Requirements, also known as cyber security drivers, are those laws, regulations, common business practices, ethics, and the like on which the policies are based. The policies are needed to comply with the requirements; the procedures are required to implement the policy; and the processes are steps that are followed to support the procedures.

The corporate information assets protection policies are a series of policies that deal with the protection of various information assets categories within the corporation. These policies make up a major portion of the cyber security program, as they are the protection “rules.” They are the first building blocks of the corporation information assets protection environment. Information assets protection policies are the foundation for a cyber security program. It is crucial that they:

One cannot state these requirements too strongly. They are the key to a successful cyber security program. If it is not stated in writing, it does not exist. After the information assets protection policies are established and approved in accordance with the corporation requirements (executive management approval for all policies that affect the entire the corporation), the information contained in the policies must be given to all corporate employees. This will be done through the corporation cyber security program education and awareness training program.

A key process that the cyber security officer must establish is one that will maintain all information assets protection policies in a current state. Because this is a crucial function, the cyber security officer has assigned one staff member full time to ensure that the policies are current at all times and ensure that when changes are considered, they are properly coordinated, and the information is dispensed to all employees as soon as possible. After all, the changes may just be procedural, or they may mitigate a risk to some valuable corporation information assets.

The cyber security officer’s focal point for information assets protection policies is the central cyber security person to collect information that adversely affects the protection of information and information systems. That adverse information is analyzed by the focal point, with help from others as needed, to determine if policies must be added or modified to help mitigate the adverse effects—vulnerabilities—identified. If so, such changes are done based on a cost–benefits approach to mitigating the identified vulnerabilities.

For the position of an information assets protection policy specialist, the cyber security officer has chosen a person already employed by Human Resources (HR). This was done after interviews and looking at the experience of the cyber security staff. None of the cyber security staff were qualified or interested in such a position: The cyber security staff saw it as being a “nontechie paper shuffler” job. The cyber security officer purposely looked for a qualified employee within the corporation, since that person would already be familiar with the corporation culture and processes—basically, how things were done at the corporation.

The cyber security officer was able to get this new position approved by the HR Department and rated at a sufficiently high position level to attract the best candidates. The cyber security officer’s rationale was to rate all new positions at as high a level as possible, so the cyber security officer could attract the best candidates in the corporation or outside the corporation. Such a position would be seen as a promotion by many in the corporation. This was not an easy task, but the cyber security officer had experience in working with HR specialists. The task was not as difficult as it might have been—and once had been for the cyber security officer.

The person hired had worked in an HR office and whose duties included writing HR policy and procedures documents, coordinating document approvals, and maintaining the corporation documentation library. The individual responded to a corporation “vacant position” announcement that was available to all employees through the online HR network.

The job description for the Cyber Security Specialist was developed by the cyber security officer based on past experience. The person was not actively recruited within HR, as this violated the corporation policy—people cannot actively try to “steal” employees from one another. As well as violating corporate policy, it is unethical.

One person who responded to the vacancy announcement had two years of experience at the corporation and had a bachelor’s degree in journalism, but no cyber security or information assets protection experience. The cyber security officer wanted someone who could write and coordinate policies and procedures as the first priority and could secondarily learn about cyber security-related matters. The incentive was that the position was a promotion from the person’s previously held position, and the person would be the lead in this function, rather than “just another employee” in the HR organization.³

At the corporation, the cyber security officer developed an administrative document architecture in which there was an overall information assets protection policy document followed by the other assets protection policy documents. The corporation overall policy document (Information Assets Protection Policy Document 500-1, also known as IAPPD 500-1) begins with a letter from the corporation CEO to show employees that this program was supported by the CEO:

To: All Corporation Employees

Subject: Protecting the Corporation’s Information Assets to Maintain Our Competitive Edge through a Corporate Cyber Security Program

We are a leading international corporation in the manufacturing and sales of widgets. Today, we compete around the world in the global marketplace of fierce competition. To maintain a leadership position and grow, we depend first and foremost on all of you and provide you the resources to help you do your jobs to the best of your ability. You are vital to our success.

