NIST CSF 2.0 Unleashed: Get Past the Gaps and Boost Your Results - WEBINAR - Reveal Risk

NIST CSF 2.0 Unleashed: Get Past the Gaps and Boost Your Results. My name is Jeff Mann. I'm a physical threat intelligence analyst with the Health ISAC, and I'll be introducing today's speakers from Reveal Risk. Today we will be hearing from Aaron Pritz, Chris Adix, Michael Milroy, and Eugene Korlov. This webinar will be recorded and sent to attendees following the presentation. And with that, I will let our presenters get started.

All right. Thanks everyone for having us. My name is Aaron Pritz and longtime ISACA member. I was at Eli Lilly Pharmaceutical Company for 17 years and got the pleasure to be introduced to the Health ISACA on that side of the table. Really love the community, the sharing such as this, and really the community that I built is still active for me. So really can't say enough good things about this organization. And there's a reason why this is our number one sponsor event now that I'm on this side of the table, because I see the value of sharing and specifically to pharma, life sciences, healthcare, biopharma, just really have a lot of passion for that. So with that, if we can go to the next slide, I'll do a quick intro to the team just so we can get right into it, and then each of them will tell a little bit about themselves and their unique backgrounds. None of us come from a career consulting background, so that's one of our unique things. But like I said, long time at Eli Lilly, 17 years, got a chance to do really, really cool things across privacy, audit, cybersecurity, risk management, and then co-founded Reveal Risk in 2018 with Tim Sewell, who has a background in Mayo Clinic and another healthcare ISAC member. Chris Adix joined us several years ago, background from Merck, CR Bard, Bechtel Dickinson, and Catalent Pharma Solutions where we met him. And then Michael Milroy, heralds from the US Marines doing cyber intel, signals intelligence, and also did some work for the state of Indiana before joining us. And then Eugene Korolov, tenured career in the Navy, still active as a reserve, and has been doing cyber across a number of different corporations, including Lilly as well. With me, slight overlap, before joining us more recently. All right. So let's go ahead and get started. Today's talk, Chris and I were actually talking with Terry Morris— sorry, Terry Rice earlier in the year, which Chris worked with while at Merck. And we asked, has anybody really come into the Health ISAC and talked about NIST CSF 2.0? We're all focused on it. Most of companies have pivoted. Chris and I have a lot of passion for kind of getting beyond the checkbox of a framework and really getting into the strategy and action and really executive influence to help cyber practitioners drive value and the necessary actions within their program. So we'll talk a little bit about our journey. I think I've already covered that piece. And then we'll talk— Michael's going to give a, a brief crash course on the CSF 2.0, and whether you have already pivoted your, in the process of pivoting or you're brand new to NICS, hopefully there's something in it for you and you can take away some good insights and ask questions on things that you have or questions that you have. We actually— Chris was our contributor to the review cycles last year and leading up to the approval early this year, and we've been using the draft framework since about Q3 last year. So hopefully with experiences across this sector and, and other sectors as well, be able to provide some best practices. And speaking of that, Eugene Korolov will help us through some of those best practices. And then Chris and I are going to bring it home with kind of to that, that initial thing that drives us, like getting success beyond the NIST CSF assessment, figuring out your number. A number is just a number. How does that transcend into your strategy or roadmap and beyond? So we'll end on that, and we'll try to save time for questions at the end. If you do have questions, please put them into the chat. Bronwyn is going— and Jeff from ISAC is going to be helping us man that. So long story short, I think I've already talked about a lot of our backgrounds, but again, we are— we pride ourselves on having been on your side of the table, and none of us are career consultants. We are individuals that love to help others but have grown up as career practitioners. In cyber and leadership on the pharma life sciences side. So this drives us, this drives everything that we do. And that's been our journey, like, like mentioned, from a corporate practitioner to like a consultant advisor. So with that, I'm going to— we're going to move on to the crash course and, and Michael, take it away.

All right.

