Create a Comprehensive InfoSec Plan in 9 Steps

© Eze Castle Integration | 1
9 Steps to Create an
Information Security Plan

Table of Contents
1. Regulatory Review and Landscape
2. Governance, Oversight, Responsibility
3. Take Asset Inventory ………..
4. Data Classification and Protection
5. Evaluating Available Security Safeguards
6. Perform a Cyber Risk Assessment
7. Perform a 3rd Party Risk Assessment
8. Create an Incident Response Plan
9. Training and Testing Employees
Step
Step
Step
Step
Step
Step
Step
Step
Step
………………………………………………………………………3
………………………………………………….…………..4
……..………………………………………………………………….……….5
………………………………………………………………………6
. ………………………………….……………………….7
….……………………………………………………………………8
.………………………………………….………………………9
…….……………………………………………………………….10
…………………………………………………………………………11

In today's changing regulatory and investor landscape, Information Security Plans are critical
for firms to comply with Securities and Exchange Commission (SEC) regulations, due
diligence requests and state laws in addition to increasingly more common and more
sophisticated cybersecurity threats.
To preface, it is important to know what an Information Security Plan is and why your firm
needs one. An information security plan is documentation of a firm’s plan and systems put in
place to protect personal information and sensitive company data. This data can include
anything from investor information and data to employees’ personal information.
Having an information security plan can mitigate threats and risks against your organization
and its data, help your firm protect the integrity, confidentiality, and availability of the data, and
provides processes so your firm will know what to do if a data breach or incident were to
happen.
Aside from protecting the integrity of your data and keeping it confidential, there are other
legal reasons to have an Information Security Plan in place. As previously mentioned, any firm
that is registered with the SEC is required to have one in place. There may be other state or
industry specific regulations your firm must adhere to as well. This is why the first step in
creating an Information Security Plan is performing a Regulatory Review and Landscape.
Overview

Step 1: Perform a Regulatory Review and Landscape
The first step to creating an Information Security Plan is to perform a Regulatory Review as all
businesses have requirements coming from oversight bodies including:
• International Bodies, such as the EU General Data Protection Regulation (GDPR)
• Federal Agencies, such as the Securities Exchange Commission (SEC) and Financial
Services Authority (FSA)
• State Agencies, such as MA’s PII Regulation (201 CMR 17.00)
• Industry Oversight, such as FINRA and National Futures Association (NFA)
There are also self-imposed industry standards and expectations that come from external
stakeholders including:
• Investors, who will have standard due diligence questionnaires and reporting
expectations
• Auditors, who will have frameworks to be followed
• External Partners

It is important to note that everyone in an organization has a role in information security. Your organization
should create a highly trained and specialized group of people who are responsible for making sure the
company follows the policy and procedures around the information security plan. This team can go by
several names; CIRT (Computer Information Response Team) and CISRT (Computer Information Security
Response Team) are two common names.
This team is made up of members of your firm that have other functional roles within an organization. It is
best practice to have members from different departments, for example, the Compliance, IT, Finance,
Human Resources, and Communications.
The CISRT is responsible for:
While the CISRT has an important role to oversee the governance of the Information Security Plan, all
employees within the organization are expected to be aware of and comply to relevant policies,
procedures, and guidelines, report any suspicious activity, and attend annual trainings.
Step 2: Specify Governance, Oversight & Responsibility
Responding to computer incidents
Managing and facilitating the communication for any breaches or updates in policy
Notifying regulatory agencies, state agencies, etc. for any breaches
Overseeing governance of Written Information Security Plan policies and procedures

Know what you have. Having an idea of what your firm has in terms
of assets will give you a good baseline for creating your information
response plan and can help you identify any potential vulnerabilities.
This includes inventorying hardware and software as well as
identifying existing safeguards and controls you have in place. A
best practice is to maintain a running list of: workstations, servers,
applications, and smartphone devices such as phones, tablets, and
laptops.
Often forgotten on this list are other devices that store information
(phones, printers/copiers, etc.) as well as the growing collection of
Internet of Things (IoT) systems including conference call
equipment, wireless speaker systems, and the like. Anything
connected to your firm’s network should be inventoried and
cataloged.
Why, you ask? Because you can’t properly assess your firm’s level of
risk or adequately protect data and information unless you
understand what systems you have and what data they hold.
At the bare minimum, firms should conduct an annual review cycle
of all IT assets to understand if there have been additions, deletions
or changes in how that technology is managing data and what
controls are in place to protect it.
Step 3: Take Inventory of Assets
PRO TIP
Although this step may be
a partially manual process,
there are software
applications and scanning
tools that can make the
process easier.

Identify what data is important and what needs to be protected. There are different types of data a firm may
have access to:
The first two types of data are legally required to be reported to the Security Exchange Commission if there
is a breach. When writing an Information Security Plan’s policies and procedures, an organization should
cover:
• Where the information resides;
• Who has access to the information;
• How the data is stored, removed or transferred; and
• How the data is protected.
Step 4: Classify Data
Personally
Identifiable
Information (PII)
According to the U.S.
General Services
Administration – PII is
information that can be
used to identify an
individual’s identity,
either when the
information is alone or
combined with other
identifying information
that is linkable to an
individual.
Protected Health
Information (PHI)
The HIPPA Privacy Rule
defines Protected Health
Information as
demographic
information, medical
history, test and
laboratory results,
insurance information
and other data that
healthcare organizations
and professionals store
and have access to.
Non-Public
Information (NPI)
The Federal Trade
Commission defines NPI
as any personally
identifiable financial
information.

