STARTING A SECURITY PROGRAM FROM SCRATCH (OR RE-STARTING)

Summary from the TLDR InfoSec newsletter

This post provides a roadmap for growing a new or existing program through four phases of maturity. The first phase focuses on establishing the basics by appointing a Head of Security, establishing a governance process, conducting a breach assessment, and acting on the most critical results. The second phase focuses on comparing the organization's current state with established frameworks, developing a plan to close gaps, hiring MSSPs, and building a team. Phases 3 and 4 focus on furthering organizational maturity by establishing program management and aligning with business objectives, establishing continuous monitoring and guardrails, increasing resiliency, and training the team.