1. Successful Information Security Governance
Pitching, Integrating, Governing and Succeeding the
Information Security Governance Project
Brian D. Huntley
P.E., PMP, CISA, CISSP, CBCP
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

2. Learning Objectives Information Security Governance
Program Development
Program Management
Risk Mitigation
Closing known control gaps
Continuous Service Improvement (CSI)
Event, Incident, Problem Management
Information Security Program Projects
Originating drivers, triggers, and influences
Special challenges = f (Origins)
Challenge : Response Tactics
Project Management Body of Knowledge (PMBOK®)
Information Technology Infrastructure Library (ITIL®)
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

3. Information Security Governance
“Governance ensures that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritisation and decision making; and monitoring performance and compliance against agreed-on direction and objectives.” COBIT® 5 © 2012 ISACA. All rights reserved.
Information Security Program Development
“Management plans, builds, runs and monitors activities in alignment with the direction set by the governance body to achieve the enterprise objectives.” COBIT® 5 © 2012 ISACA. All rights reserved.
Information Security Program Management
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

4. Drivers, Triggers, and Influences
Information
Security
Program
Development
Management
Expected ↓
Known
Planned
Unexpected
Unplanned
Unknown
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

5. Information Security Project Challenges
MUST Deliver On Time and On Budget!
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

6. Challenge : Response Tactics
▪ Enterprise-Wide Scope
▪ Precise tactics demanded, on a large scale.
Response:
▪ Task Decomposition
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

7. Task Decomposition Example
“The company will……
plan,
design,
agree and approve,
fund,
develop, and
..implement an Information Security Program…
A corporate Information Security Program policy
A set of information security policies
An information assets inventory
An information security controls inventory
An Information Security Risk Assessment
An information security Incident Response Plan…
..by…
May 1, 2013
July 12, 2013
August 30, 2013
September 25, 2013…
..December 31, 2013.”
Hypothetical
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

8. Challenge : Response Tactics
▪ Heavily-matrixed human resources
▪ Multiple competing interests
▪ “The company will agree……”
Response:
▪ Governance Stakeholders Mapping
“Circles of Influence” Model
Project Governance Diagram
Responsibility Assignment Matrix (RAM)
Also –
“Linear Responsibility Chart” (LRC)
“RACI Matrix” (or “RASCI Matrix”)
- Responsible, Accountable, Supporting, Consulted, Informed
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

9. Circles of Influence Model
Assign people to groups (“circles”) as a function of their relative influence
Increasing Influence
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

10. Project Governance Diagram
Project Steering Committee
Enterprise
Initiative(s)
Other
Project(s)
INFORMATION
SECURITY
PROJECT
Team(s), Department(s), etc. ? ?
Team(s), Department(s), etc.
Individuals
Inputs to Project
Outputs of Project
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

11. Responsibility Assignment Matrix (RAM)
Responsible, Accountable, Supporting, Consulted, Informed
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

12. Challenge : Response Tactics
▪ Meaningful communications and status reporting
80%!
(False Positive)
Response:
▪ Earned Value Analysis (EVA)
High SWAG
How much is done?
48%!
(On schedule,
On budget)
Measured Response
Low SWAG
Only 10%...
(False Negative)
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

13. Challenge : Response Tactics
Planned
Minimal Funding
≈ Longer Timelines
Unplanned
“BAU” Budget
Short Timelines
Response:
▪ Planning With Uncertainty –
▪ Selection of Project Execution Method
Crashing → Spiral Development → Waterfall Method
Time
Cost
Uncertainty
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

14. Selection of Methodology
Waterfall Method
Spiral Development
Task 1
Task 2
Task 3
Task 4
Task 5
Crashing
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

15. Summary
Successful information security governance requires planning and execution of projects to develop and manage the Information Security Program.
Use thoughtful selection and deliberate application of structured project management tactics to meet the unique challenges of the Information Security Project.
Plan your work, and work your plan.
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.

16. Brian D. Huntley P.E., PMP, CISA, CISSP, CBCP bhuntley@gwi.net
11/19/2018
© 2013 Brian D. Huntley, P.E., PMP, CISA, CISSP, CBCP
Reproduction and distribution rights granted to EGRC and NMI LLC.