It is the policy of the corporation to protect all our vital assets that are the key to our success, and among these are our information-related assets. These include information, automated manufacturing tools, technology, information- and systems-driven processes, hardware, software, and firmware that we all rely upon to be successful. You and these other vital corporation information assets must be able to operate in a safe environment, and our resources must be protected from loss, compromise, or other adverse effects that affect our ability to compete in the marketplace.

It is also corporation policy to depend on all of you to do your part to protect these valuable information-related assets in these volatile times.

The protection of our information assets can be accomplished only through an effective and efficient cyber security program. We have begun an aggressive effort to build such a program.

This directive is the road map to our corporate cyber security program and the continued success of the corporation. In order for the cyber security program to be successful, you must give it your full support. Your support is vital to ensure that the corporation continues to grow and maintain its leadership role in the widget industry.

(Signed by the corporation President and CEO)

It is crucial that the CEO lead the way in the support of the protection of the corporation information assets. To get the preceding statement published, the cyber security officer relied on the policy cyber security staff member to draft a statement for the CEO to sign. The cyber security officer reasoned that it is always better to write a draft for someone to ensure that what is published meets the needs of the cyber security program and the corporation. The statement was drafted after reviewing numerous other documents and speeches made by the CEO to ensure that the words and format used were consistent with what the CEO normally signed.

The draft was edited by the cyber security officer and then coordinated by the cyber security officer with the Director of Corporate Security, since this had to do with the corporation assets. The Director of Security had no issues with the policy and in fact was happy that the cyber security officer was aggressively moving forward on this matter. In addition, the Director of Security believed that the cyber security officer pushing forward would eventually benefit the Security Department. Furthermore, if the cyber security officer ran into trouble with executive management, the Director could see how far the cyber security officer was able to go in meeting the information assets protection objectives. He likened the cyber security officer to a lead scout going through the corporation’s executive management minefield. It would help the Director to politically choose his ground. After all, the Director was “old school.” He didn’t care much for computers, and he had no problem letting the cyber security officer take on the cyber security matters while the Director concentrated on more “mundane” security matters while awaiting his time for retirement in another four or five years.

Because the draft was going to the CEO, it was also reviewed and edited by the cyber security officer’s boss, the CIO. It was then sent to the CEO’s public relations staff and legal staff for editing and subsequently presented to the CEO by the cyber security officer accompanied by the CIO, who was always concerned when the cyber security officer was involved in anything that brought CEO visibility to any aspects of the CIO’s department.

The cyber security officer accomplished another objective toward building a cyber security program for the corporation. The letter signed by the CEO was just one part of it. The cyber security officer also got support from the CEO to aggressively attack the vulnerabilities problems, because the CEO did not object to the assessment approach briefed by the cyber security officer as part of the cyber security program philosophy. That “hidden agenda” was used to initiate a more proactive effort that the Director of Audits and the cyber security officer had agreed to prior to the cyber security officer’s meeting with the CEO. This tacit approval allowed the cyber security officer to establish a more proactive and aggressive cyber security program. All this may seem a little devious but not unethical—or is it? Do the results outweigh the tactics used to gain those results? You be the judge.

The cyber security policy document had a coordination note attached that showed all those who had seen the document (CEOs rarely sign anything relating to corporate business without input from the staff). If the cyber security officer had just made an appointment with the CEO and asked for concurrence on the document, the cyber security officer would undoubtedly be asked if the CIO had seen it, had it been coordinated with his (cyber security officer’s) staff, etc. The cyber security officer would have said no, wasting the CEO’s time and the cyber security officer’s time. The CEO would never sign off on the document without CEO staff input. The whole incident would make the cyber security officer look foolish and unprofessional, and perhaps feel a little insecure, as though the CEO did not trust the cyber security officer.