There are available security frameworks to help firms map out
their approach to their Information Security Plan. The National
Institute of Standards and Technology (NIST) provides a
Cybersecurity Framework that can be a starting point for firms,
however it is important to note that the needs of every business
are different, and aspects of the NIST Framework may not be
applicable to your organization.
It is important to reiterate that employees are considered the first
line of defense, and it is crucial to make them a security asset
instead of a security risk. Forcing employees to have strong
passwords, providing phishing and training for employees, and
regular cybersecurity training helps create an internal culture of
security.
Firms should also evaluate what solutions and controls can be
added by their IT vendor to enhance security. Additionally,
discerning what is overkill and what is necessary can be
challenging, so having a trusted partner or vendor can help you
discern and prioritize regulations specific to your organization in
addition to providing additional safeguards.
Step 5: Evaluate Available Security Examples of NIST Framework
IDENTIFY:
• Cyber Risk Assessments
• IT Audit
• Network Inventory
PROTECT:
• Access Control
• Next-Gen Firewalls
• Endpoint Protection
• Encryption
• Patch Management
• Mobility Management
• Info Security Training
• Phishing Tests
DETECT:
• Intrusion Detection & Prevention
• Penetration Testing
• Vulnerability Assessments
• Continuous Security Monitoring
RESPOND:
• Incident Response Planning
• Remediation Services
RECOVER:
• Backup & Recovery
• Disaster Recovery
• Security Policy Audit & Maintenance
Identify Protect Detect Respond Recover

Performing a cybersecurity risk assessment is crucial to understanding the cybersecurity risk to the firm’s
operations, functions, and assets. Typical steps associated with a vulnerability scan or assessment include:
• Identifying all appropriate systems, networks and infrastructures;
• Scanning networks to assess susceptibility to external hacks and threats;
• Classifying vulnerabilities based on severity; and
• Making tactical recommendations around how to eliminate or remediate threats at all levels.
As part of the process you will want to identify and document the following components:
• Asset Vulnerabilities
• Internal vs. External threats
• Potential Business Impacts & Likelihoods
• Potential Control
• Appropriate Risk Responses & Remediations
Your risk assessment doesn’t have to be overly complex or robust. Start with the basic risk assessment
considerations and then your risk assessment plan can evolve as your organization grows and matures.
Step 6: Perform a Cyber Risk Assessment

Performing a third-party risk assessment on an annual basis is an essential part of your Information Security
Plan. As more firms outsource business functions, it is imperative to set expectations with your partners,
vendors, and providers so that everyone is on the same page.
Eze Castle Integration suggests having a process and checklist in place to make sure your firm is
establishing acceptable third-party management guidelines.
Ask the following questions:
If your vendors undergo an audit, you can ask for that information. For example, Eze Castle Integration
undergoes an annual SOC2 audit of our cloud services.
Lastly, review critical vendors on an annual basis to see if any practices have changed. If practices don’t live
up to your firm’s data privacy standards, it may be time to find another vendor.
Step 7: Perform a Third Party Risk Assessment
How are third parties storing data?
How long are they storing data for?
What employees can access it?
Are they testing and training their employees?
How often do they perform security and penetration testing?

Creating a realistic Incident Response Plan that is relevant and
attainable for your organization is crucial, because it is not a
matter of if – but when – a cybersecurity incident will happen.
All Incident Response Plans are different and relative to the
organization’s specific business. The key factor in your Incident
Response Plan is that it is realistic to your firm, as well as the
vendors and partners that have a stake in your response.
Engage with other partners internally from all departments, such
as:
• IT
• Operations
• Human Resources
as well as external partners, such as:
• Service providers
• Third-party vendors
• Clients
• Regulators
Step 8: Create an Incident
Response Plan PRO TIP
It’s not if, but when, a cybersecurity
incident will happen.
Communication is
critical during incident
response, and we don’t
just mean to employees.
There are a number of
third parties who will
also likely need to be
notified and kept abreast
of the firm’s situation,
depending on its
severity and potential
impact.
Select at least one
member of the CSIRT to
handle communication
on behalf of the firm – to
notable and affected
investors, third party
service providers, and
regulators.

To reiterate, making your employees a security asset instead of a
threat is an extremely important part of your Information Security
Plan. Follow the following steps to ensure your employees are an
asset instead of a threat:
• Educate employees by having training throughout the year
• Review individual roles and responsibilities within the
organization at least once a year
• Evaluate incident management procedures yearly and
communicate any changes to employees
• Have a formal training or educational curriculum as well as
activities
• Deploy annual or bi-annual phishing simulations and training
Step 9: Training and Testing
Employees
PRO TIP
Conduct annual
tabletop and simulation
exercises to ensure
employees are
effectively trained.
These can be in-person
or virtual seminars but
should bring together
department
representatives across
the firm to enable swift
business recovery in the
event of a business-
impact scenario.

Create a Comprehensive InfoSec Plan in 9 Steps

Recommended

Recommended

More Related Content

Similar to Create a Comprehensive InfoSec Plan in 9 Steps

Similar to Create a Comprehensive InfoSec Plan in 9 Steps (20)

Recently uploaded

Recently uploaded (20)

Create a Comprehensive InfoSec Plan in 9 Steps