book

The Cybersecurity Guide to Governance, Risk, and Compliance

by Jason Edwards, Griffin Weaver

May 2024

Intermediate to advanced

672 pages

22h 23m

English

Wiley

Read now

Unlock full access

UNDERSTANDING GRCTHE BUSINESS CASE FOR GRCGOVERNANCE: LAYING THE FOUNDATIONRISK MANAGEMENT: MANAGING UNCERTAINTIESCOMPLIANCE: ADHERING TO REGULATIONS AND STANDARDSTHE INTERSECTION OF GOVERNANCE, RISK, AND COMPLIANCEGRC FRAMEWORKS AND STANDARDSGRC TOOLS AND TECHNOLOGIESBUILDING A GRC CULTURETHE ROLE OF GRC IN STRATEGIC PLANNING
COMPREHENSIVE OVERVIEW OF CYBERSECURITY MATURITYCYBERSECURITY IN THE FINANCIAL INDUSTRYCYBERSECURITY IN THE HEALTHCARE INDUSTRYCYBERSECURITY IN THE GOVERNMENT SECTORCYBERSECURITY IN SMALL TO LARGE ENTERPRISES
THE ESSENTIAL TRAITS OF A CYBERSECURITY LEADERBUILDING AND LEADING EFFECTIVE CYBERSECURITY TEAMSADAPTING TO EMERGING TRENDS IN CYBERSECURITY LEADERSHIPSTRATEGIC DECISION‐MAKING IN CYBERSECURITY LEADERSHIPDEVELOPING THE NEXT GENERATION OF CYBERSECURITY LEADERSPERSONAL DEVELOPMENT FOR CYBERSECURITY LEADERSINCIDENT MANAGEMENT AND CRISIS LEADERSHIPLEADING CYBERSECURITY CULTURE AND AWARENESSTHE ETHICAL DIMENSION OF CYBERSECURITY LEADERSHIPBALANCING BUSINESS OBJECTIVES AND CYBERSECURITYLEARNING FROM MILITARY LEADERSHIPFUTURE TRENDS AND PREPARING FOR WHAT'S NEXT
PROGRAM AND PROJECT MANAGEMENT IN CYBERSECURITYTYPES OF CYBERSECURITY PROJECTSPROJECT MANAGEMENT FUNDAMENTALS APPLIED TO CYBERSECURITYAGILE PROJECT MANAGEMENT FOR CYBERSECURITYMANAGING CYBERSECURITY PROGRAMSCOMMUNICATION AND COLLABORATION IN CYBERSECURITY PROJECTSA GUIDE FOR PROJECT MANAGERS IN CYBERSECURITY
WHY BUSINESS EXECUTIVES NEED TO BE INVOLVED IN CYBERSECURITYROLES AND RESPONSIBILITIES OF BUSINESS EXECUTIVES IN CYBERSECURITYEFFECTIVE COLLABORATION BETWEEN BUSINESS EXECUTIVES AND CYBERSECURITY TEAMSKEY CYBERSECURITY CONCEPTS FOR BUSINESS EXECUTIVESINCORPORATING CYBERSECURITY INTO BUSINESS DECISION‐MAKINGDEVELOPING A CYBERSECURITY RISK APPETITETRAINING AND AWARENESS FOR BUSINESS EXECUTIVESLEGAL AND REGULATORY CONSIDERATIONS FOR BUSINESS EXECUTIVESTHE FUTURE OF BUSINESS EXECUTIVE ENGAGEMENT IN CYBERSECURITY
THE CRITICAL ROLE OF THE BOARD IN CYBERSECURITYPERSPECTIVES FROM THE BOARD OF DIRECTORSPERSPECTIVES FROM CYBERSECURITY EXECUTIVESTHE BOARD'S RESPONSIBILITIES IN CYBERSECURITYEFFECTIVE COMMUNICATION BETWEEN THE BOARD AND CYBERSECURITY EXECUTIVESSPECIFIC RECOMMENDATIONS FOR REPORTING TO THE BOARDINSIGHTS FROM THE FFIEC AND OTHER STANDARDS ON BOARD INVOLVEMENTCYBERSECURITY GOVERNANCE: EMBEDDING CYBERSECURITY IN CORPORATE CULTURELEGAL AND REGULATORY CONSIDERATIONS FOR THE BOARDTHE FUTURE OF BOARD INVOLVEMENT IN CYBERSECURITY