Thank you. Again, my name is Michael Milroy. I've been here with Reveal Risk about 3 and a half years. Like Aaron mentioned, my background, Started out, uh, doing IT and networking security, uh, through school, and then joined the Marine Corps, signals intelligence, cybersecurity, uh, operations. And then, uh, short, quick pivot over, got my degree in psychology from Purdue, um, and then went and did project management, process engineering for the state of Indiana. And then from there pivoted back into cyber, joined Reveal Risk, kind of tying together the, the business acumen and the technical chops there. And I've been focused a lot on program assessments, risk management, process design as well since I've been here. So getting into the, the NIST CSF in general. So just real quick for those who may not be familiar with it, NIST CSF originally came out early 2014. They spent the next few years gathering a bunch of feedback from across the industry, across multiple industries. And when it first came out, it was really focused on critical infrastructure or organizations. 2018, there was the release of the 1.1. They really tried to make it more flexible, a little more clear to understand, adding in things like more focus on identity management, supply chain assessments, and starting to touch on governance. But here in 2024, they released the 2.0— excuse me, the 2.0 version. With this, there's some more significant structural changes that came with it. We'll get into those here in just a minute. But overall for the NIST CSF, so the objective is to provide guidance on consistent best practices through outcome-based actions. And that outcome-based actions is really important because no one wants to give nor be given a list of things that are wrong and told to just go fix them. So throughout the iterations of CSF, they've gotten a lot more concise on how to actually go about implementation and improvements for the organization. And then the approach, so kind of have this 4-step approach here. So understand and assess, really starting out when you jump in with NIST CSF, the goal is understand where your organization and where your program currently is. Once you know where you're at and you're able to identify gaps, then you want to prioritize those, making sure you're hitting those core foundational components up front as opposed to things that really require a lot of prereqs or other enabling initiatives to be done first, and then communicating that out across teams, departments, across the broader organization. OCM, organizational change management, is a critical piece to every initiative, especially when it comes to cyber. Make sure we play nice with the rest of the business and everyone really understands what we're doing and why we're doing it so that we can actually be enablers for the business, not blockers. All right. So NIST CSF, the 2.0. So getting into the actual structure of it. So NIST has released two main types of profiles, the organizational profile, which takes you from where is my organization now and where do I want it to go? So it's really a current state, future state approach with a profile, community profile, kind of broadening that out and saying, where is the rest of my industry at today? This is, this is something that was definitely lacking in the 1.0, 1.1s. If you think the Cyber Risk Institute came out with the FS profile for the financial financial sector, really they just got together and said, what is NIST? What are the gaps in the NIST CSF for financial industry? They kind of made their own additions to the CSF there, and that was known as the FS Profile. They actually played a very large role in helping draft the, the 2.0 as well. So things like those industry-specific gaps from before have— they had intentional effort and drove a lot of the improvements in here, so they're actually more accounted for throughout. Getting into the tiers. So NIST CSF gives you 4 tiers, 1 through 4: partial, risk-informed, repeatable, and adaptive. However, what, what we do, what we've seen more often than not, is the tiers from CMMI are actually used more often in, in practice. Sorry, one sec.

Yeah, and I'll add many times with consulting companies, they will have their own proprietary scoring method. As I learned on the practitioner side, and as Chris and I have, we, as we've designed this program, we don't believe that any company should adopt a proprietary method because then you're stuck with that firm's methodology. So CMMI I think it has such broad reach and use because it is a multi-sector and industry and, and, and approach measurement tool with Carnegie Mellon. And it's also fairly known at the executive level. So we've, I've always used this even back on the, on the pharmaceutical side. It's consistent, people understand it. And, and there are some companies that use NIST default 1 to 4. We just don't see that very often, and we push for something that is very easy to understand and ubiquitous across industries.

Yep.

And then just to touch on the tiers at a high level, so really just think of it with initial, there may be processes and practices in place. However, they're not formal, they're not documented, they're not measured, very rarely like formally improved. And then as you go through Manage to Find, You start adding in projects to improve those, documenting the process, getting governance in place around the process, making sure they're tailored for your organization. Get into metrics, reporting, KPIs, and then the optimize— you're really focused on continuous improvement through intentional strategic initiatives. And then the, the other thing that's been added here to the, the 2.0 is something that I think everyone has been asking for ever since, since the inception of SDSF, but giving implementation examples. Again, this is historically— the CSF has been historically vague and extremely high level and hard to read in a practical way. So in the 2.0, they've, they've made a huge effort in making concise examples and making them practical so that you can, you can read a description and say it's not just you need policies in place, it's you need a cybersecurity or information security governance policy in place, identifying stakeholders, business initiatives, and the strategy moving forward. So that's a huge addition that came in here. And then again, with those that action-oriented, that the outcome-driven activities with that. Next, we have the functions. So originally NIST CSF was 5 functions: identify, protect, detect, respond, and recover. However, in this 2.0 version, they have teased Govern out, made it— finally made it its own function. So a lot of, a lot of subcategories from the other functions were moved over into that, which really gives the, the intentional focus that governance deserves to maintain a program. And then just looking through these, Govern, you want to drive the standards, identify how are you going to find vulnerabilities, risks, threats. Protect through proactive actions, detect by finding those threats, responding and taking action, and then recover. How are you going to fix things and what— how are you going to learn from it for next time? The biggest functional changes that, that have been added to the NIST. So again, we already talked about govern as a new function, really puts an intentional connection to enterprise risk management strategy. That's definitely something that has been lacking before. So making sure that it integrates with the business risk overall, and then a more significant focus on cyber chain. Excuse me. Yeah, adding executive oversight to the cyber chain as a supply chain as an attack vector, especially here over the last couple of years, and definitely since NIST was first released. Supply chain has continued to be an increasing attack vector. So it's great to see focus put on that. As we move to Identify, they really focus on continuous improvement now. So again, intentional initiatives to improve your overall program. Protect, we added— they added a platform security to focus on hardware, software, services vulnerabilities, infrastructure resilience for business continuity. And then respond and recover. Again, mostly focused on making, making this section much more practical and including some tactical focus on those as well. And then for your organization, thinking of NIST maturity as a journey. So as you go through, no journey through this is the same for any organization. You're going to be facing different, different obstacles and difficulties. But there are 4 main things that we see that really need to be focused on and at the forefront of your mind while you're doing this, this growth. So the investment hurdle, as you, as your organization grows, as maturity increases, there's going to have to be investment. I think everybody knows that. Nobody really likes it, but it does have to happen. But with that, knowing that that investment is not always a 1-to-1, you could spend $20,000 to go from maturity level 1 to 2, but that $20,000 is not going to get you anywhere near the same outcomes when you're looking at moving from a 3 to 4. So just keeping that in mind. Control coverage as your organization grows, wanting to make sure that the controls grow with the organization as well. And this is, you know, as maturity goes, maybe you're focused on a couple core components or core departments, But as you increase in maturity, you want to make sure that the coverage goes across the organization. For technology and investments, so again, higher maturity, they often come with more specific technology— technological needs. So you're going to be looking at more expensive tools for the most part, and then processes to go along with those. And then for the organizational growth, already hit on this, but as the organization grows, it is expected, even, you know, implied that your security program is much— is growing at the same time. So making sure that as the organization grows, you're not just sitting at a 1 or 2 all the time, but you are making those intentional improvements.