One key factor is missing here. Do you know what it is? Would the CEO have signed the document without seeing the draft policy directive, IAPPD 500-1? The answer is probably yes. This is because the cyber security officer ensured that the letter was written without alluding to or identifying any “attached policy document” or any other document, for that matter. Why is this important? It is important because this document is timeless and can be used as a stand-alone document. The cyber security officer thought that it could also be attached to any information assets protection policy directive and would help enforce the policy directive because anyone would assume that the CEO’s signed document is supporting the policy directive to which it is attached.

The fact is, it is probably true that the CEO would support the policy directive: That directive could not have been published and implemented without following the corporation directive publishing process. This process, as stated in the corporation directive HRD 5-17, includes directions as to proper coordination with applicable departments that would be affected by the directive.

The next day, the cyber security officer happened to be in discussion with the cyber security policy specialist around the coffeepot. They discussed the CEO’s approval of the document, and the cyber security officer thanked the specialist for a great job.⁴ The specialist said “Thanks” and also said, “You know, of course, that it is corporation policy that letters, regardless of who signs them, have no more than a 90-day life span? That policy was put in place because many executives and other managers were writing policy ‘letters’ to circumvent the coordination process for directives. So, these policy letters proliferated at the corporation. No one knew what was current and what wasn’t, and many failed to follow the letters because ‘they didn’t work for that person’ (the person who signed the letters). So, the letters were ignored. The last thing that the corporation needed was a bunch of letter policies flowing around and being ignored. That left the entire corporation atmosphere full of conflicts, some chaos, and an attitude of flouting any rules that one didn’t like. In fact, that contributed to our loss of information assets, the firing of managers, including your predecessor. So, you don’t want to end up starting that mess all over again. Do you?”

The cyber security officer didn’t know that and was glad that the right person had been hired for the information assets protection policy specialist position. It’s funny how things sometimes work out better than expected. An “cyber security techie” in that position would probably not have known that valuable piece of information.

The cyber security officer thought about what the information assets protection policy specialist had said. The cyber security officer wanted to keep to a minimum any objections to the information assets policy directives.

So, the cyber security officer directed that a copy of the CEO’s signed document be attached to any information assets protection policy document the cyber security officer was trying to get through the coordination process, published, and implemented. The cyber security officer also included a note on the coordination sheet that stated: The attached document is an implementation document to meet the corporation information assets protection program requirements as stated in the CEO’s document. The cyber security officer was very satisfied with this approach and also directed that the CEO’s letter be changed to a formal directive and so instructed the cyber security policy specialist. That directive, the cyber security officer reasoned, should not require any coordination because the CEO had already signed it. This was the case, and the CEO’s letter became the corporation’s IAPPD 500-1. Therefore, all other policy directives flowed from that overall directive—the CEO’s memo-directive.

The cyber security officer directed that a project, with the cyber security policy specialist as the project lead, be established and implemented. The objective was to bring all information assets protection policy directives up to date. This would require all the corporation policy directives related to information assets protection to be reviewed, updated, coordinated, republished, and placed online, and that all briefings, training, and other processes be updated accordingly. The cyber security officer also directed that the project lead should prioritize the directives according to the following schedule:

The cyber security officer reasoned that outdated directives were better than no information assets policy directives, because where some were needed and did not exist, the information assets were more vulnerable. Although the missing directives would take the longest to get implemented, they were the most important. The cyber security officer also directed the information assets protection policy project team, with the policy specialist as the project lead, to do as much as possible in parallel. Those requiring the least amount of work could be done faster, and every updated directive was another victory in the war to protect corporate information assets.

War? The choice of words was used in all seriousness. The cyber security officer and the staff must get on a “war footing” and not treat their professional duties as some 9-to-5 job. Corporate information assets are being attacked from inside and outside the corporation, from within the home nation-state, and by competitors and nation-states from around the world on a 24/7 basis. This corporation was no exception, and in fact because of its leadership role in the widget industry, it was probably more at risk than some other the corporations.

