Downloaded 18 times
Uploaded byCISOSHARE
Top Tips on Choosing a vCISO
The document outlines the key considerations for choosing a virtual Chief Information Security Officer (vCISO), an outsourced security role pivotal for leading cyber security programs. It emphasizes five steps: educating oneself about the organization's needs, assessing the current security state, exploring options for the vCISO role, communicating findings to stakeholders, and making an informed decision. Additionally, it describes various service providers and stresses the importance of understanding budgetary constraints and different outsourcing models.
Top Tips on Choosing a vCISO
- 1. And What YouNeed to Know Beforehand Top Tips on Choosing a vCISO @CISOSHARE
- 2. What is aVirtual CISO? An outsourced security role to lead your cyber security program. Copyright © 2019
- 3. Why Use aVirtual CISO? • You need an interim security leader as you build an internal team. • You’re outsourcing security entirely. • You need support in improving your security program. There are no wrong reasons, only different business goals. Copyright © 2019
- 4. 5 Steps to Choosingthe Right vCISO: 1. Educate Yourself 2. Understand Your Current State 3. Determine Your Options Moving Forward 4. Tell the Story 5. Make a Decision Copyright © 2019
- 5.
- 6. STEP 1 Understand thebasics of your organization: Why do you want to improve cyber security? What problems will you face without the right program? What requirements does your organization have to meet? Copyright © 2019
- 7. Explore your implementationoptions: Outsource everything in your security program. Only outsource the CISO role and hire an internal security team. Hire an internal CISO and outsource roles to a service provider. Anything in between! STEP 1 Copyright © 2019
- 8. Evaluate available securityservice providers: Professional services consultants These teams offer project-based contracts, including vCISO services. Managed security service providers True service providers offer ongoing role and process performance to clients. One-person CISO consultancies These are individuals you can use to perform the CISO function. STEP 1 Copyright © 2019
- 9. Everything in securitywill have ongoing capital and operational costs. Don’t forget to factor in foundational costs, resource costs, and any necessary technology costs. Understand your budget and cost savings. STEP 1 Copyright © 2019
- 10. STEP 2: Understand Your CurrentState Copyright © 2019
- 11. • Alignment tobest practices and security regulations • Foundation and process maturity • Existing resource capability • Existing remediation items and security roadmap • Security architecture and data map • Susceptibility to attack Understand key areas of your security program: STEP 2 Copyright © 2019
- 12. Different ways tomeasure your current state: Internal assessment using your own team External assessment through a consultancy Potential security service providers Utilizing a previous customer assessment STEP 2 Copyright © 2019
- 13. STEP 3: Determine YourOptions Moving Forward Copyright © 2019
- 14. STEP 3 1 Whatthe option is, so people can quickly understand it. 2 The annual capital and ongoing costs of each program option. 3 The foundational elements that will be built. 4 The resource elements and whether they’ll be internal, outsourced, or a combination of the two. 5 Any security architecture technology that might change or be added. 6 How the option will maintain or improve your current state. 7 Any pros and cons for each. Copyright © 2019
- 15. STEP 4: Tell theStory Copyright © 2019
- 16. Use everything you’vegathered from your research, your current state, and any service providers you’ve found. Explain the needs of your security program. STEP 4 Copyright © 2019
- 17. Educate your upstream decision-makersand make a case for each option. STEP 4 Copyright © 2019
- 18. STEP 5: Make aDecision Copyright © 2019
- 19. Turn each optionon the table into specific and actionable next steps. The more work you’ve put into the previous steps, the easier this one will be. STEP 5 Copyright © 2019
- 20. Want More Decisions? DownloadOur Guide to Selecting a vCISO! Copyright © 2019
- 21. Go Out Thereand Find the vCISO that will Improve Your Security Program! Learn More About Our vCISO Services @CISOSHARE Copyright © 2019
- 22. @CISOSHARE Copyright © 2019 Basedin Southern California and serving organizations globally, CISOSHARE is the leading provider of security program development, professional, and managed services for leading and rapidly-growing organizations. Learning and teaching lies at the core of CISOSHARE’s culture, focusing on educating employees and clients about information security through our services. CISOSHARE offers managed security program services, role-based services, security architecture, incident management and response, and more. About CISOSHARE www.cisoshare.com | info@cisoshare.com | +1-800-203-381