Building Security Framework For Enterprise

Major Milestones of Building a Security Framework for any Enterprise is Risk Assessment, Risk Analysis, Risk Treatment & Compliance.

The initial baseline assessment is an abbreviated version of a more full blown “Risk or security assessment/ analysis.” The assessment is only as good as the honesty and knowledge of the people who answer the questions and the experience and knowledge of the persons interpreting the answers. For example, just because an Organization has policies, does not mean that the policies are being followed or even enforced. It is still necessary to assess at a more detailed level by testing a policy to see if people are in compliance with it.

After the report is complete, an Organization must deal with the number one issue to a successful security program: Management commitment .Each organization will find the level of Management commitment very different. It may be easy to get the needed buy-in because of an incident causing financial loss, or it may be difficult because Management does not understand all the risks, as the baseline report points out. Presenting them in a Business context will help management understand. In either case, be prepared by understanding management’s business expectations and use the sample questions as indicated in Annexure 1 to educate management to the security concerns. Until security matters as much to management as the bottom line, the users will not make security policies, guidelines and procedures a priority. As the security program grows, it will be equally important to have management’s buy-in throughout all levels of the organization – from executives to line managers. 

Annexure 1: Baseline assessment of company security status.