The cyber security officer directed that all policy directives be limited to specific issues. The cyber security officer reasoned that to develop one large policy directive that covered all aspects of the corporation’s information assets protection needs was not a good idea. Do you agree? Before answering, think about it from an employee’s perspective. The employee has a job do to as a specialist in a chosen profession. Employees are not, nor do they want to be, cyber security specialists. To assist them in at least complying with the cyber security program, the “KISS” principle (keep it simple, stupid) should always be applied.

An employee who wants to do the right thing and comply with all the corporation directives and information assets protection directives is part of the group. Let’s say the employee works in a marketing group. If there were just one large policy document, the employee would look at this monster and might be intimated by its size. The employee does not need to know about many of the information assets’ protection requirements—for example, those that pertain to the manufacturing environment. Yes, one could do keyword searches if the documents are online, but in all probability, pertinent information would be scattered throughout the document. With the capability of putting documents online and maintaining them online, it is easy in today’s word processing environment to just cut and paste applicable portions of other information assets protection documents that apply to more multiple information environments.

Many employees have lost patience trying to read through such large—and boring—documents. Let’s face it, even cyber security professionals get bored reading cyber security documents. Ironically, some cyber security personnel never read the entire series of cyber security-related documents unless they have to, or unless someone embarrasses them by pointing out that they (cyber security personnel) are violating their own cyber security rules!

Topic-oriented information assets protection policy documents can be developed, coordinated, and implemented faster. In addition, employees can easily determine which directive to search for guidance without reading volumes. Also, one large directive would be almost constantly in a state of change because of various aspects requiring changes at different times.

The cyber security officer directed that, as a minimum, individual information assets policy directives were to be established to provide guidance for the protection of the following corporate information assets⁵:

Each information assets protection policy requires compliance by those identified in the policy directives. Each of these directives requires one or more procedures to be established so that there is a standard method used to support and implement the policies, including their spirit and intent. The information assets protection directives previously discussed require procedures to be established to comply with those directives. For example, what procedures should be used to determine the classification to be given a piece of information: corporation–trade secret, corporation–sensitive, corporation–proprietary? Some procedures may be written for everyone in the corporation to follow, while various departments may write others based on their unique information environments.

There are various opinions as to how best to go about developing procedures. One continues to get to a more detailed level as one goes from requirements (drivers) to policies to procedures. The main issue is this: If the cyber security officer establishes a specific procedure to comply with a specific policy, which in turn assists in meeting the corporation goals as stated in the corporate strategic business plan, tactical business plan, and annual business plan, the procedures may not be practical in one or two of the corporation’s departments. The department head may so state and may ask for a waiver saying that they can still comply if they have a different procedure that takes into account their unique working information environment. There may be more than one department with similar complaints. So, how does the cyber security officer ensure that people are following proper information assets protection procedures to comply with the information assets protection policies?

The cyber security officer has found that the best way to do this at the corporation is to require that the individual departments establish, implement, and maintain their own set of information assets protection procedures that comply with the policies. This has several benefits:

The question then arose as to how the cyber security officer could be sure that the procedures written by each department meet the spirit and intent of the policies. Two methods were identified:

Procedures, along with their related processes, are the heart of a cyber security program because they provide the step-by-step approach for employees as to how to do their work and also ensure the protection of corporate information assets. And if the departments write their own procedures, they become actively involved as valuable team members in the process of protecting the corporation’s valuable information assets.

The corporation’s cyber security officer reviewed the cyber security officer’s charter and cyber security program focus previously agreed to by the cyber security officer and executive management. That charter included the following cyber security program functions:

The cyber security officer analyzed the plans, functions, number of systems, and number of users and determined that two subordinate organizations would be needed to provide the minimum cyber security program professional services and support.

Actually, the cyber security officer thought of dividing the functions into three organizations, but the need for one of those was borderline. Also, having three suborganizations might give the wrong impression to others in the corporation (one must always remember perceptions and appearances when building a cyber security program and organization). It would also provide another level of administrative overhead burden that would not be cost-effective. The cyber security officer reasoned that the two subordinate organizations would suffice for now; the organizations could be reevaluated at the end of the first year’s operation.

