  • Risk Assessment – compare proven best practices against how your business approaches various actions/processes that can impact your security. RealTime has a shortened Risk Assessment to get you started, all based upon the NIST Cybersecurity framework. Save some time by calling us to review your processes or use the full assessment using the NIST framework tools provided below:

  • Vulnerability Assessment – Test your network inside and out for technical holes using this assessment. A competent professional should perform this step and RealTime is available. You can do this yourself, but it’ll be faster, cheaper, and better to engage a professional to perform this step.

  • Business Impact Analysis – Outline the most important things your business does and technologies or systems used to perform these important functions. This will help you focus your resources where you can get the most positive impact to your business. A Business Impact Analysis is definitely a DIY step – no one knows your business better than you. RealTime can help guide the process and the risk discussion if you need it.

IDENTIFIED RISKS AND POTENTIAL IMPACTS

After you’ve gathered this information, prioritize your findings to help make educated decisions on

  1. What risks you need to mitigate now;

  2. What risks to plan to address in the future;

  3. What risks you choose to accept for now.

    The goal is for your business to understand what your identified risks are and the potential impacts; this allows you to prioritize and begin mitigating those risks. Most small businesses find that many risks are process/procedure oriented. These things can largely be addressed internally with proper staff training on new processes.

    Additionally, it is likely that there will also be technical risks and these will need to be addressed by your Technology Department or an outsourced provider like RealTime.

 ARE YOU GOING TO SLEEP WELL TONIGHT?

We hope this piqueS your interest in getting on the path to improving cybersecurity for your business. EVERY business, small or large, needs a comprehensive cybersecurity program now more than ever. Call us if we can help or fill-out the form below, (334) 678-1417.

Pro tip – this is part of RESPOND, but is something you’ll want to have in place sooner rather than later – Cyber liability insurance. Talk to a qualified insurer, ask lots of questions and make sure the policy is going to be effective in providing the coverage your business needs. 

[Guest post written by RealTime VP Todd Swartzman]

WANT ADDITIONAL RESOURCES?

We have resources such as a Business Impact Analysis spreadsheet and other items to help your business. Just fill-out the form below and we will help you out.

See this form in the original post