One example, just to jump in, is we've worked with a lot of companies that have mergers and acquisitions growth, and it's important in the broader strategic storytelling to the executives as you add different companies' assets, you may be going up or down in maturity. And sometimes you might start with two books of business from a maturity standpoint until you get them fully inculcated into that single organization or not. Sometimes those integrations don't happen in a full capacity. So the more complex the organization or the more it grows through M&A, the more challenging it can be to tell the story. And it's important to also say why you might be going backwards in maturity. And that doesn't mean that executives on the cyber side should be fired, and they won't be if you're telling that right story.

Yep, absolutely. All right. Getting in here, just kind of wrap up this, this, again, crash course, right? Very high level, but we really want to focus on the practicality here, for the rest of this talk. But lessons learned, some tips and tricks, starting with the most critical areas, just as NIST lays out, understand and assess is, is the first important piece that, to kind of start this whole journey. You have to understand where you're at and understand the gap so that you can prioritize most foundational piece, the biggest bang for the buck, what's going to enable more later down the road. But along with that, small progress is still progress. Everything doesn't need to be a massive jump. It may be easy to go from a score of a 1 to a 2, but a 3 to a 3.1 or 3.2 is still a significant growth. So just keeping that in mind as you go through. Also maintaining a program, not just assessments. So doing assessments are great. If you don't do anything with the results or use them as a lessons learned or, you know, drum up and approve initiatives to, to grow the maturity, then it really doesn't do any good. So making sure that it's maintained as a program and it's driving other initiatives in the organization. Just a couple of things to avoid. So when you're building the program, don't just build it around one thing. Some organizations will build an entire maturity program just based on this CSF, and depending on the size of your organization and the industry you're in, that could leave a huge gap in terms of actual security. So you want to make sure that you're looking at things like ISO, things like SOC 2 and the CICPA and things like that so that you have the appropriate coverage, you know, privacy, security, and the like. And then compliance, again, does not equal security. Just because you meet the checkboxes in a compliance assessment does not mean that your organization is secure or any less, less open to attack vectors. So just a couple of things to keep in mind there as we go along. But now I'll hand it over to Eugene to start the conversation on the best practices.