RISK MANAGEMENT IN THE BUSINESSUNDERSTANDING THE RISK MANAGEMENT LIFE CYCLEFFIEC HANDBOOKS AND RISK MANAGEMENT GUIDANCEGOVERNANCE AND RISK MANAGEMENT FRAMEWORKRISK APPROVALS AND THE ROLE OF COMMITTEESRISK IDENTIFICATION AND ANALYSISTHIRD‐PARTY RISK MANAGEMENTREGULATORY EXPECTATIONS FOR THIRD‐PARTY RISK MANAGEMENTCOMPLIANCE AND LEGAL RISK MANAGEMENTMONITORING AND REPORTING
THE NIST RISK MANAGEMENT FRAMEWORKUNDERSTANDING RMF'S AUTHORIZATION PROCESSNIST RMF IN PRACTICE: STEP‐BY‐STEP ANALYSISAPPLICABILITY TO REGULATORY EXPECTATIONSINTEGRATING NIST RMF INTO AN ORGANIZATIONUSING NIST RMF FOR RISK ASSESSMENT AND MANAGEMENTNIST RMF AND TECHNOLOGY IMPLEMENTATIONCHALLENGES AND SOLUTIONS IN IMPLEMENTING NIST RMFNIST RMF AND THIRD‐PARTY RISK MANAGEMENTSAMPLE RMF AUTHORIZATION DOCUMENT PACKAGE
UNDERSTANDING CYBERSECURITY METRICSTHE IMPORTANCE OF METRICS IN CYBERSECURITYTHE ROLE OF METRICS IN DECISION‐MAKING AND RESOURCE ALLOCATIONDIFFERENTIATING BETWEEN KPIs AND KRIsTHE ROLE OF METRICS IN COMPLIANCECHALLENGES AND CONSIDERATIONSKEY PERFORMANCE INDICATORS (KPIs)KEY RISK INDICATORS (KRIs)INTEGRATING KPIs AND KRIs INTO CYBERSECURITY STRATEGY
THE IMPORTANCE OF RISK ASSESSMENTSTHE FFIEC's PERSPECTIVE ON RISK ASSESSMENTSNIST's APPROACH TO RISK ASSESSMENTSRISK ASSESSMENT FRAMEWORKSCONDUCTING A CYBERSECURITY RISK ASSESSMENTMANAGING THIRD‐PARTY RISKSCHALLENGES AND BEST PRACTICES IN RISK ASSESSMENTSRISK ASSESSMENT TEMPLATE EXAMPLE
BACKGROUND ON THE NIST CSFCORE FUNCTIONS AND CATEGORIESIMPLEMENTATION TIERSPROFILESIMPLEMENTATION
ISO/IEC 27001: INFORMATION SECURITY MANAGEMENTCOBIT (CONTROL OBJECTIVES FOR INFORMATION AND RELATED TECHNOLOGIES)CMMC (CYBERSECURITY MATURITY MODEL CERTIFICATION)CIS (CENTER FOR INTERNET SECURITY) CONTROLSPCI DSS (PAYMENT CARD INDUSTRY DATA SECURITY STANDARD)ICFR (INTERNAL CONTROL OVER FINANCIAL REPORTING)CLOUD SECURITY ALLIANCE CONTROLSISO 27017: CODE OF PRACTICE FOR INFORMATION SECURITY CONTROLSISO 27701: PRIVACY INFORMATION MANAGEMENTCOMPARING AND INTEGRATING DIFFERENT CYBERSECURITY FRAMEWORKSFUTURE TRENDS IN CYBERSECURITY FRAMEWORKSTOP STRENGTHS OF EACH FRAMEWORK
OVERVIEW OF NIST SP 800‐53STRUCTURE AND ORGANIZATION OF NIST SP 800‐53UNDERSTANDING CONTROLS AND CONTROL FAMILIESNIST 800‐53 CONTROL FAMILIES AND DESCRIPTIONS
FFIEC HISTORY AND BACKGROUNDROLE AND RESPONSIBILITIESUNDERSTANDING THE FFIEC EXAMINATION HANDBOOKSTHE FFIEC CYBERSECURITY ASSESSMENT TOOL (CAT)THE FFIEC AUDIT HANDBOOKTHE FFIEC BUSINESS CONTINUITY HANDBOOKTHE FFIEC DEVELOPMENT AND ACQUISITION HANDBOOKTHE FFIEC INFORMATION SECURITY HANDBOOKTHE FFIEC MANAGEMENT HANDBOOKTHE ARCHITECTURE, INFRASTRUCTURE, AND OPERATIONS HANDBOOKTHE OUTSOURCING TECHNOLOGY SERVICES HANDBOOKTHE RETAIL PAYMENT SYSTEMS HANDBOOKTHE SUPERVISION OF TECHNOLOGY SERVICE PROVIDERS HANDBOOKTHE WHOLESALE PAYMENT SYSTEMS HANDBOOK
