![innogy Group Security
Exemplary Cyber Security maturity actuals
and planning
Approach
Current Cyber Security maturity [%]
1% – 39%
Initial
40% – 59%
Repeatable
60% – 79%
Defined
80% – 94%
Managed
Optimised
Company overview
Control Global DE UK NL PL CZ SK
CA.05 Information security policies 79 79 79 79 79 79 79
CA.06 Organisation of information security 80 80 79 80 80 81 80
CA.07 Human resources security 67 62 59 62 60 84 72
CA.08 Asset management 53 52 52 52 51 58 55
CA.09 Access control 65 62 59 63 60 79 68
CA.10 Cryptography 80 80 78 80 80 78 82
CA.11 Physical & environmental security 81 80 80 80 82 84 80
CA.12 Operations security 68 66 67 65 68 72 72
CA.13 Communications security 68 65 67 67 65 73 69
CA.14
System acquisition
development & maintenance
49 43 54 43 48 62 43
CA.15 Supplier relationships 71 71 75 71 67 71 71
CA.16 Information security incident mgmt. 82 85 78 84 74 84 85
CA.17 Information security aspects of BCM 79 80 80 80 78 75 80
CA.18 Compliance 72 71 74 71 66 76 71
Total ø 72 70 70 70 68 75 72
Cyber Security maturity planning [%]
62
69
7280
0
20
100
40
60
Jan
18
Dec
18
Jun
19
60
Mar
18
Jun
18
Sep
18
Mar
19
Sep
19
Dec
19
Target:
80
Planning Actual
CSMA methodology and tool awarded
with the Security Innovation Award.
Fictitious example
14](https://image.slidesharecdn.com/hagenbuch20190315csmaatasisv1-190411144733/85/Cyber-Security-Maturity-Assessment-14-320.jpg)
More Related Content
Similar to Cyber Security Maturity Assessment
![Draft_ppt_dmss[1][2] (1) FINAL123455667.pptx](https://cdn.slidesharecdn.com/ss_thumbnails/draftpptdmss121final-250720163613-fd8ed22f-thumbnail.jpg?width=640&height=640&fit=bounds)
Cyber Security Maturity Assessment
- 1. ASIS EUROPE 2019 CyberSecurity Maturity Assessment innogy SE · 30.03.2019 · Christoph Hagenbuch
- 2. innogy Group Security Content Aboutinnogy SE1 Motivation2 Approach3 Success4
- 3. innogy Group Security Thanksto our employees and customers … About innogy SE Source: innogy SE | Facts and Figures 2018 ≈42,000 EMPLOYEES 23 MILLION CUSTOMERS The average football stadium has around 42,000 seats. Converted to the equivalent of full-time positions. Equivalent to the population of Denmark and the Netherlands put together. Netherlands Population: ≈17 millions Denmark Population: ≈6 millions 3
- 4. innogy Group Security Sustainablegeneration of electricity Efficient distribution of energy Products and services for our customers Future business models Overview of our operations About innogy SE Renewables Grid & Infrastructure Retail New Businesses Source: innogy SE | Factbook 2018 Wind Hydro Solar (EPC/O&M/IPP) Grid assets Grid+ FTTx Commodity Energy+ eMobility Innovation Hub 4
- 5. innogy Group Security Content Aboutinnogy SE1 Motivation2 Approach3 Success4
- 6. innogy Group Security Cybersecurity has an increasing importance Motivation For a successful and sustainable digitisation, CYBER SECURITY creates essential foundations and is therefore crucial for the PERFORMANCE and SUCCESS OF EVERY COMPANY. 6
- 7. innogy Group Security Thechallenges for cyber security have changed dramatically and are constantly increasing Motivation RISK ENVIRONMENT New and constantly increasing cyber attacks are omnipresent and have unprecedented dynamics. IT ENVIRONMENT IT environments are becoming increasingly complex and fast-moving. 7
- 8. innogy Group Security Maximumtransparency of cyber security measures is required: key parameters Motivation MATURITY EFFECTIVE- NESS COST 8
- 9. innogy Group Security Inaddition, specialists and decision makers do not always speak the same language Motivation Decision makers are obliged to set up an EARLY WARNING SYSTEM and need specific and COMPREHENSIBLE information instead of technical terminology A methodology is required to communicate QUICKLY and COMPREHENSIBLY the concrete need for action to the decision makers. 9
- 10. innogy Group Security TheCyber Security Maturity Cockpit enables Motivation The Cyber Security Maturity Assessment creates maximum transparency & enables decision makers to make optimal use of financial & human resources. The following questions are answered in an understandable way: What are we doing? What does it cost? How well are we doing it? Are we doing the right things? 10