Thank you, Michael. Hello, everyone. Eugene Korolev. Been doing cybersecurity for the last 9 years. I have experience in both implementing and assessing controls. As Aaron mentioned, during my tenure at Eli Lilly, I worked on their third-party risk management program, bringing it to enterprise level. From there, pivoted to a Fortune 500 telecom company where I helped them digitalize their governance, risk, and compliance program and select a solution that would work for all the stakeholders. Also had experience with a small hospitality— not small, but a hospitality startup, about 1,000 people. Helped them mature their program from a startup mentality going to enterprise, enterprise assessments and following multiple frameworks. And been with Reveal Risk for the last year. So Michael, thank you for the great overview of, um, NIST. Okay, here we go. So, well, I would like to talk to you about best practices. And when we talk about best practices, uh, let's talk about what is— what would you like to see when you are conducting a NIST assessment? So I will walk you through the process, how we usually see it within the industry. So the first thing you want to start with is the scope alignment. When you are going to do an assessment, what is in scope? Are you doing it against your enterprise? Is there a specific product in, in mind, or is it broken down by business function? Once you have that scope aligned, that takes you to the next step. Next point is stakeholder engagement, because for your assessment to be efficient and for you to get the right answers, you need to have the right people involved. You also need to identify those executive sponsors who will help you make the people you need available to you and engaged. We all know we have competing priorities, so sometimes it has to be emphasized and it has to come from your executive leadership saying, saying this is important, please make time for it. Once you have that in place, We are moving on to documentation. As you are prepping for the assessment, whether you are doing it internally or you have external party that is helping you with it, you want to identify documentation that is in scope and you want to review it before the assessment. One thing that we encourage you to do would be, as you're going through the documentation through the policy and standards and you're seeing what controls have been prescribed, Differentiate between the ones that are aspirational and already implemented because sometimes policies and standards, the way they are written, they do not reflect where your organization stands and it might be a goal, but with the NIST CSF assessment, you want to be realistic. And then we jump to the assessment itself. Big thing, and I'm going to stump on this assessment. This is an assessment. This is not an audit. There is no pass or fail score You're not doing a witch-hunting exercise. You're not pointing fingers. In fact, it is an iterative collaboration between your team, your, the stakeholders that have been involved. It is truly a one team, one fight. You have to define where you are at. You have to agree on the goals where you want to be. And you will have to have working sessions with your stakeholders to peel the onion and understand how controls have been implemented, how how they have been prescribed and what the organization is doing, because it might not be implemented, but it might be on the roadmap, and you still want to account for that. As you're going, going through those working sessions, one thing to keep in mind: scoring criteria. That's a big one because it has to be uniform. It's really, it's really hard to be objective, and we tend to be subjective when we are grading our answers. So Your scoring criteria needs to be uniform. For it to be uniform, you have to communicate what are, what are the, those grades to all the stakeholders involved and set up also comparison to any previous assessments you have done. Because if your scoring criteria is off and you compare the scores, you will not be comparing apples to apples and you will get questions. I don't want to say unnecessary questions, but I would say unvalidated questions because your scoring model was not aligned. You cannot address all the gaps at, at the same time. So that's where prioritization comes into place. Once you have identified your opportunities for improvement, you have to make the decision. You have to answer the question: where do you get the best return on your investment? Sometimes you can address it by which subcategories are we going to address at first, and are we going to go for the ones that have the lower score. Also, it's not uncommon for you to uncover the biggest pain points in your day-to-day operations as you're going through those interviews. You might want to tackle those. It could also be that you're rating them based on your external factors like your customer requirements that you need to comply with. There could be some cyber insurance clauses that absolutely have to be in place. Again, that is yours, that is your decision as the organization that needs to be communicated and cannot be done in a vacuum. It also helps to have some external benchmarking. You want to show where you are against your peers and within the industry. And to summarize all of that, you want to put all of it in one document. It's— we call it a roadmap. All of you identify priorities. You want to map them against the timeline because, as I said, most of the time you don't have the resources. You don't have the manpower to tackle everything at once. So take the gaps, the opportunities identified, and put them on the timeline. Take into consideration resource availability, budget constraints, company initiatives, ongoing ones, as well as, you know, your business. So are there any seasonal or operation spikes that you need to account for as well? As you have the conversations with your executive team, you might get the question, how do we pull it to the left? How do we expedite it? And that's where you can drive awareness saying we can be done. But that's what we would need from you. So we talked about benchmarking. I wanted to drive some of this benchmarking examples home with a visual. A couple of things to keep in mind. As you look through this, you can, you can say, hey, NIST 2.0 just came out. There is not enough of data. So sometimes, yes, you will need to compare 1.1 to 2.0. As Michael walks us through it, they, the controls are pretty much the same. They changed how, which buckets they put them in, but it is the same. So it's still a valid comparison of 1.1 to 2.0. You would need to put an asterisk around it and communicate it, but do not throw away your 1.1. It's, it can still be used as a benchmark. And then aggregate maturity. And what I mean by that, when you are doing the benchmarking, You don't want to break it down by subcategories, categories. Keep the, the score high level. What it allows you to do, the benchmarking like this, this is your opportunity to tell the story, the, the, the story of your maturity journey. Where have you been, where you are at, and what is your goal? You can highlight the progress you have been able to, to achieve so far. And it also your opportunity to ask for support in pursuit of your goal for the next level of the maturity. So 3 things that I want to highlight here. Don't chase the score. I know everybody, this is the industry benchmarking goal, and everybody wants to chase the score and say, hey, if the industry benchmark is 3.0, we want to be a 3.0. Don't chase the score. Be realistic of where you are at today and set up realistic goals.

If—

because it's always better to under-promise and over-deliver. You don't want to do it the other way around. And also it allows you to have those realistic conversations with your team saying, hey, for us to get there, this is what, what we need. We are confident we can get you here, but if you want us to be right here, This is the additional buy-in from the organization that we are asking for.

Yeah, we've also seen companies and leaders get over- enamored on the number itself and lose the context to Eugene's point on the why. So I think numbers and benchmarks, they're always good to kind of tell a story, but if you overfocus on it, I've seen some really bad things happen on both sides of the table. And that can include like people stretching, like I'm a fisherman, so stretching the fish. Oh yeah, that was a 12-inch fish. No, it was a 7-inch fish. You're just overestimating. So to me, I always advise our executives, use the numbers to help you tell the story, but never make it only about the number. That's where things start to get really slippery.

Yep.

