Difference between revisions of "LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan"
Shawndouglas (talk | contribs) |
Shawndouglas (talk | contribs) m (Fixed link to LIMSpec) |
||
(6 intermediate revisions by the same user not shown) | |||
Line 2: | Line 2: | ||
'''Title''': ''Comprehensive Guide to Developing and Implementing a Cybersecurity Plan'' | '''Title''': ''Comprehensive Guide to Developing and Implementing a Cybersecurity Plan'' | ||
'''Edition''': | '''Edition''': Second | ||
'''Author for citation''': Shawn E. Douglas | '''Author for citation''': Shawn E. Douglas | ||
Line 8: | Line 8: | ||
'''License for content''': [https://creativecommons.org/licenses/by-sa/4.0/ Creative Commons Attribution-ShareAlike 4.0 International] | '''License for content''': [https://creativecommons.org/licenses/by-sa/4.0/ Creative Commons Attribution-ShareAlike 4.0 International] | ||
'''Publication date''': | '''Publication date''': March 2023 | ||
Look across the internet and you will find a wealth of [[information]] about [[cybersecurity]] and the cybersecurity plan. However, much of that information is either disparate or, if comprehensive, difficult to access or expensive to acquire. In particular, a walk-through of the various steps involved with how an organization or individual develops, enforces, and maintains a cybersecurity plan is difficult to come by. This guide attempts to fill that gap, including not only a 10-step walk-through but also insight into regulations, standards, and cybersecurity standards frameworks, as well as how they all fit together with cybersecurity planning. Additionally, this document provides access to ''[[:File:An Example Cybersecurity Plan - Shawn Douglas - v1. | Look across the internet and you will find a wealth of [[information]] about [[cybersecurity]] and the cybersecurity plan. However, much of that information is either disparate or, if comprehensive, difficult to access or expensive to acquire. In particular, a walk-through of the various steps involved with how an organization or individual develops, enforces, and maintains a cybersecurity plan is difficult to come by. This guide attempts to fill that gap, including not only a 10-step walk-through but also insight into regulations, standards, and cybersecurity standards frameworks, as well as how they all fit together with cybersecurity planning. Additionally, this document provides access to ''[[:File:An Example Cybersecurity Plan - Shawn Douglas - v1.1.pdf|An Example Cybersecurity Plan]]'', a companion document that provides a representative example of the 10-step walk-through put to use. This guide also includes a slightly simplified version of many of the security controls found in the National Institute of Standards and Technology's (NIST) Special Publication 800-53, Rev. 5, with additional resources to provide context, and mappings to [[Book:LIMSpec 2022 R2|LIMSpec]], an evolving set of specifications for laboratory informatics solutions and their development. The guide attempts to be helpful to most any organization attempting to navigate the challenges of cybersecurity planning, with a slight bias towards [[Laboratory|laboratories]] implementing and updating information systems. | ||
The second edition updates citations and statistics, as well as grammar. The first edition was released months prior to the NIST 800-53 update from Rev. 4 to 5; this edition is updated throughout to address the changes in that framework to Rev. 5, including Appendix 1. | |||
The table of contents for ''Comprehensive Guide to Developing and Implementing a Cybersecurity Plan'' is as follows: | The table of contents for ''Comprehensive Guide to Developing and Implementing a Cybersecurity Plan'' is as follows: | ||
Line 26: | Line 28: | ||
3. [[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/Fitting a cybersecurity standards framework into a cybersecurity plan|Fitting a cybersecurity standards framework into a cybersecurity plan]] | 3. [[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/Fitting a cybersecurity standards framework into a cybersecurity plan|Fitting a cybersecurity standards framework into a cybersecurity plan]] | ||
4. [[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/NIST Special Publication 800-53, Revision | :3.1 How do cybersecurity controls and frameworks guide plan development? | ||
4. [[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/NIST Special Publication 800-53, Revision 5 and the NIST Cybersecurity Framework|NIST Special Publication 800-53, Revision 5 and the NIST Cybersecurity Framework]] | |||
:4.1 NIST Cybersecurity Framework | :4.1 NIST Cybersecurity Framework | ||
Line 44: | Line 48: | ||
6. [[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/Closing remarks|Closing remarks]] | 6. [[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/Closing remarks|Closing remarks]] | ||
:6.1 Recap and closing | |||
Appendix 1. [[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/A simplified description of NIST Special Publication 800-53 controls, with ties to LIMSpec|A simplified description of NIST Special Publication 800-53 controls, with ties to LIMSpec]] | Appendix 1. [[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/A simplified description of NIST Special Publication 800-53 controls, with ties to LIMSpec|A simplified description of NIST Special Publication 800-53 controls, with ties to LIMSpec]] | ||
