CISEC-IT cheat sheet

Governance defines who decides; management executes. Board retains fiduciary oversight, the CISO advises and operates, and the audit committee independently verifies.

Three lines model: 1st line owns and manages risk operationally, 2nd line sets frameworks and monitors (security, risk, compliance), 3rd line is internal audit reporting to the board.

Common board committee routing: audit committee for risk and control assurance, risk committee for appetite and exposure, technology committee for architecture and resilience investment.

Strategic plan hierarchy: enterprise strategy → security strategy → security program roadmap → annual operating plan with funded initiatives and owners.

Policy hierarchy: policy (mandatory intent, board/executive approved) → standard (measurable requirements) → procedure (steps) → guideline (recommended). Exceptions require documented risk acceptance.

Security steering committee composition: CISO chair, business unit leaders, CIO/CTO, legal, risk, HR; cadence monthly; decisions logged with owners and due dates.

Board reporting cadence rule: operational metrics monthly to CISO/CIO, program-level quarterly to board risk committee, material incidents within 24–72 hours depending on severity.

CISO reporting line options: CIO (technology alignment, weaker independence), CRO (risk alignment), CEO or board (strongest independence and authority).

Risk = likelihood × impact. Qualitative scales (1–5) must be defined in writing; quantitative methods use annualized loss expectancy (ALE = SLE × ARO).

Risk register fields: ID, asset/process, threat, vulnerability, likelihood, impact, inherent score, controls, residual score, owner, treatment, target date, acceptance signature.

Treatment options are exactly four: mitigate, transfer (insurance, contract), avoid (stop activity), accept (documented by accountable owner within appetite).

Risk appetite is the amount of risk the organization is willing to pursue; risk tolerance is the acceptable variance around a specific metric or limit.

Inherent risk is scored before controls; residual risk after controls. Control effectiveness must be evidenced, not assumed, before residual is reduced.

Common frameworks: NIST RMF (7 steps: prepare, categorize, select, implement, assess, authorize, monitor), ISO 31000 (principles and process), FAIR (quantified factor analysis of information risk).

Heat map rule: 5×5 matrix with defined thresholds; any risk in the highest band escalates to executive risk committee regardless of owner.

Concentration and aggregation: risks individually acceptable may exceed appetite when summed across a business unit; aggregate review is required at portfolio level.

GDPR core obligations: lawful basis, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability. Breach notification to supervisory authority within 72 hours of awareness.

Data subject rights under GDPR: access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making.

Roles: controller determines purpose and means; processor acts on controller instructions. Processor contracts must include the mandatory Article 28 clauses.

Cross-border transfer mechanisms: adequacy decision, standard contractual clauses, binding corporate rules, or derogations. Schrems II requires a transfer impact assessment.

PCI DSS applies to any entity storing, processing, or transmitting cardholder data; scope reduction via tokenization or network segmentation reduces assessed systems.

HIPAA Security Rule safeguards: administrative, physical, technical; plus breach notification and the minimum necessary standard for PHI use.

SOX IT general controls: change management, access management, computer operations, and program development; deficiencies are classified as deficiency, significant deficiency, or material weakness.

Records retention: legal hold suspends scheduled destruction; spoliation of evidence creates litigation risk. Privacy notices must state retention periods or criteria.

Defense in depth layers: identity, endpoint, network, data, application, and monitoring. Each layer assumes the prior layer has failed.

Zero trust pillars per NIST SP 800-207: identity, devices, networks, applications/workloads, data, visibility and analytics, automation and orchestration.

Architecture review gate: security sign-off is a required stage in the SDLC before production release; exceptions require time-bound risk acceptance.

Reference architectures map controls to frameworks (e.g., NIST CSF functions: govern, identify, protect, detect, respond, recover) so investment can be traced to control coverage.

Cloud shared responsibility: provider secures the cloud (facilities, hypervisor, managed service baseline); customer secures what is in the cloud (identity, configuration, data, access).

Technical debt and legacy risk: unsupported systems require compensating controls and a funded remediation date; compensating controls do not eliminate the finding.

Key management rules: separate key custodian from data owner, rotate per cryptoperiod policy, escrow recovery keys, and never store keys with the encrypted data.

Secure configuration baselines (CIS Benchmarks, STIGs) are enforced by policy-as-code and drift detection; exceptions are tracked as configuration findings.

Incident response lifecycle: preparation, detection and analysis, containment/eradication/recovery, post-incident activity. Lessons learned is mandatory, not optional.

Severity taxonomy drives escalation: severity 1 (material) triggers executive crisis team, legal, communications, and regulator assessment within defined hours.

Business impact analysis outputs: RTO (time to restore), RPO (acceptable data loss), MTD (maximum tolerable downtime), and dependency mapping. MTD ≥ RTO.