Thank you, Aaron. So best practices, whether you're trying to do the, the NIST assessment yourself within your company, or you are engaging a third-party help. There are specific deliverables that we— you should be expecting to have. So we have broken those down into 3 categories. The first one, you want to have a one-pager, your assessment executive summary. So once the NIST assessment is done, that is something you would circulate around. Look at it— this is your elevator speech. If somebody asks you, hey, what are the results of my assessment? Whether it is your peer, whether it is a manager, whether it is a VP, That is your 30-second show talk saying, hey, this is what we did. And the 3 things you need to hit on, what was your assessment approach and scope? What was in scope? How did you conduct the assessment? Then you want to highlight critical, basically the critical outcomes. And when you say critical assessment highlights, highlight both good and bad. And what we mean by that, opportunities for improvement, highlight those, but also highlight if you have recovered NIST introduced a new, a new term, not a new term, but they highlighted a new term within NIST 2.0 that is called positive risks. So highlight, as you're giving those, your executive assessment summary, highlight any strategic opportunities as well that have been identified, and that would be like, hey, it's right there. It's, it's It's really easy to attain, so let's focus on it. And then maturity rating overview. That's where that benchmarking slide comes in. Everybody likes a good visual that helps you tell the story of how you compare against your peers, how you compare against your, against other companies within your industry. You want to show how you rank against others in traffic because that also helps you answer the question when somebody comes back and tells you, Why are we not at 5? And you can tell, hey, like, look, this is 5. We can get there, but the return of investment is not there. And by the way, nobody else is doing it. The next one is we talk about rating criteria. We talked about rating criteria being uniform and it being more subjective than objective. So we recommend breaking it down into 5 subcategories. And what do I mean by that? If somebody asks me, hey, can you rate this control from 1 to 5, from 1 not being implemented to 5 being implemented. You ask that question to multiple people, you'll get a different, different answer. Our recommendation and what we have been practicing is to ask it from 5 different lenses. So once you're rating any specific control, before you give the rating, consider, consider the aspects. Do you have proper documentation for that control? Standards, policies? Do you have people like FTEs available to execute that control? Is there a process around, defined process that can be executed? Is there technology? If it is a technical control, do you have proper technology in place to execute it? And then coverage, the proper coverage of that control. Is it, does it span across enterprise or it's only focused on specific business unit, specific product? And if you're doing an enterprise, Assessment, the COVID if the coverage is limited, then it's really hard to give it a high, high score. Also keep in mind, based on some of the controls, how they are worded in NIST, not all 5 of those will be applicable as you're doing the rating. But this is just a guidance to put you in the right thought pattern. And then we talk about initiatives. We talk that the final deliverable should be the roadmap. As we talk about the roadmap, it's not enough just to list, just to list all the gaps that have been identified. What you want to do, you want to tell the story. So the way we see it being accomplished, most of the time you read out, read out that you have a roadmap, and that roadmap has one-pagers, one-pagers, strategic one-pagers for every initiative that has been identified. Let me break it down for you. So on that one-pager, you want to have an initiative overview. That is your high-level statement. How mitigating the risk, what benefit and value does it bring to the company? You want somebody to— if they, if they, they are given that one-pager and they have data, they know nothing about NIST, they know nothing about cybersecurity, but they can read that initiative overview and translate, hey, this is why cybersecurity, my cybersecurity team is asking for additional resources. This is how they're gonna benefit the, our organization through implementing this initiative. With that being said, you want to highlight resourcing and cost. You want to break it down saying, hey, do we need additional cost from a technology standpoint? Do we need additional— do we need to hire additional personnel, or do we need to spend money on training existing personnel? Implementation approach, you want to break it down into high-level steps, how you're going to tackle that initiative. It's step 1, step 2, step 3. As well as that correlates into what key deliverables and milestones you expect your stakeholders, including yourself internally, to see as you are implementing that initiative. As well as don't forget about in-flight initiatives. Anything that has been budgeted for on the existing roadmap or in-flight, give credit to yourself, give credit to your team for what they have been doing, doing so far. Here at Real Risk, we have done quite a few NIST assessments. The presentation, this presentation is the product of our collective experience. If you have any questions of what I just talked through, please do not reach out. Please, please don't hesitate to reach out to us. At the end of the day, we are all here to learn, and as all of us know and can attest to, cybersecurity, it's all about collaboration. Thanks. Thank you very much. I'll pass it on to Chris.

