1. Security Operations Update
{Month/Year}
CONFIDENTIAL

2. Agenda Security Program News Projects Looking Forward
Updates from last meeting
Completed, ongoing, new
Recent developments
Effect on risk metrics and controls
Concerns
Looking Forward
Security Operations Metrics
Next X Days
Security operations
Audit and compliance
Risk drivers
People, process, technology

3. Security Program News
{This will cover anything new that has occurred since your previous update.}

4. Since the Last Meeting Action items (if any, from last meeting)
Security environment changes
Business developments
Industry or regulatory developments
Concerns
High level – reasons will be discussed in following section

5. Security Operations Metrics
{There are more metrics slides here that you will want to use. They are meant to be illustrative of how to show security operations performance, risk and controls.}

6. Security Operations Metrics
Scorecard: Consistent (meeting over meeting) security metrics without jargon.
Current measure, status and trend for all metrics.
Adjust these metrics for your environment.
There should be a governing security KRI.

7. Security Operations Metrics
Governing security KRI trend
Explanation (next slides)
Organizational risk contributors
Risk metrics and drivers
Easy-to-spot risk trend

8. Security Operations Metrics
Risk Contributors: Where in the organization is risk concentrated?
Metrics breakdown by organization contributor.
Use the same metrics as on the scorecard.

9. Security Operations Metrics
Risk Matrix: An alternative view of overall risk contribution.
LIKELIHOOD
HIGH
LOW
IMPACT
SUPPORT SERVICES
Metrics breakdown by organization contributor.
CORE SERVICES
Focus attention on business problem area.
MARKETING
MANUFACTURING
DEVELOPMENT
EXECUTIVE ADMIN
HARDWARE

10. Compliance Metric (% controls, findings, etc.)
Audit and Compliance
Included in risk scorecard
Compliance challenges
Last audit: mm/dd/yy by ___________
Significant findings
Compliance Metric (% controls, findings, etc.)

11. Clear indication of trend over time.
Risk Drivers: People
Observation
Rate of severity for outbound access has been increasing over the past week
Metric
Event severity trend
Actions Taken
Improved rules in defenses, but increase still occurring
Suggestion
Target people with highest risk profile and have them go through a training course
Clear indication of trend over time.

12. Show Process Metrics by organization/function
Risk Drivers: Process
Observation
Time to patch has reduced
Metric
Compliance by Department
Actions Taken
Analyzed which org units were most behind
Suggestion
Internal training
Meeting with middle management to get buy-in for employee machine reboots, stronger enforcement of security patch reboots
Show Process Metrics by organization/function

13. Risk Drivers: Controls
Identify
Protect
Detect
Respond
Recover
Total
Devices 5 9 6 2 22
Apps 4
Networks 7 8 33
Data 1 16
Users 17 25 13 10
75/250
Observation
Risk controls concentrated on network, devices and data
Users and apps largely unprotected
Limited response and recovery capabilities
Metric
Cyber defense matrix (defense in depth)
Actions Taken
Implemented end-point protection on devices
Suggestion
Address users and apps next
Then work on improving overall control maturity
Ratings represent technologies and processes
Scores can also be plotted over time.

14. Projects
{These should align to the metrics shown and objectives discussed.}

15. Project Status Maps to Risk Metrics Report Project Status Date %
Compliance
Controls
Metric(s)
Network Segmentation
Complete
1/1/17
100
PCI DSS Scoping
NW - Prot
Corporate Intrusion Protection System (IPS)
In Progress
4/1/17 50
CSC 12
Defenses
BigFix Endpoint Management
6/1/17 25
PCI
Dev – Det/Prot
Defenses Surface Area
Maps to Risk Drivers – Controls Table

16. Looking Forward
{What to expect by the next update.}

17. Next X Days Business operations impact(s) Training
Project 1
Type (security awareness, phishing, etc.)
Project 2
Audits / GAP analysis
Dates
Type (SSAE 16, PCI, FFIEC, ISO, etc.)
Other
Participants (vendor, departments, executives, others)
Dates (audit, report, etc.)

18. Backup

19. What You Should Not Do
Technical Jargon
Statistics
No Business Context