- 11. innogy Group Security Content Aboutinnogy SE1 Motivation2 Approach3 Success4
- 12. innogy Group Security Highestpossible efficiency and considerable savings Approach CSMA makes it possible to achieve the optimum between the accepted residual risk and the resources used, thus ensuring a considerable increase in efficiency and cost reduction. 1 2 3 Targeted reduction of the cyber security risk through transparency about maturity levels and adaptation or implementation of appropriate cyber security measures Reduction of overlaps, redundancies and over- or underachievement of self-defined degree of target maturity depending on risk appetite The resources used achieve the desired degree of maturity with the lowest total expenditure. The optimum between the accepted residual risk and the resources used is sustainably achieved Underfulfillment Optimum Overfulfillment Overall effort (€) = Risk + Resources Risk (€) Resources (€) 1 3 2 12
- 13. innogy Group Security Analysisof all cyber security measures Approach Measurement of maturity & effectiveness per measure Economic Efficiency Analysis Cost Maturity/effectiveness Optimal economic efficiency Optimise economic efficiency Critical economic efficiency 13
- 14. innogy Group Security ExemplaryCyber Security maturity actuals and planning Approach Current Cyber Security maturity [%] 1% – 39% Initial 40% – 59% Repeatable 60% – 79% Defined 80% – 94% Managed Optimised Company overview Control Global DE UK NL PL CZ SK CA.05 Information security policies 79 79 79 79 79 79 79 CA.06 Organisation of information security 80 80 79 80 80 81 80 CA.07 Human resources security 67 62 59 62 60 84 72 CA.08 Asset management 53 52 52 52 51 58 55 CA.09 Access control 65 62 59 63 60 79 68 CA.10 Cryptography 80 80 78 80 80 78 82 CA.11 Physical & environmental security 81 80 80 80 82 84 80 CA.12 Operations security 68 66 67 65 68 72 72 CA.13 Communications security 68 65 67 67 65 73 69 CA.14 System acquisition development & maintenance 49 43 54 43 48 62 43 CA.15 Supplier relationships 71 71 75 71 67 71 71 CA.16 Information security incident mgmt. 82 85 78 84 74 84 85 CA.17 Information security aspects of BCM 79 80 80 80 78 75 80 CA.18 Compliance 72 71 74 71 66 76 71 Total ø 72 70 70 70 68 75 72 Cyber Security maturity planning [%] 62 69 7280 0 20 100 40 60 Jan 18 Dec 18 Jun 19 60 Mar 18 Jun 18 Sep 18 Mar 19 Sep 19 Dec 19 Target: 80 Planning Actual CSMA methodology and tool awarded with the Security Innovation Award. Fictitious example 14
- 15. innogy Group Security Effectivityupdates of local services have very little impact on Total effectivity Approach Evaluation Level Example: Impact of ATP on effectivity CSMA evaluation Aggre- gation Global (all control areas, all countries) Sub-control • Average of control areas across units • New: 69% • Average of all control areas in GER • New: 68.59% • Average of all controls in GER • New Effectivity for A.12: 67% • Average of sub-controls • New Effectivity A.12.2: 80% • Evaluation of services in sub-control • New Effectivity A.12.2.1: 80% Services • Maturity for ATP service: 80 100 Increase of service effectivity Control Control area Total (all control areas per unit) 15
- 16. innogy Group Security Objectivationof maturity judgement Approach CSMA TODAY Expert knowledge based (feeling) Attendees change from time to time Subjective CSMA TOMORROW Make CSMA more constant/objective Add Simulation features & unit & control weighting Save time by automation 16
- 17. innogy Group Security Content Aboutinnogy SE1 Motivation2 Approach3 Success4
- 18. innogy Group Security TheSCMA makes us successful Success UNIQUE TRANS- PARENCY CYBER SECURITY … methodology based on ISO 27001 … awareness & communication increased … budget & human resources increased by factor 2 18
- 19. innogy Group Security Q& A Questions & Answers
- 20. innogy Group Security CHRISTOPHHAGENBUCH Cyber Security Management Phone +49 (0) 201 12 21610 Mobile +49 (0) 152 09053637 Email christoph.hagenbuch@innogy.com innogy SE Opernplatz 1 45128 Essen – Germany 20