CISM: Certified Information Security Manager certification video training course by prepaway along with practice test questions and answers, study guide and exam dumps provides the ultimate training package to help you pass.

Domain 01 - Information Security Governance

90. BIA

Now when we talk about the roadmap, really when we look at the elements of strategy, the question is: what should go into the security strategy? Again, one of the things that needs to be included is the starting point and the destinations. Now, when we create this roadmap, it's really a document that's going to tell us how to get to that defined and desired state of security. Now the roadmap may have many stops along the way.

There may be times when you create some short-term goals to be able to help build you up to that long-term goal, which might be to get to the desired state of security. It's an important part of understanding where you are and where you need to go in order to develop that kind of plan or strategy. Now, other things that you should document, things that are going to be crucial for understanding what resources I have available to me to get to that desired state, are things like understanding the people that I have involved: do I have people with sufficient expertise or training? Do I have the resources necessary for whatever the strategy is going to be? Do you need to maybe look into getting third-party help?

What are the processes that you're going to go through? Again, remember that the processes, as you can look at them as part of the overall project, may have different dependencies and different timelines in which they are supposed to be executed. We must consider the technologies. Now, technologies are extremely beneficial and constantly evolving. In fact, it's not uncommon for new technology to emerge during the process of reaching your desired states, which may be an even better solution than the one you originally planned. And, of course, you want to look at other resources. Other resources could include monetary and financial resources, as well as the possibility of mergers.

91. Lesson 10: Information Security Strategy Development

So now I'm going to look at the roadmap. Like I said, prior to beginning the roadmap, we need to know what the desired level of security is going to be. We have to have an architecture chosen as a framework so that we can begin. And, as previously stated, achieving that desired state is typically regarded as a long-term goal that may include a number of short-term series, projects, and initiatives.

Now, another good thing about that, though, is that we are creating through this process ways of being able to get to those key points where we can say, "Look, we're meeting our deadlines, we're meeting our budgets, and we're meeting the time objectives that we're supposed to be at, at certain locations." It's providing some of those metrics and measurements that can help us see the progress of getting to that end point.

Now, this means that the overall roadmap is probably going to be broken down, as I said, into a series of short-term projects. But again, the benefits are that we have a lot of checkpoints and the ability to do reviews, to look, and to see if we're still on target. So there are a lot of benefits to this planning process.

92. The Roadmap

Part of what we need to look at, as we said, are the resources. And remember, resources are what's available to the organization, and they should be listed and considered when you're developing your security strategy. So examples of this are, of course, existing policies, standards, procedures, and guidelines.

Now, it is important to understand that part of our current state of security should be based on the current policies, standards, and procedures. Now, a policy is usually, as we said, a kind of framework or blueprint for what we are trying to achieve. And a part of this process may be the creation of new policies, but we still have to make sure we're working within existing policies because they were there to get you to the current state of security that you have. So I'm not going to suggest you just throw all the old policies out, don't have any standards throughout all the procedures, and forget that those are the items that helped get you to your current state of security, but instead try to work from that state to get to the new location or to the desired state.

You may now have some limitations or constraints; they may be physical in nature. You may just have no more room for growth within your current facilities. Maybe you've maxed out the power utilisation offered by the power suppliers, or whatever the case may be. It could be technical limitations or constraints that you have to deal with or existing technical resources that might be available as well. When we have limitations based on what we can get from our service providers, such as wide area networks or infrastructure, the type of cabling, not all facilities can get fibre optics basically into their network from their service providers. Some may be so rural that they're lucky to get a good copper phone line.

I hope that's not the case for you, but just to reiterate, we have some technical and physical issues, as well as procedural controls. Remember, there are maybe some regulations we have to follow as well to make sure we don't violate anything as we're getting to that new desired state. Look at your existing countermeasures and figure out if they work for what you're coming from. not only the existing state but also the desired state. Talk about layers of defence if you can put them in place. Again, this means that we must stay current on the technologies we are currently using as well as any new technologies that may be on the horizon as we work toward our long-term goal. Your organisational structure is very important in all aspects. In fact, there may be times when you encounter people who are hesitant or resistant to change.

Maybe you have to deal with the fact that there may be existing "kingdoms" that people don't want to give up. Some responsibilities from existing cultures might throw some constraints in there as well. Having clearly defined roles and responsibilities is certainly an important aspect. The skills, training, awareness, and education of everybody involved; existing audits to see if you are currently in compliance; and, of course, audits to help you see that you get to certain checkpoints or are on the way to the desired state. And do I have the existing and underlying risk and business impact assessments that help me create a clearly defined roadmap as part of my strategy to get to that desired state? Security?

93. Elements of a Strategy

Now, as I said, the resources and constraints kind of go hand in hand. However, constraints must be considered when developing a strategy. And again, you have some constraints that absolutely cannot budge. There may be legal issues or regulations that you cannot violate without risking severe criminal or civil penalties from the jurisdiction that you live in. Like I said, the physical environment may be enough of a constraint that there's no room for growth.

The corporation's ethics, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture, culture We've always done business this way, so we want to continue to do business this way. And again, it just kind of gets us into the "the way we've always done things" mentality rather than being flexible to see that growth. And again, it could be that the changes you make may affect other people's roles and responsibilities, or what we sometimes call their kingdoms. And we don't want to cause anyone to be upset. The costs. I'm not saying don't upset them. I'm just saying to think of these as constraints if they are truly constraints and there aren't ways to work around them. Again, the expenses are the costs.

Sometimes things go over the estimated costs. We talked about some of those pitfalls and coming up with the strategies, and, you know, people are kind of getting anchored onto an existing cost or not willing to take into account how things might evolve or change or not having those flexibilities. Your personnel and organisational structure could certainly be issues, especially if you're trying to get to a certain desired state. Maybe you require some new offsite facilities as backups, maybe as a part of your disaster recovery business continuity plans, and you've decided to put those facilities at such a distance that it's not reasonable for your current set of people to be able to drive those distances to man those facilities.

So that could also be another issue that you have to deal with. And of course, again, the resources and capabilities of the existing personnel and staff. If you've desired to find a new countermeasure and you have nobody trained in that particular product, that may be a limitation you have to come across. You might have time constraints as well, and of course, risk tolerance. Again, remembering that some of the constraints we have are that we might have a very small appetite for risk, As a result, we must ensure that we achieve the risk that we are willing to accept as part of the objectives. And again, that could cause a constraint insofar as maybe it takes too much time, too much money, not enough personnel, or whatever it is to get to a certain point.

94. Strategy Resources and Constraints

Now, the business impact assessment is something we should do while we're looking at our current risks. And in fact, a thorough business impact analysis of your critical systems and processes is there so you can get a good picture of your current state of security. Now people might say, "Okay, look, why do I need to see my current state?" I know where I want to be. Why do I look at my current state? We often use the gap between them to perform a gap analysis, so that if we know where we are now, we can begin the process of making course corrections, following the roadmap, or whatever great other term we use to get to the state that we're attempting to achieve. That is one way of looking at it. It's hard to chart a path if you don't know where you are, even if you know where it is you're trying to get to. So again, some of that business impact analysis that you have can help you get the information you need to create an effective strategy. The strategy must now address the gap between acceptable levels of impact and the current level of potential impacts.

Prepaway's CISM: Certified Information Security Manager video training course for passing certification exams is the only solution which you need.