Nov 13, 2023
Planning for your company's operations in the coming 24 months, 36 months, or even 5 years requires a clear long-term vision. But how do you turn that vision into a tangible working model? To navigate this transformation, expert facilitation and a solid understanding of your current state are essential.
In this article, you’ll find a carefully curated list of questions to assist you in developing a comprehensive cyber security Target Operating Model (TOM). The categories explored here cover a wide range of critical cyber security areas; delve into each section or skip ahead below:
- IAM (Identity Access Management)
- IGA (Identity Governance and Administration)
- PAM (Privilege Access Management)
- CIAM (Customer Identity and Access Management)
- SIEM (Security Information and Event Management)
- SOAR (Security Orchestration, Automation and Response)
- SOC (Security Operations Centre)
- ITSM (IT Service Management)
- ITDR (IT Disaster Recovery)
Creating a resilient cyber security Target Operating Model (TOM)
By considering and addressing these questions, you'll be well-prepared to set the environment for creating a robust and effective cyber security target operating model that ensures the security and integrity of your organization's systems and data.
IAM - Identity Access Management
- What is our current approach to managing user identities and access permissions within the organization?
- How can we enhance user authentication and authorization processes to ensure better security?
- Are there specific role-based access control policies we need to implement?
- How do we plan to address user lifecycle management, including onboarding, changes, and offboarding?
- What technologies or tools do we need to improve IAM practices?
IGA - Identity Governance and Administration
- How do we currently govern and administer user identities and their associated permissions?
- Are there clear policies and procedures in place for managing user access?
- What methods do we use for certification and attestation of user access rights?
- How do we ensure compliance with regulatory requirements related to identity management?
- What technology solutions and tools can enhance our IGA capabilities?
PAM - Privilege Access Management
- How are we currently managing and monitoring privileged access to critical systems and data?
- What measures can we take to secure privileged accounts and reduce the risk of unauthorized access?
- Do we have a strategy for auditing and reviewing privileged access?
- What automation and integration efforts can improve PAM for our organization?
- How do we plan to train and educate employees on the importance of PAM practices?
CIAM - Customer Identity and Access Management
- How are we currently managing customer identities and access to our online services?
- What measures can we implement to enhance the security of customer accounts and personal data?
- How do we balance user convenience with security in our CIAM practices?
- Are there privacy compliance considerations (e.g., GDPR) that we need to address?
- What improvements can we make to streamline the customer registration and authentication processes?
SIEM - Security Information and Event Management
- How are we currently monitoring and analyzing security events and incidents?
- What sources of security data are we collecting, and how can we optimize data ingestion?
- Do we have effective incident detection and response workflows in place?
- What integration efforts can improve our SIEM's effectiveness?
- How often do we review and update our SIEM configurations and rules?
SOAR - Security Orchestration, Automation, and Response
- What security processes and tasks can be automated to improve incident response times?
- Do we have a centralized incident response platform, and how can it be optimized?
- Are there specific security use cases that could benefit from orchestration and automation?
- How can we integrate SOAR with our existing security tools and systems?
- What metrics do we use to measure the effectiveness of our SOAR capabilities?
SOC - Security Operations Centre
- What is the current structure and function of our Security Operations Center (SOC)?
- How do we handle security incidents, and what is the escalation process?
- Are there gaps in our SOC's capabilities, and how can we fill them?
- What skillsets and training do our SOC personnel need to stay effective?
- How do we ensure 24/7 monitoring and response coverage for security events?
ITSM - IT Service Management
- How do we incorporate cyber security considerations into our IT service management practices?
- Are there specific incident and change management processes that need to be aligned with security?
- What role does ITSM play in supporting the overall cyber security strategy?
- How do we prioritize and respond to security-related service requests?
- How can we improve collaboration between ITSM and cyber security teams?
ITDR - IT Disaster Recovery
- Do we have a comprehensive IT disaster recovery plan in place, and when was it last updated?
- How do we identify critical IT systems and data that need to be prioritized in recovery efforts?
- What is the RTO (Recovery Time Objective) and RPO (Recovery Point Objective) for our critical systems?
- How do we test and validate our ITDR plan regularly to ensure its effectiveness?
- What roles and responsibilities are defined within our ITDR plan, and how do we ensure clear communication during a disaster event?
- What offsite backup and data replication strategies are in place to safeguard critical data?
- How do we coordinate ITDR efforts with other aspects of cyber security and incident response?
In summary
Improve your company's security posture with the expertise of seasoned professionals. Wherever you are in your journey, Stott and May Consulting provide a range of services to support organizations in making technology transformation more productive. Find out more and get in touch to see how we can deliver your technology initiatives with predictable precision here.