The cyber security officer decided to brief the CIO (the boss) on the plan. The CIO thought it was reasonable, but wondered how the cyber security officer would handle the off-site locations in the United States, Europe, and Asia.

As with any good plan, nothing ever runs completely as expected. Being an honest and straightforward cyber security officer, the only logical comeback was “Huh?” The CIO went on to explain that their global locations are manufacturing sites making final or subassemblies of the widgets and shipping them to the main plant or global customers, as applicable.

The cyber security officer asked the CIO how other organizations handled the off-site. The CIO explained that they have smaller, satellite offices to provide the service and support needed at that location. The cyber security officer determined that before deciding on the need for a satellite office, the problem should be further evaluated. The cyber security officer explained to the CIO that the evaluation would be conducted within a week and a decision made at that time.

The cyber security officer subsequently determined that to provide quality services and support to the off-site locations, small cyber security organizations with dedicated staff should be in place at all facilities. This would replace the current staff, who, as an additional duty assigned by on-site facility executive managers, had to serve as part-time cyber security persons. This decision was based on several considerations:

Based on the analysis, the cyber security officer determined that cyber security program satellite offices were indeed necessary, but some functions could be supported from the corporate office, such as risk management, policy development, and requirements.

The cyber security officer informed the CIO of the decision and the basis for the decision, emphasizing its cost-effectiveness. The CIO agreed based on the business logic shown by the cyber security officer, the minimal number of cyber security staff needed, and what the CIO sensed as the cyber security officer’s strong commitment to the cyber security program using a lowest cost/minimum risk approach.

The cyber security officer found that establishing the cyber security program organization to date had been the easy part. Now came the bureaucracy of coordinating and gaining approval of the cyber security program organization from the designated organizations, such as organizational planning, HR, and facilities, as well as completing their and other organizations’ forms.⁸

A word of caution to the cyber security officer: Some service and support organizations are more interested in proper completion of the administrative bureaucracy than in helping their internal customers. Just grin and bear it. You can’t change it, except over time, and now is not the time. The priority is getting the cyber security program and the cyber security organization off the ground. Concentrate on that priority.

However, before that could be accomplished, and in accordance with the corporation organizational development and HR requirements, a cyber security job family first had to be established. After all, the corporation, being a high-tech, modern corporation, requires that employees be assigned to career families to support their career development program as directed by the HR Department. And, unfortunately, it seems that cyber security functions have never been a formal part of the corporation. Therefore, there are no job families that seem to meet the needs of the cyber security program functions.

The cyber security officer and the HR representative discussed the matter and agreed that the cyber security officer would write the cyber security functional job family descriptions. The cyber security officer was told that they must be generic, so they are flexible enough to support several cyber security job functions within each level of the job family. The HR representative advised the cyber security officer that this is necessary to ensure the flexibility needed for recruiting, hiring, and subsequent career development of the cyber security professionals. Also, it would streamline the process and ensure that the number of cyber security job family position descriptions could be kept to a minimum, thus also decreasing bureaucracy and paperwork.

At the conclusion of the meeting, the HR representative provided the cyber security officer with the job descriptions for the security, auditor, and IT job family. Also provided were several forms that had to be completed when submitting the cyber security job family descriptions, as well as forms to be used for documenting each job family description by grade level.

Armed with the challenges of this new onslaught of bureaucratic paper, and bidding adieu to the smiling HR representative, the cyber security officer headed back to the office to begin the task of writing the corporation’s cyber security job family as sample descriptions (while wondering when there would be time to do real cyber security program work).

After reviewing the provided job descriptions and reading the paperwork needed to make this all happen, the cyber security officer wrote and provided the HR representative with the function descriptions of the cyber security job family! After several iterations and compromises, and approvals through a chain of organizational staffs, the job family was approved.

Position summary: Provide all technical administrative support for the cyber security organization.