GRAMM–LEACH–BLILEY ACT (GLBA)THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)INTERAGENCY GUIDELINES ESTABLISHING INFORMATION SECURITY STANDARDS (12 CFR 30 PART B)PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)SARBANES–OXLEY ACT (SOX)THE CLOUD ACTINTERNAL REVENUE SERVICE PUBLICATION 1075CRIMINAL JUSTICE INFORMATION SERVICES (CJIS) SECURITY POLICYDEFENSE FEDERAL ACQUISITION REGULATION SUPPLEMENT (DFARS)DEPARTMENT OF DEFENSE CLOUD COMPUTING SECURITY REQUIREMENTS GUIDEFAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT (FERPA)SEC RULES 17A‐4 AND 18A‐6SECTION 508FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA)FEDERAL INFORMATION PROCESSING STANDARD (FIPS) 140‐2
STATE‐LEVEL CYBERSECURITY REGULATIONSHARMONIZING STATE AND FEDERAL COMPLIANCEFUTURE DEVELOPMENTSNOTABLE STATE REGULATIONS
INTERNATIONAL CYBERSECURITY LAWSGENERAL DATA PROTECTION REGULATION (GDPR) – EUROPEAN UNIONPIPEDA – CANADATHE DATA PROTECTION ACT – UNITED KINGDOMTHE CYBERSECURITY LAW – CHINATHE PERSONAL DATA PROTECTION ACT – SINGAPOREOTHER NOTABLE INTERNATIONAL CYBERSECURITY LAWSCOORDINATING GLOBAL CYBERSECURITY COMPLIANCE EFFORTS
THE INTERSECTION OF PRIVACY AND CYBERSECURITYPRIVACY AND DATA PROTECTIONKEY PRIVACY PRINCIPLESPRIVACY LAWS IN THE UNITED STATESINTERNATIONAL PRIVACY LAWS AND REGULATIONSPRIVACY BY DESIGN AND BY DEFAULTCHALLENGES IN MAINTAINING PRIVACY AND SECURITY COMPLIANCETOOLS AND FRAMEWORKS FOR PRIVACY MANAGEMENTEXAMPLE PRIVACY IMPACT ASSESSMENT
THE EVOLVING ROLE OF AUDITORS IN CYBERSECURITYUNDERSTANDING CYBERSECURITY: ESSENTIAL CONCEPTS FOR AUDITORSTHE AUDIT CHARTER AND AUDIT ENGAGEMENTRISK‐BASED AUDITING APPROACH IN CYBERSECURITYEVALUATING INTERNAL CONTROLS FOR CYBERSECURITYTESTING AND SAMPLING TECHNIQUES IN CYBERSECURITY AUDITINGCOMPLIANCE WITH LEGAL AND REGULATORY REQUIREMENTSREPORTING AND COMMUNICATION OF AUDIT FINDINGSCONSIDERATION OF THIRD‐PARTY RELATIONSHIPSQUALITY ASSURANCE AND IMPROVEMENT PROGRAMPROFESSIONAL ETHICS, SKILLS, AND CONTINUING EDUCATIONBEST PRACTICES FOR CYBERSECURITY EXECUTIVES AND TEAMS WHEN INTERFACING WITH AUDITORS
THE PARAMOUNT ROLE OF THE REGULATOR IN CYBERSECURITYIDENTIFYING KEY FOCUS AREAS IN CYBERSECURITY FOR REGULATORSUTILIZING FFIEC WORK PAPERS EFFECTIVELYDEVELOPING EFFECTIVE COMMUNICATION STRATEGIESCONTINUOUS IMPROVEMENT AND ADAPTATION FOR REGULATORSSTAYING INFORMED AND CONTINUOUSLY LEARNING AS REGULATORSPROVIDING SUPPORT AND GUIDANCE TO THE BUSINESSCHALLENGES FACED BY REGULATORS AND HOW TO OVERCOME THEMREGULATORY EXCELLENCE AND FORWARD‐LOOKING LEADERSHIPBECOMING A REGULATOR: SELECTION, EDUCATION, AND CAREER PATHSBALANCING OBJECTIVITY AND ADVOCACY