Great. Thanks, Eugene. So hello, everyone. My name is Chris Addicks. As Aaron mentioned, 20 years on the cyber— in the cyber domain on the practitioner side. 3 years ago, I came over to Reveal Risk. And what I find on this side of the fence is very quickly is I love sharing my knowledge and all the things that I've learned. And Eugene, to your point, continually learning, getting feedback from clients and listening. So with that, one of the things— and do I have control here? Could you go to the next slide, please? Awesome. Thank you. Oh, thank you, Michael. Appreciate that. All right, back one. Sorry, guys. Okay, great. So one of the things I learned, I've been in the position of having a strategy in front of me, whether it was developed internally with my teams or from a third party, and it's really great. The cyber world is truly your oyster. You're looking at a strategy that covers almost anything you can imagine, everything from a security awareness program that needs improvement to a risk management program that needs improvement, all the way over into, I don't know, network segmentation, your OT strategy and cyber, cyber needs in that area. So as you look through these in this context, there's really nothing worse than developing a strategy, going through all that work, and it is hard work to do that, to assess current state and then develop a strategy. That spans 6, 9, 12, 24 months, for example. But nothing worse than having that strategy sit on the shelf and not moving it forward. Ideally, we all want our strategy to live and breathe and be executable. And we want to look back in a, a year and say, yeah, I made progress there. We've, we've moved the ball internally, externally with our business stakeholders, and we've moved our maturity score, right? So So now I think this is where, you know, from my experience, the, the hard work is— the, the harder work, I should say. And really what this means is kind of taking your strategy hat, your strategist hat as a cyber leader, and putting that aside for a little bit and putting on your influencer hat. And this is something that I learned very slowly and sometimes painfully over my career, but it's paid dividends. And now, love sharing this experience with clients. And it's really this. It's It's sitting down with your stakeholders that you've identified through your journey or just organically working across your organization. And as we know, stakeholders are going to be the internal cyber team, the remainder, the larger IT team, the business, and even third-party external stakeholders. Okay? And as you work through this, everyone probably in your head, you could probably think through very quickly, hey, here are the key stakeholders I'd work with on this. So as you think through that, and if you have any ability to kind of document those out even better, but sitting down with your strategy and starting to talk to people, starting to get buy-in, gather critical mass, because I don't think I've been at an organization— and now that I'm on this side of the table seeing our clients, there's no organization where a strategy comes out and you're sitting there going, hey everyone, I have a strategy, and people don't pull out their wallets and say, well, what do you need? We're on board, it's all good. So what do you need to do there? You need to take your strategy, you need to take the next step and take those initiatives and that breakdown initiatives and start thinking through the projects and specific things that need to be done and understand who needs to be involved in those. And then often, especially at larger and more mature organizations, you do have an IT PMO process, a budgeting process, a strategy review process, and compliance mapping objectives that you need to make sure your strategy fits into on your projects. So there's a lot of different things you'll need to work through, but it's really taking the time to think through how you're going to make these projects real How are you going to get stakeholder buy-in and then get them through whatever the required process is to make those real, to make sure they are prioritized on the IT project portfolio for maybe next year, or if there's something urgent, later this year through special approvals, right? And not only that, that includes the budgeting for that. Budgeting is obviously a big thing. Often these assessments don't perfectly— assessments and strategies that you're able to do, um, they don't always perfectly line up with your strategic planning, right? If you have a strategic, strategic plan due in, I don't know, August or September, sometimes your assessment is going to get finished up, assessment strategy can get known November or earlier in the year, meaning that there's going to be a gap or overlap with that strategic plan. You're going to have to figure out a way to work the projects in and not sit on the strategy until 9 or 10 months have passed. Okay. So, so the, the goal here is really working through and kind of, and Eugene, you covered it perfectly, which I love, and, and they're here on this slide too, but really getting ahead of and addressing the budget constraints, getting, fighting the battle to get it in your IT project portfolio. Everyone you work with in IT, they're busy, they have their own priorities. You can't just come with a large security 9-month project and say, hey, We're going to uplift our SecOps and redo the way we monitor our environment. Hey guys, do you have some free time to work on this? The answer typically isn't, sure, you got it, we can start tomorrow, right? And then as you build, you need to run. One thing that I've experienced is best laid plans. We're going to build an awesome security management process program and we're going to have a risk register, we're going to have all the tied documentation, we're going to communicate it. You have to make sure that you're ready to run that after you build it and maintain it over time with the proper resources and budget. And then just quickly, again, I said it earlier on, the wallets aren't always open. It's not that easy to get that money and pull it out. So sometimes from, from that perspective, and sometimes with some of your stakeholders, they're not quite where you're at with the understanding of the topic you're trying to get through, what you're trying to drive through. So it's really, sometimes you have to go back to the drawing board to get initial buy-in and convince people that your strategy or this project as part of the strategy is required. So how can you do that? A couple just things kind of brainstorm on to drive additional buy-in, getting down to that next level of granularity beyond that high-level strategy, right? And say, look, maybe I can use some type of testing to enable or to prove a point here. And again, across all this, there's no fear, uncertainty, doubt, don't do it, doesn't work. But you can take things and identify gaps at a more granular level, turn those into actionable initiatives, and then use that as input to drive your projects and strategy. So you can see this, we're getting a little low on time. I do want to cover security events. Again, not fear, uncertainty, or doubt. Okay, but we've all said it, we've all lived it, we love it, maybe not. Never waste a good crisis. And really what that means in my opinion is after an incident, as part of that lessons learned, it's not just lessons learned around your internal incident response process or your plan or how you address something or forensics capabilities or third-party assistance on an incident. It's sitting down, looking at the root causes of things and thinking both tactically and strategy back through that to identify key risks and gaps and then tying those again to initiatives and see how those map back into your strategy and your projects. And if they don't, staging new projects or initiatives to get those covered. And not just tactically. Hey, a patch led to this issue. Don't just patch that. Look at your patch management strategy. Look at your vulnerability risk management strategy. Fix those things, process and documentation. So I'll stop there. It's probably a lot, but I will hand it over to Aaron to bring us home. And thank you for your time.