Line 50: | Line 56: | ||
:Appendix 1.2 Awareness and training | :Appendix 1.2 Awareness and training | ||
:Appendix 1.3 Audit and accountability | :Appendix 1.3 Audit and accountability | ||
:Appendix 1.4 | :Appendix 1.4 Assessment, authorization, and monitoring | ||
:Appendix 1.5 Configuration management | :Appendix 1.5 Configuration management | ||
:Appendix 1.6 Contingency planning | :Appendix 1.6 Contingency planning | ||
Line 59: | Line 65: | ||
:Appendix 1.11 Physical and environmental protection | :Appendix 1.11 Physical and environmental protection | ||
:Appendix 1.12 Planning | :Appendix 1.12 Planning | ||
:Appendix 1.13 Personnel security | :Appendix 1.13 Program management | ||
:Appendix 1. | :Appendix 1.14 Personnel security | ||
:Appendix 1. | :Appendix 1.15 Personally identifiable information processing and transparency | ||
:Appendix 1. | :Appendix 1.16 Risk assessment | ||
:Appendix 1. | :Appendix 1.17 System and services acquisition | ||
:Appendix 1.18 System and communications protection | |||
:Appendix 1.19 System and information integrity | |||
:Appendix 1.20 Supply chain risk management | |||
<!---Place all category tags here--> | |||
[[Category:LII:Guides, white papers, and other publications]] |
Latest revision as of 18:36, 20 June 2024
Title: Comprehensive Guide to Developing and Implementing a Cybersecurity Plan
Edition: Second
Author for citation: Shawn E. Douglas
License for content: Creative Commons Attribution-ShareAlike 4.0 International
Publication date: March 2023
Look across the internet and you will find a wealth of information about cybersecurity and the cybersecurity plan. However, much of that information is either disparate or, if comprehensive, difficult to access or expensive to acquire. In particular, a walk-through of the various steps involved with how an organization or individual develops, enforces, and maintains a cybersecurity plan is difficult to come by. This guide attempts to fill that gap, including not only a 10-step walk-through but also insight into regulations, standards, and cybersecurity standards frameworks, as well as how they all fit together with cybersecurity planning. Additionally, this document provides access to An Example Cybersecurity Plan, a companion document that provides a representative example of the 10-step walk-through put to use. This guide also includes a slightly simplified version of many of the security controls found in the National Institute of Standards and Technology's (NIST) Special Publication 800-53, Rev. 5, with additional resources to provide context, and mappings to LIMSpec, an evolving set of specifications for laboratory informatics solutions and their development. The guide attempts to be helpful to most any organization attempting to navigate the challenges of cybersecurity planning, with a slight bias towards laboratories implementing and updating information systems.
The second edition updates citations and statistics, as well as grammar. The first edition was released months prior to the NIST 800-53 update from Rev. 4 to 5; this edition is updated throughout to address the changes in that framework to Rev. 5, including Appendix 1.
The table of contents for Comprehensive Guide to Developing and Implementing a Cybersecurity Plan is as follows:
1. What is a cybersecurity plan and why do you need it?
- 1.1 Cybersecurity planning and its value
2. What are the major regulations and standards dictating cybersecurity action?
- 2.1 Cybersecurity standards frameworks
3. Fitting a cybersecurity standards framework into a cybersecurity plan
- 3.1 How do cybersecurity controls and frameworks guide plan development?
4. NIST Special Publication 800-53, Revision 5 and the NIST Cybersecurity Framework
- 4.1 NIST Cybersecurity Framework
5. Develop and create the cybersecurity plan
- 5.1 Develop strategic cybersecurity goals and define success
- 5.2 Define scope and responsibilities
- 5.3 Identify cybersecurity requirements and objectives
- 5.4 Establish performance indicators and associated time frames
- 5.5 Identify key stakeholders
- 5.6 Determine resource needs
- 5.7 Develop a communications plan
- 5.8 Develop a response and continuity plan
- 5.9 Establish how the overall cybersecurity plan will be implemented
- 5.10 Review progress
- 6.1 Recap and closing
Appendix 1. A simplified description of NIST Special Publication 800-53 controls, with ties to LIMSpec
- Appendix 1.1 Access control
- Appendix 1.2 Awareness and training
- Appendix 1.3 Audit and accountability
- Appendix 1.4 Assessment, authorization, and monitoring
- Appendix 1.5 Configuration management
- Appendix 1.6 Contingency planning
- Appendix 1.7 Identification and authentication
- Appendix 1.8 Incident response
- Appendix 1.9 Maintenance
- Appendix 1.10 Media protection
- Appendix 1.11 Physical and environmental protection
- Appendix 1.12 Planning
- Appendix 1.13 Program management
- Appendix 1.14 Personnel security
- Appendix 1.15 Personally identifiable information processing and transparency
- Appendix 1.16 Risk assessment
- Appendix 1.17 System and services acquisition
- Appendix 1.18 System and communications protection
- Appendix 1.19 System and information integrity
- Appendix 1.20 Supply chain risk management