Recovery strategies tier by RTO: backup/restore (hours–days), warm site (hours), hot site or active-active (minutes). Cost rises as RTO shrinks.

Crisis communication rules: single designated spokesperson, pre-approved holding statements, legal privilege preserved, and no speculation on cause or attribution.

Tabletop exercises test decision-making and communications; functional tests validate technical recovery; full failover tests validate the whole plan. Frequency should be defined in policy.

Evidence handling: maintain chain of custody, image before remediation where feasible, and coordinate with counsel to preserve privilege.

Plan maintenance: review at least annually and after major change, reorganizations, or actual incidents; record version, approver, and distribution list.

Principles: least privilege, separation of duties, need-to-know, and default deny. Access is granted to roles, not individuals, wherever possible.

Joiner/mover/leaver controls: access provisioned on approved request, re-evaluated on role change, and revoked within a defined SLA on termination.

Privileged access management: vault credentials, session recording, just-in-time elevation, and separate administrative accounts from daily-use accounts.

Access recertification: business managers certify entitlements at least annually; privileged and sensitive-data access more frequently. Orphan accounts are removed.

MFA is required for remote access, administrative access, and access to sensitive data. Phishing-resistant factors (FIDO2, certificates) are preferred for administrators.

Data classification tiers (e.g., public, internal, confidential, restricted) determine handling, encryption, retention, and sharing rules; classification must be assigned by the data owner.

Data loss prevention and encryption: encryption at rest and in transit for confidential data; tokenization or masking for analytics use of sensitive fields.

Identity governance metrics: percentage of accounts with MFA, orphaned accounts, time to revoke on termination, recertification completion rate, and privileged account count.

Tiering rule: classify vendors by data sensitivity, system criticality, and regulatory exposure. Tier 1 (critical/high) receives full assessment and onsite or independent attestation.

Due diligence evidence: SOC 2 Type II report (review the period, scope, and exceptions), ISO 27001 certificate with scope statement, penetration test summary, and financial stability.

Contract clauses to require: right to audit, breach notification timeline, data return and destruction, subcontractor approval, insurance, SLA with remedies, and termination assistance.

Ongoing monitoring is continuous, not one-time: annual reassessment for Tier 1, continuous security rating feeds, and re-review triggered by incidents or ownership change.

Fourth-party risk: the vendor's own critical subcontractors must be identified and assessed, since the organization's data may reside with them.

Concentration risk: dependence on a single vendor for a critical function requires an exit strategy, escrow, or alternate provider.

Supply chain integrity: verify software provenance (SBOM, signed artifacts), vendor secure development attestations, and hardware provenance for critical components.

Offboarding: revoke access, confirm data deletion certificate, retrieve or destroy assets, and close the contract record with evidence retained.

Awareness program outcomes: reduce risky behavior, increase reporting of phishing and incidents, and satisfy compliance training obligations. Completion rate alone is a weak metric.

Measurement hierarchy: completion and quiz scores (activity), simulated phishing click and report rates (behavior), and incident reports per employee (outcome).

Phishing simulation rules: baseline first, then role-tailored difficulty; never punish reporters; report rate is a better success indicator than click rate alone.

Role-based training: all staff get baseline; developers get secure coding; privileged users get privileged-access training; executives get targeted social engineering and crisis content.

Culture indicators: speak-up and near-miss reporting volume, help-desk social-engineering attempts reported, and whether staff feel safe reporting mistakes.

Talent management levers: career ladders with defined competencies, rotation and cross-training to reduce single points of failure, and retention through certification and project funding.

Skills gap assessment compares required competencies per role to current capability; results feed the training budget and hiring plan.

Onboarding and offboarding: security obligations acknowledged at hire, access granted after training completion, and obligations reaffirmed annually.

Metric types: KRIs (leading, risk exposure), KPIs (operational performance), and KCIs (control effectiveness). A balanced program uses all three.

Metric quality criteria: specific, measurable, attributable to an owner, repeatable, and tied to a decision. Vanity counts (e.g., total alerts) are excluded.

Benchmarking: compare spend as a percentage of IT budget or revenue and per-employee cost, but adjust for industry, size, and regulatory burden before drawing conclusions.

Budget structure: run (licenses, staff, maintenance), grow (new capability, remediation), transform (architecture change). Board asks which portion reduces risk.

Business case structure: problem, risk quantified (ALE or regulatory exposure), options considered, cost, expected risk reduction, timeline, and residual risk if not funded.

Risk-reduction framing: translating control investment into avoided loss or reduced likelihood is more persuasive to executives than control counts.

Board reporting format: one page, trend over time, material changes, top risks with owners, decisions requested. Avoid raw operational dashboards.

Value of security program: reduced incident cost, faster recovery, compliance enablement of revenue, and insurance premium effects are the measurable value levers.