GSTP cheat sheet

Strategy formulation: define mission, vision, and measurable objectives; align to business goals and risk appetite; use OKRs or balanced scorecard for tracking.

Governance structures: security steering committee, executive sponsor (CISO), and defined RACI for decision rights; board reporting cadence at least quarterly.

Policy hierarchy: policy (intent) → standards (mandatory controls) → procedures (steps) → guidelines (recommendations). Exceptions require documented risk acceptance.

Regulatory drivers: identify applicable laws (GDPR, HIPAA, PCI DSS, SOX, NIST CSF adoption) and map controls to requirements; maintain compliance register.

Risk appetite and tolerance: set qualitative and quantitative thresholds (e.g., max residual risk score, financial loss limit); review annually or upon major change.

Transformation roadmap: phased approach (assess → design → implement → operate → optimize); include quick wins, dependencies, and funding gates.

Maturity models: CMMI, NIST CSF tiers (Partial, Risk-Informed, Repeatable, Adaptive); use for gap analysis and progress measurement.

Security metrics for governance: % policy exceptions, audit findings closure rate, time to remediate critical vulnerabilities, % assets with current risk assessment.

Third-party governance: vendor risk tiering, contractual security requirements, right-to-audit clauses, and continuous monitoring for critical suppliers.

Risk = likelihood × impact; qualitative scales (1–5) or quantitative (ALE = ARO × SLE; SLE = asset value × exposure factor).

Risk treatment options: mitigate, transfer, avoid, accept; document residual risk and owner; acceptance must be at appropriate authority level.

Risk assessment process: asset identification → threat modeling → vulnerability assessment → likelihood/impact scoring → risk ranking → treatment plan.

Control frameworks: NIST SP 800-53, ISO/IEC 27001 Annex A, CIS Controls v8; map controls to risks for coverage analysis and audit evidence.

Program design components: charter, scope, roles, policies, awareness training, incident response plan, business continuity/disaster recovery, metrics.

Defense in depth: layered controls (preventive, detective, corrective) across people, process, technology; avoid single points of failure.

Risk register fields: ID, description, asset, owner, likelihood, impact, score, treatment, status, due date, residual risk.

Key risk indicators (KRIs): leading metrics (e.g., % unpatched critical systems, phishing click rate) with thresholds triggering escalation.

Business impact analysis (BIA): identify critical processes, RTO, RPO, and dependencies; use to prioritize recovery and security investment.

Zero Trust principles: never trust, always verify; least privilege; micro-segmentation; continuous authentication and authorization; assume breach.

Reference architectures: SABSA, TOGAF security overlay, NIST Zero Trust Architecture (SP 800-207), cloud security alliance (CSA) guidance.

Secure by design: threat modeling (STRIDE, PASTA) at design phase; security requirements in SDLC; architecture review board gate.

Cloud shared responsibility: provider secures infrastructure; customer secures data, identities, configurations, and workloads; varies by IaaS/PaaS/SaaS.

Identity and access management (IAM): SSO, MFA, privileged access management (PAM), just-in-time access, role-based and attribute-based access control.

Data protection: classification, encryption at rest/in transit, key management (HSM, KMS), data loss prevention (DLP), tokenization.

Network security architecture: segmentation, next-gen firewalls, IDS/IPS, secure web gateway, SD-WAN security, SASE/SSE models.

DevSecOps: shift-left security, SAST/DAST/SCA in CI/CD, infrastructure as code scanning, container security, secrets management.

Technology transformation risks: legacy system dependencies, integration complexity, vendor lock-in, skills gaps; mitigate with pilot phases and rollback plans.

Kotter’s 8 steps: urgency, coalition, vision, communicate, empower, short-term wins, consolidate, anchor; use for security culture change.

ADKAR model: Awareness, Desire, Knowledge, Ability, Reinforcement; assess gaps at each stage for individuals and teams.

Stakeholder analysis: map influence vs. interest; tailor communication and engagement; identify champions and resisters.

Communication plan: audience, message, channel, frequency, feedback loop; repeat key messages; use storytelling and business language.

Resistance management: surface concerns early, involve skeptics in design, provide training and support, address WIIFM (what’s in it for me).

Security culture: measure via surveys (e.g., security culture framework), phishing simulations, reporting rates; leadership modeling is critical.

Training and awareness: role-based training, micro-learning, gamification; measure completion and behavior change, not just clicks.

Change readiness: assess organizational capacity, timing, and change fatigue; sequence initiatives to avoid overload.

Sustaining change: embed in performance metrics, reward adoption, update policies and processes, continuous reinforcement.

Security operations center (SOC) tiers: Tier 1 triage, Tier 2 investigation, Tier 3 threat hunting/forensics; define SLAs for detection and response.

Incident response lifecycle: preparation, detection & analysis, containment, eradication, recovery, lessons learned (NIST SP 800-61).

Mean time to detect (MTTD) and mean time to respond (MTTR) are key operational metrics; track trends and set targets.

Vulnerability management: asset inventory, scanning frequency, risk-based prioritization (CVSS + exploitability + asset criticality), remediation SLAs.

Patch management: define patch cadence by severity (e.g., critical within 15 days), test before deploy, track compliance %.

Log management and SIEM: centralize logs, define retention (e.g., 90 days hot, 1 year cold), tune use cases to reduce false positives.

Metrics hierarchy: operational (tickets, alerts), tactical (control effectiveness), strategic (risk reduction, business alignment); use SMART criteria.

Dashboards: audience-specific (executive, operational); leading and lagging indicators; avoid vanity metrics.

Continuous improvement: post-incident reviews, tabletop exercises, red team/purple team, maturity assessments; feed findings into roadmap.