Information Security Roadmap

Information Security Roadmap

Reference book:

Gregory, P. (2018). CISM Certified Information Security Manager All-in-One Exam Guide (First ed.). McGraw-Hill Education, New York.

TASK

 

Using the Threat and Risk Assessment Report from the previous initiative devise an Information Security Roadmap that selects and articulates the business benefit for 5 individual Information Security Initiatives for EvolveNet. The Information Security Initiatives must involve the implementation of controls that provide the most benefit to the organisation. Controls can be in the form of administrative, technical,

The Information Security Roadmap consists of two deliverables:

1.      An Information Security Roadmap Charter Document

2.      An Information Security Roadmap Executive Presentation

 

Information Security Roadmap Charter Document

The charter document must contain a section for each selected initiative that articulates the following:

· Introduction (including business problem/threat scenario)

· Scope

· Business benefits

· Functional business requirements

· Key success indicators

· Required resources

· Indicative budget

· Two possible products and technical solutions

· Estimated delivery timeframe 

Information Security Roadmap Executive Presentation

 The executive presentation must contain:

· An introductory slide summarising the overall intent of the Information Security Roadmap

· A slide for each initiative that contains:

· Initiative executive summary (business problem and benefit)

· Initiative solution summary

· A graphic or image representing the initiative

· Estimated costs and resources

· A slide summarising all initiatives in a single list (including total roadmap costs)

 

RATIONALE

 

This assessment task will assess the following learning outcome/s:

· be able to create and maintain an information security strategy that aligns with organisational goals and objectives.

· be able to establish, monitor and report on a set of security metrics that are appropriate to an organisation's business mission.

· be able to identify, define and manage requirements for internal and external resources to execute the information security program.

· be able to create and maintain an incident response plan to ensure an effective and timely response to information security incidents.

An information security manager that is responsible for the security of an enterprise must be able to develop a plan for the implementation of security controls to address information security risk and protect organisational assets. This typically comes in the form of an information security roadmap. This assessment is aimed at developing skills in control analysis, product selection, solution design and authoring of executive presentations. Clear and concise presentations that are based on sound solutions are a key tool for establishing an information security roadmap and protecting the organisation.

 

MARKING CRITERIA AND STANDARDS

 

Criteria

HD

DI

CR

PS

FL

Marks

Composition of Information Security Roadmap Charter

The document clearly describes initiatives and the benefit to the business. Initiative costs and resources are realistic. Selected solutions satisfy business requirements, align with strategy and demonstrate knowledge of the organisation.

The document clearly describes initiatives and the benefit to the business. Initiative costs and resources are realistic. Initiatives address risks and align with business strategy.

The document adequately describes initiatives and the benefit to the business. Initiative costs and resources are mostly realistic. Initiatives address the main risks and align with business strategy.

The document adequately describes initiatives and the benefit to the business. Initiative costs and resources are well considered. Business strategy is taken into account

The document does not adequately articulate initiatives. Initiatives do not satisfy business requirements or align with strategy.

/40

Composition of the Information Security Executive Presentation  

The document clearly describes and illustrates the selected initiatives. Initiative costs and resources are realistic. Initiatives address risks and align with business strategy. The presentation provides a compelling argument for initiative implementation.

The document clearly describes and illustrates the selected initiatives. Initiative costs and resources are realistic. Initiatives address risks and align with business strategy.

The presentation adequately describes and illustrates the selected initiatives. Initiative costs and resources are mostly realistic. Initiatives address risks and align with business strategy.

The presentation adequately describes and illustrates the selected initiatives. A high level view of the roadmap is understandable.

The presentation does not adequately articulate initiatives and does not provide the author with a high level view of the roadmap.

