Creating an Information Security/Information Assurance Program - Lessons Learned
summary
Creates IS/IA programs from ground up across three organizations and claims repeatable steps: map mission and jurisdiction, decide formal versus virtual team, and enumerate core functions—built IS/IA programs from scratch, vulnerability/configuration management, continuous monitoring and use CISA vulnerability feeds for triage. Develops incident response with threat intelligence, penetration testing and auditing, and brought digital forensics in‑house to avoid external dependencies. Embeds legal and contract clauses (FISMA) into procurements and stresses managing VIP politics and operational dependencies like MSSPs, server and network engineering.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:28Why this topic
- 2:07Understanding your organization mission
- 3:49Understanding your jurisdiction
- 5:02Team makeup
- 5:47Core functions
- 7:56Customers
- 9:25Politics
- 11:17Regulatory Compliance
- 13:33Dependencies
- 15:52Security Audits
- 19:31Reactive
- 21:42Questions
related talks
40mHow CISA Is Charting a Path Toward Defensible Infrastructure
38mBuilding a Security Assurance Program
01h 05mWhat It Takes to Lead America’s Vulnerability Management Team
31mAlleviating the Fear in Preparing for Information Security Compliance
29mBuilding a Security Operations Program
40mCISO Leadership: Building Your Personal Action Plan
46mNow You’re in Role: The Fearless CISO
50mHack the Institution – A Map To a Strong Partner-Based Security Program