Governance

IT governance is a formal framework that shows senior management that IT investments support business objectives. The National Institute of Information Security’s Security and Privacy Controls for Federal Information Systems and Organizations^[1] is the premier regulatory document for all IT security and privacy controls. It provides a catalog of security and privacy controls for all federal information systems and organizations, except those related to national security. The first step to implementing governance is to establish policies with a documented process and roles and responsibilities for creation, review, and oversight.

Committee

• Establish committee membership with people who have authority and expertise to oversee and approve the development of IT privacy and security policies.

• Establish a process for development of new policies and revision of existing policies.

• Establish roles and responsibilities, such a policy owner, executive sponsor, and steering committee.

• Develop a workflow for the approval and review processes.

Risk

The current IT ecosystem includes an interconnected network of appliances—workstations, servers, network devices, switches, firewalls, databases—that all need to work together to ensure the smooth delivery of products and services. Every piece of the network introduces some risk, and the more effectively that IT organizations can understand and manage these risks (Figure 3), the better their resilience will be. Risks can have both downsides and upsides. A risk management plan should include:

• Risk identification,

• Risk analysis and prioritization,

• Risk treatment,

• Risk monitoring, and

• Risk control.

The selection of risk treatment strategies should be based on a multitude of factors. These include the magnitude and frequency of the risk, should it actually materialize. The magnitude is a function of the criticality or sensitivity of the resource. Risk management options include:

• Treat: Where rational consideration is made for taking the risk, but mitigation strategies are put in place, and the risk is actively monitored.

• Tolerate: A conscious strategy of accepting risks where the reward outweighs the risk.

• Transfer: A control strategy that involves contractual shifting a risk from one party to another, such as through purchase of an insurance policy.

• Termination: An approach taken to avoid taking the risk, since it is higher than the established risk appetite and risk tolerance of the organization.

Every organization has some level of investment in IT, and with every new technology comes new security and privacy risks. While it is imperative that we take risks in order to grow, we need to be diligent about managing both the upsides and downsides of those risks. The CCoE should provide guidance to organizational leadership to create a risk appetite (the level of risk that an organization is prepared to accept in pursuit of its objectives), a risk tolerance (the degree of variance from the organization’s risk appetite that the organization is willing to tolerate), and a formal risk management plan, all of which should be embedded in the organization’s strategic and operational processes.

The CCoE should also work with organizational leadership to establish its risk appetite and risk tolerance. Risk appetite is a description of the desired level of risk that an entity will take in pursuit of its mission, while risk tolerance reflects the acceptable variation in outcomes related to specific performance measures linked to objectives that the entity seeks to achieve.

Compliance

Organizations that deal with personally identifiable information or federal tax information are subject to regulatory IT compliance, such as Security and Privacy Controls for Federal Information Systems and Organizations and more. A CCoE facilitates an organization’s response to IT regulatory standards by facilitating the following functions:

• Establishing IT privacy and security controls to meet the regulatory standards.

• Selecting and implementing a GRC tool to use as a system of record for all GRC activities.

• Documenting how the organization is responding to the baseline regulatory requirement.

• Conducting a crosswalk (i.e., identifying associations) between the baseline requirements and other authoritative sources (the Internal Revenue Service’s Tax Information Security Guidelines For Federal, State and Local Agencies;^[3] the Centers for Medicare & Medicaid Services’ Volume III: Catalog of Minimum Acceptable Risk Security and Privacy Controls for Exchanges;^[4] FedRAMP’s guidance documents;^[5] etc.) and document the relationship. Note if there is a full or partial match.

  • A full match is when the baseline regulatory requirement fully matches another authoritative source’s regulatory requirement. A partial match is when the baseline regulatory requirement partially matches another authoritative source’s regulatory requirement.

  • For the full matches, the controls applied to meet the baseline requirements can be inherited from the other authoritative sources. For the partial matches, additional actions need to be documented to meet the differential requirements of the authoritative source that are not covered by the baseline regulatory requirement.