Awesome. Thanks, Chris. Yeah, that's a big topic. We probably could have had a whole hour on managing the after you get the assessment, building the strategy, managing the stakeholders. What I wanted to talk about, and it's really building on what Chris said, which is, you know, figuring out the way that you're going to influence getting the budget or getting executive sponsorship or getting the board backing you, is it's really, and this is a lot of these skills come from, you know, organizational change management principles, marketing. So I think as you think about your diverse workforce, who are you pulling in within your company or from an outside standpoint that bring some skills that you don't. I mean, you know, a lot of the stigma within our industry is that a lot of us came from core IT practitioner roles, or infrastructure was the big feeder pool for cyber. That's changing for the better a bit, but a lot of us didn't get an MBA or own a full P&L of a company and understand budgets and influence and how to manage the board. So along my way on the corporate side and then on this side of the table, I loved learning and bringing in diversity of thought to help with some of the things that I did not have at the time. And just talking about some of the audiences, line leadership. So thinking about getting action, think about MFA or privileged access management, or, or figure out what your employee or user activating action or key initiative is for the year. At some point you're going to have to, or you are best enabling if you, if you, you're best enabled to get action if you have line leadership support. How do you get that? You might do it through, you know, a management blast. You might have a leader toolkit. I've done that for several different initiatives, both on the corporate side and, and with clients. Executive committee, whatever this looks like. You might be a healthcare hospital association that's a nonprofit. You might not have a formal board and an audit committee like a publicly traded company. But whatever that committee, the, the, the top executives in the, in the company or the organization are, understand them, profile them in a good way. Like, who is your, who are your influencers? Who are your detractors? Who, who can have influence over another? When I was a Six Sigma black belt in the pharmaceutical company that I worked, I learned some really cool tools like political mapping. And it wasn't like US politics, it was like Hey, figuring out how you navigate through a, you know, an uncertain executive political landscape. And it's really worth the time. I'm happy to share the templates that I've used. They've helped me year after year in almost every situation that involved executive influence. Board of Directors, Audit Committee, again, depending if your company has those official publicly traded things or not, there's usually some sort of oversight. And I hear a lot of CISOs in our industry that are like, I don't have the seat at the table. The CIO is presenting for me. I'm getting filtered. All of that is solvable with a lot of these soft skills, and I'll talk a little bit more about that here in a bit on how to learn some chops in that. And then lastly, kind of beneath that, who are your supporting functions? Legal, privacy, HR, those are the usual suspects. I'd like to think that our Chief Privacy Officer, our privacy compadres, are aligned on goal. We're, after all, we're all protecting data. But in often, in many cases, sometimes these organizations compete against each other, or privacy in Europe is very tough to navigate. So it may be, like, very constraining for your security operations center team because you can't do certain things in Germany and Austria. Lived that for many years. So, again, all challenges that are there and present, but having focused time on how to navigate that and bringing in expertise that can help you navigate that is super important. So that is not a detractor from what you're trying to do from your overall mission. And next slide, Michael. So tips for executive level committee, and I picked, uh, 4 or 5 tips because we don't have time to cover them all. Create some sort of governance or steering committee. When I've done this on the corporate side, it included representative business leadership, all your, um, cross-functional your legal, privacy, HR, and create a committee that is your action board to make things happen. Secondly, and go ahead and build out the slide, Michael, champions. Who, this is like a grassroots effort. How are you, how can you not just kind of sit in your chamber within IT where, or cybersecurity, wherever you sit and kind of push things out, but how do you build the pull through building some sort of champions group. We do a lot of this on awareness programs, but I believe the champions can play a much broader role. And we've helped companies with a lot of those most, more recently. And then secondly, with your governance and with how you show up to the organization, separate the business-facing initiatives from all your backend technical. Like it, it really, I get shocked sometimes when I see some of these reports that are going upstairs to executive committees on like, detailed granular vulnerability concerns and not a call to action for the business. That's all good information for somebody, but really, if you're going to have this committee that's focused on cyber, what are the initiatives that they need to sponsor, take action, and be personally accountable for? MFA, awareness, phishing testing, penetration testing results within specific app teams within lines of business. Could go on, but that's separating it from the backend infrastructure stuff that they need, you know, there may not be an immediate executive or business area action for them to take. And then lastly, measure progress and success. All the good leadership books would say if you're not keeping score, you're not, you're not winning. So find a way to gamify across departments the results of whatever your key initiatives are. And most executives that lead these functions got to their level because they're competitive people. And you can like social engineer your way into that and create it to be a little bit like a game. And even if they don't want to be first, if they're not that motivated, I can guarantee you they don't want to be last. They don't want to be last on your scoreboard. So there's a lot you can do there. And as companies get past some of the basics, measurement becomes more and more important. And then lastly, like, I have a lot of passion for executive influence, leadership, helping CISOs get to the next level and get that seat at the table. So I picked 6 of the things that I've written over the last, probably 2 or 3 years on this topic. Everything from audit committee insights. Some of these are written for board members and executive committees to understand your perspectives. So all of these will be available in the slides. They're not paywalled. They're not contact information, uh, walled. They're on our website. Clickable. Because I know we're cyber people, we're probably not going to enter our information in. So these are all like, there is no sales pitch in these. These are just my learnings because I do believe as cyber professionals, we are sometimes in our own way. And if we spent more time becoming part of the business versus complaining about not being more integrated with the business, we will win together better. So again, happy to chat with anybody more about any of these topics, but don't have enough time to go into all the, all the thought leadership and, and topics here. Okay, with that, I think we are to our time, and I know we only have 8 minutes. We have a lot of questions. If we don't get to your question here in the Q&A, we will follow up. And then also, you know, I think there was a question that I saw pop up on our methodology. We tried to make this, as I think the ISAC would appreciate and, and, and focuses, this is education. If you want to hear more about how we do this and differentiators and how we kind of take our experience from your side of the table, from being you as corporate practitioners into solving issues and pain points with consulting that we've had over the years, happy to have that conversation and share more. But again, this is all about helping this community learn and grow, whether you're doing this yourself or you're leveraging help. So with that, I will turn it over to Jeff to kind of help us through the Q&A. Bronwyn, help along the way if you want to help as well. And Kristen, we might have to unmute Jeff. I think that's a control that we have on— there we go. Thank you. Jeff, you're live.

Yeah, great. Well, Bronwyn, did you see any questions that you thought should be brought up?

Yeah, we've got some really good ones. First of all, thank you everyone so much for participating in the chat. It's really nice to have people asking questions like along the way. So thank you. So I'm going to start with Brent's question from earlier. And Michael, I think this one is going to be best answered by you. So Brent asks, speaking of action or outcome-driven information that comes with CSF 2.0, do you see CIS Controls also help drive/build actionable items? And do you believe that CIS Controls pair well with the NIST updates? And yeah, we'd love to hear more of your opinions about those comparisons.