/40

Presentation  

Writing demonstrates clarity of intention, purpose, and approach to the topic. Written expression is clear, fluent and well-structured:
Sentences are well structured, with good use of vocabulary, and with minimal or no grammatical and punctuation errors.
Paragraphs are structured to present a flow of ideas.
The written piece is well-formatted with minimal or no spelling or proofreading errors.
Language is used to convey a clear meaning to the intended audience. Writing style conveys a clear and meaningful interpretation of the task, based on confidence in knowledge and ability to clearly communicate complex concepts and ideas. Presented in 1.5 line spacing, with wide margins, page numbers and suitable type-size. 

Written expression is clear, well-structured and understandable:
Sentences are well structured, with good use of vocabulary, and contain minimal grammatical and punctuation errors.
Paragraphs are well structured and assist in presenting a flow of ideas, despite a small amount of repetition.
Formatting has been well considered and contains few spelling or proofreading errors.
The purpose of the writing is identified and explained. The language used has meaning to both themselves and their intended audience. Writing style is well suited to the purpose of the task and the intended audience. Writing conveys the intended meaning and required level of detail of knowledge  

Written expression is clear, well-structured and understandable:
Sentences are well structured, with good use of vocabulary, and contain few grammatical and punctuation errors.
Paragraphs are well structured and assist in presenting a flow of ideas, despite a small amount of repetition.
Formatting has been considered and contains few spelling or proofreading errors.
The purpose of the writing is identified and explained. The language used has meaning to both themselves and their intended audience. Writing style is suited to the purpose of the task and the intended audience. Writing conveys the intended meaning and required level of detail of knowledge Some issues with submission or formatting. 

Written expression is clear, well-structured and understandable:
Sentence structure could use some work, with some grammatical errors present.
Paragraphs are mostly structured in a way that demonstrates thought and planning
The written piece is adequately formatted but contains some spelling or proofreading errors.
The purpose of the writing is identified and explained.  Writing style is suited to the purpose of the task and the intended audience. Writing conveys the intended meaning but requires more detail and evidence of knowledge. Some issues with submission or formatting. 

Writing lacks clarity of expression, structure or purpose:
Sentences are poorly structured, with inappropriate vocabulary and frequent grammatical and punctuation errors.
Paragraphs do not assist in presenting a flow of ideas.
The written piece is poorly formatted with frequent spelling or proofreading errors.
The language used does little to convey meaning Writing style is focused on information without conveying a meaningful interpretation of the topic. Deviates significantly from the required in the submission format

/10

Referencing

Excellent independent identification of an extensive range of literature which is: relevant; current; authoritative; and which includes multiple publication types. Substantially exceeds the minimum number of required references, demonstrating excellent skills in searching for relevant and credible literature. Excellent linkage and integration. Has developed and justified using own ideas based on publications which have been thoroughly analysed, applied and discussed to illustrate and justify the discussion.

Minimum of 8 references including at least 4 refereed journal articles located by the student have been used. Some (but not all) of the literature is not: relevant; current; or authoritative; and may not include multiple publication types. Clear evidence of application of readings relevant to the subject. Some attempt to integrate information from publications with own writing. 

Minimum of 6 references including at least 3 refereed journal articles located by the student have been used. Some (but not all) of the literature is not: relevant; current; or authoritative; and may not include multiple publication types. Some evidence of application of readings relevant to the subject. Some attempt to integrate information from publications with own writing. Some content from publications is presented uncritically, in a purely descriptive way and indicates limitations of understanding or a limited ability to compare and link information from several sources.   

Minimum of 4 references including at least 2 refereed journal articles located by the student have been used. Some of the literature is not: relevant; current; or authoritative; and may not include multiple publication types. Student has attempted to apply or integrate information from publications into own writing. Most content from publications is presented uncritically, in a purely descriptive way and indicates limitations of understanding or a limited ability to compare and link information from some sources.   

Little of no evidence of attempt to search for and independently identify relevant, current or authoritative literature.   Less than 8 overall references have been used. Little or no attempt to compare or link information from several sources. Content from publications is listed without integration with student writing and without identifying similarities or differences.

/10