Qualifications: High school diploma, 1 year of security administration or 2 years of clerical experience. Must type at least 60 words per minute.

Position summary: Assist and support cyber security staff in ensuring all applicable corporation cyber security program requirements are met.

Qualifications: This position normally requires a bachelor’s degree in a cyber security-related profession.

Position summary: Identify, schedule, administer, and perform assigned technical cyber security analysis functions to ensure all applicable requirements are met.

Position requires being assigned to perform duties in the following areas:

Qualifications: This classification normally requires a bachelor’s degree in a cyber security-related profession and at least 2 years of practical experience.

Position summary: Identify, evaluate, conduct, schedule, and lead technical cyber security analysis functions to ensure that all applicable corporation cyber security program requirements are met.

Position requires being assigned to perform duties in the following areas:

Qualifications: This classification normally requires a bachelor’s degree in a cyber security-related profession and 4 years of practical, related experience.

Position summary: Act as technical cyber security program advisor, focal point, and lead to ensure all cyber security program functions are meeting the corporation requirements, as well as developing and administering applicable programs.

Position requires being assigned to perform duties in a combination of the following areas:

Qualifications: This classification normally requires a bachelor’s degree in a cyber security program-related profession and 6 years of cyber security program experience.

Position summary: Act as a technical systems management consultant, focal point, and project lead for cyber security program functions and programs developed to ensure the corporation’s requirements are met.

Position requires being assigned to perform duties in the following area:

Qualifications: This classification normally requires a bachelor’s degree in a cyber security-related profession and a minimum of 10 years of cyber security program-related experience.

Hold it! Not so fast! The cyber security officer must first determine the following:

The cyber security officer must plan for the gradual hiring of personnel to meet the cyber security program and cyber security organizational needs based on a prioritized listing of functions. Obviously, a mixture of personnel should be considered. One or two high-level personnel should be hired to begin establishing the basic cyber security program and cyber security processes. Personnel who meet the qualifications of a system security engineer should be hired immediately. At least two should be hired. One would be the project lead to begin the process of establishing the formal functions of one of the cyber security subordinate organizations and the other would do the same for the other cyber security organization. At the same time, the access control function positions should be filled, as they represent the key cyber security program mechanism of access control.

Functions such as risk management, noncompliance inquiry, and the awareness program could come later. The rationale used by the cyber security officer for this decision was that cyber security program policies had not been established, so there was nothing on which to base noncompliance inquiries or an awareness program. The next position to be filled, after the two systems security engineers and access control personnel, was the position of the emergency planning, disaster recovery planning, and contingency planning specialist.

The cyber security officer reasoned that while access controls were being tightened up and analyzed, the engineers were beginning to build the process for each function, with much of the access control process development being done with the assistance of the access control administrators. In the event of a disaster, the systems must be up and operational in as short a time period as possible. This is crucial to the well-being of the corporation.

Unfortunately, the type of individual the cyber security officer would ideally want to employ is not usually readily available. In addition, the corporation’s policy is one of “promote from within” whenever possible. So, although a more qualified individual may be available from outside the corporation, the cyber security officer may have to transfer a less qualified individual currently employed within the corporation, because that person does meet the minimum requirements for the position—at least as interpreted by the HR personnel.

The cyber security officer soon began to realize that compromise and coordination were a must if there was to be even a slight chance of succeeding in building the corporation cyber security program. Based on a self-evaluation, the cyber security officer decided to find as many people as possible within the corporation who were willing to transfer and who met the minimum requirements for a cyber security program position. The cyber security officer soon learned why the job descriptions approved through the HR Department include words such as “normally” and “equivalent.” The cyber security officer naively thought that those words would assist in bringing in cyber security professionals. It never entered the cyber security officer’s mind that others could also use the position descriptions to help recruit personnel—some who just barely would meet the minimum requirements!

For the cyber security officer who is trying to quickly build a cyber security program and cyber security organization, the compromises on staff selection may help or they may hurt. In either case, it is important to begin the hiring process quickly.