Yeah, definitely. And I think I saw another question in there too that had specifically mentioned like, do they— are they complementary is one better than the other? And I think, as is the case across the maturity horizon, there is no one-size-fits-all, right? They're definitely complementary. But for, for NIST and CIS specific, if you kind of step back and look at it, NIST is— while they are getting more concise and direct in the guidance, it is, it is still at a higher level. So NIST gives you guidance on you should be going this direction, but CIS is, is that more tactical level that really can get on you should be going at this speed or using this specific path to get to it. And then CIS is also focused on meeting a pretty well-defined set of controls, whereas NIST is focused on doing the practices to get you at a higher maturity level. So Overall, NIST is still very much higher level, putting you in the right direction, where CIS is a great starting point. It gives you very specific things to measure against, but NIST gives you that long-term maturity.

And just quickly— oh, go ahead, Aaron.

Oh, I was just gonna add, we've used both. We've used both together. I will just share a couple failure modes. I've seen some organizations start with CIS because they wanted to start small and then broaden to to NIST. Didn't see that go well. I think CIS is well positioned. Actually, if you look back to its origin, it was created in a top-down things that, that led to breaches and starting with, like, obviously, the hardest things first, asset inventory, software inventory. Almost everyone is not perfect or great on those things, but they're still super critical because you can't, you can't secure what you don't know about. I will say, in my opinion, CIS is fairly technical. It doesn't include a lot of the governance and assessment and executive elements and awareness. So it misses a lot of things. And when I've seen some companies start with it, they end up with heavy SecOps programs, almost no GRC, and it, it is kind of a repivot when you broaden to NIST. So the happy path that I've found is even if you're at an early maturity, starting with NIST CSF and not setting some sort of moonshot goal to get to 4.5 out of 5 in one year, which you will fail, but using CIS as prioritization within that. And to Michael's point, leveraging some specific tactical elements and, and threat-based prioritization that comes from CIS. I think I saw there's a question about comparisons. There are crosswalks. We have one. There are tools that you can mash them up together. I saw questions about tools. We're fairly agnostic to technology by design. We've helped companies make their GRC program that they've— or their GRC tool that they've invested in work to adopt NIST 2.0 and shift from 1.1. I will say some GRC tools are better than others. Some are a real struggle, struggle to get some of the basics in an actionable way. But some are, some are pretty good at it. There's also tools that are, you know, purpose-built for maturity management. Those can be helpful for the right company and size. And we've done some things and built some things internally to, to expedite for our clients, like measurement. They get the data, they can update it quarterly. We may, like, I would rather not sell you on an annual or every 2 years NIST CSF reassessment. I would rather teach you to fish, to update it along the way. Your board may ask for some sort of, you know, external validation. But my philosophy and the philosophy of our team is we would rather help you fix the things and move the program forward than get on some recurring revenue stream of like, hey, we're going to do your assessment every 2 years. And, you know, it's a big surprise what the results are going to be. That should not be the case in any situation. With NIST.

That was a great answer, and I think you've answered a couple of other questions. We have just 2 minutes left, so let's sneak in one more question from the audience on this, and then maybe we can plan to answer some of these in, in follow-up communication with the audience here. I think it was Jay who asked a question about where this benchmark data is coming from. You kind of answered that already, Aaron, but there is something else that we're going to be able to to send out to this community. Can you talk about that?

Yeah, so for those that were at the May ISAC, if you came visit our booth, we had an iPad up. We probably could have done a better job, and, and, and Jeff, there may be an opportunity to send out the link. We got about 35 companies that responded. Chris and I and, and Michael and others helped with the survey itself. We created a benchmarking service or survey specific to HISAC. Because of the pain point that Jay reached. Every consulting company has their own data from their own clients and they can aggregate that. But there, there is no single database that you can go to get everyone's results and no one wants to share that broadly. So for what I am leading the charge on is to try to get more of that into the ISAC. A lot of people share organically, but we created a 25-question survey and really it's the questions that as CISOs and GRC leaders that, you know, Chris and I hoped we could have got, but we all sometimes got filtered answers through the consultants that we use. So this is intended to be the answer to that question, Jay, and I would love for, if you didn't get a chance to do that or see us in May, we'll send out the link. We'd love to get your data in there before we finalize the white paper that we're going to push out to this community. I did, I did see a question pop on what GRC tools you recommend. Again, we're tool agnostic. I don't want to single, single any out. I know Eugene, having done GRC programs at at least 3 different companies and have experience across most of the tools, Michael as well, they have opinions. I don't want to put those out in this forum, but would be happy to take a follow-up call to help you navigate that. And there might not be a single answer for every company. So sometimes it's trying to figure out what your needs are. And then we can independently push you towards several options. We're not a reseller, so we're not trying to push you towards the one that's going to pay us the most money. That's another pet peeve of this industry that I have.

Aaron, to summarize, process comes first. Do not put GRC tool in front of your process. Have a process first, and then you, you can select the proper, the right GRC tool for you. A lot of times we see it the other way around.

Yeah, Eugene and I could fill an hour apiece on pain points of GRC implementation. I was the Proud owner of one at the pharmaceutical company. Not proud, sorry. It was very painful. I learned a lot of lessons. I've seen clients learn some of those same lessons. So there's a lot of pain in this space, and Eugene hit it on the head. We've got to understand our requirements and the process before we try to rush to a tool. Awesome.

We're probably at time. So, Jeff, I'm going to hand it back over to you so you can close us out.

Thanks, Bronwyn. Yeah, I appreciate it, guys. That was really great. So once again, I'd like to thank our speakers for their insight and our listeners for taking the time to attend this webinar. So with that, I'll thank everyone again and bye.

Thanks, everyone. Have a great day.