A security report can be technically accurate an still lef a leadership team unsure weh fi do. Di gap often appear between di evidence an di decision: weh dis finding mean fi di business, an weh shuda change because a it?
Bigin wid di activity weh matta
Consider an application weh support customer orders. A weakness inna dat deh application have technical characteristics, but its importance also depend pan weh di business use it fa, di information it handle an di alternatives weh deh deh during an interruption.
A useful discussion therefore staat wid di activity. Which customer commitment, operational process or trusted relationship depend pan dis system? Dis establish di context in which a technical severity rating haffi be interpreted.
Separiet a finding fram it consequence
A finding describe an observed condition. A consequence describe weh dat deh condition coulda allow unda particular circumstances. Confusing di two mek a report difficult fi challenge an a decision difficult fi own.
Ask fi di chain a reasoning. Weh access an adversary woulda need? Which additional assumptions are necessary? Weh evidence dem did gather, an which part a di scenario dem neva test yet? A strong assessment mek dat deh boundary visible.
Mek di next decision explicit
A leadership discussion become more productive wen each material issue attached to a decision. Dat deh decision may be fi fund a correction, change a process, accept a bounded exposure or investigate an important uncertainty.
Di recommendation shuda include dependencies an an owna. A technical team may implement di correction while a business owna decide weda an interruption is acceptable. Both responsibilities need fi be visible.
Define weh improvement ago look like
Closing an action inna a tracker is an administrative event. Assurance need evidence dat di relevant exposure change. Dipen pan di issue, dat coulda mean a retest, a reviewed permission set, an exercised recovery step or an observed change in how an alert is handled.
Disaid weh dem a go check before di work staat. Aal adawiez, wan aaganizieshan kyan invest signifikant efot an stil kyaahn explien ou it pozishan get beta.
A practical agenda fi di next review
Fi each priority issue, put five questions pan di table: weh activity deh at risk; weh evidence support di concern; weh decision dem need; who own di action; an weh ago demonstrate improvement.
Dis a di connection di Cabinet aim fi establish between offensive assessment an strategic advice. Technical depth remains essential. It value increase wen di people dem weh accountable fi di business can use it.
A useful report gi di board a decision fi own an di technical team an action fi verify.
Further reading
NIST Cybersecurity FrameworkA perspective fram di Cabinet
The Cybersecurity Cabinet