FEDERAL FINANCIAL INSTITUTIONS EXAMINATION COUNCIL (FFIEC)OFFICE OF THE COMPTROLLER OF THE CURRENCY (OCC)BOARD OF GOVERNORS OF THE FEDERAL RESERVE SYSTEMFEDERAL DEPOSIT INSURANCE CORPORATION (FDIC)CONSUMER FINANCIAL PROTECTION BUREAU (CFPB)SECURITIES AND EXCHANGE COMMISSION (SEC)FINANCIAL INDUSTRY REGULATORY AUTHORITY (FINRA)NATIONAL CREDIT UNION ADMINISTRATION (NCUA)THE FEDERAL TRADE COMMISSIONONLINE REGULATORY RESOURCES
REGULATORY VISITS AND REQUESTS FOR INFORMATIONPREPARING FOR REGULATORY VISITSRESPONDING TO REQUESTS FOR INFORMATIONBEST PRACTICES DURING REGULATORY VISITSDEVELOPING INTERNAL PROCESSES FOR MANAGING REGULATORY REQUESTSBUILDING AND MAINTAINING RELATIONSHIPS WITH REGULATORS
OVERVIEW OF REGULATORY PENALTIESREGULATORY PENALTIES AND ENFORCEMENT ACTIONSUNDERSTANDING THE AUTHORITY BEHIND ENFORCEMENT ACTIONSTHE IMPORTANCE OF UNDERSTANDING PENALTIES AS PART OF COMPLIANCE EFFORTSMATTERS REQUIRING ATTENTION (MRAS)CONSENT ORDERSCIVIL MONEY PENALTIES (CMPS)CEASE AND DESIST ORDERSOTHER ENFORCEMENT ACTIONSOTHER ENFORCEMENT ACTIONS
RECEIVING AND REVIEWING REGULATORY FEEDBACK AND FINDINGSCREATING A REMEDIATION PLANALLOCATING RESOURCES AND RESPONSIBILITIES FOR REMEDIATIONMONITORING PROGRESS AND COMPLIANCEREPORTING BACK TO THE REGULATOREXAMPLE REGULATORY FINDING REMEDIATION PLAN
CYBERSECURITY ARCHITECTUREFUNDAMENTAL CONCEPTSARCHITECTURAL COMPONENTS AND LAYERSSECURITY REFERENCE MODELS AND FRAMEWORKSBUILDING AND EVOLVING CYBERSECURITY ARCHITECTUREADAPTING ARCHITECTURE TO EMERGING THREATS
RISK MITIGATION BASICSPOLICIES, STANDARDS, AND PROCEDURESINVENTORY AND CLASSIFICATION OF ASSETSMITIGATING INTERCONNECTIVITY RISKUSER SECURITY CONTROLSPHYSICAL SECURITYNETWORK CONTROLSCHANGE MANAGEMENT WITHIN THE IT ENVIRONMENTEND‐OF‐LIFE MANAGEMENT
CLOUD COMPUTINGMAJOR CLOUD SERVICE PROVIDERSTYPES OF CLOUD SERVICESCLOUD SECURITY CHALLENGESSECURITY TOOLS AND TECHNIQUES FOR CLOUD ENVIRONMENTSCLOUD SECURITY STANDARDS AND BEST PRACTICESFUTURE TRENDS IN CLOUD SECURITY
UNRAVELING THE AI‐CYBERSECURITY CONUNDRUMA HISTORICAL TAPESTRY: TRACING THE ORIGINS AND EVOLUTION OF AITHE AI REVOLUTION: TRANSFORMING CYBER DEFENSEAI‐POWERED CYBERSECURITY SOLUTIONSTHE CISO'S AI PREPARATION CHECKLIST
QUANTUM COMPUTING – AN EMERGING PARADIGM IN CYBERSECURITYTHE QUANTUM‐CRYPTOGRAPHY NEXUS: A SHIFT IN THE CYBERSECURITY PARADIGMTHE QUANTUM RACE: STRATEGIC AND SECURITY IMPLICATIONSTHE CISO'S QUANTUM PREPARATION CHECKLIST
PLANNING AND PREPAREDNESSDETECTING AND ANALYZING INCIDENTSCONTAINMENT, ERADICATION, AND RECOVERYCOMMUNICATION AND REPORTING REQUIREMENTSWORKING WITH LEGAL FIRMSEXAMPLE CYBERSECURITY INCIDENT RESPONSE PLAN – FOR NexTech CORPORATION
CYBER INSURANCE: A PRIMER FOR BUSINESSESEXPLORING THE USES AND MISUSES OF CYBER INSURANCETHE COMPLEX DANCE OF CLAIM SETTLEMENT: UNRAVELING THE TRUTH
STRUCTURE OF KRIS