4.10 SR 11-06-2023 - Laserfiche WebLink

Home Browse Search

City of Elk River L3 Assessment with Roadmap Information Security Risk Assessment With S20rgOO And S2ScoreOO The S2ScoreOO, available through the SecurityStudioOO software platform is the most objective and comprehensive measurement of information security risk available in the market. It was designed by engineers at FRSecure, who average more than 15 years of information security experience, with these specific objectives in mind: • Serve as the foundational risk score and measurement. • Based on risk. The most effective way to manage information security is based on risk, not on specific controls that may ar may not fit for your organization. • Easy to understand. Easy to understand and effective are not mutually exclusive. In fact, they usually go hand in hand. The most effective information security programs are typically simple and effective. Complexity is often the enemy to good security. • Comprehensive. Information security is not an IT issue; it is a business issue. • Objective. Scaring is as objective as is possible given what we know about threats, vulnerabilities, exploits and risk in general. Each assessed control is given a risk metric based on professional opinions, best practices, and real-life data. • Clear and free from technical jargon. Terms like "NextGen", "Internet of Things" (IoT), "Advanced Persistent Threats" (APT), eta are all avoided as much as possible. • Industry accepted and credible. The assessment leverages and references current security framewarks and standards such as ISO/IEC 27001:2013 and the NIST Cybersecurity Framewark (CSF). This is very good news for organizations that have built their information security programs per one or more of these framewarks and helps to lend to the credibility of the assessment. • One-stop. The type of assessment that can be used to measure the ei�ectiveness of the security program, provide high-quality next steps (or recommendations), demonstrate regulatory compliance (HIPAA, GLBA, and others), and allow for etfective cyber insurance underwriting * *NOTE: The S2ScoreOO is approved for cyber insurance underwriting submission through Node International and Lloyd's of London. Check with your governing authority to ensure an "update" assessment is compliant before conducting this type of assessment. * Updates must be performed within 12 months upon receipt of deliverables from the previous S20rg * Major infrastructure changes, mergers/acquisitions or other fundamental changes to the environment will require a re-scoping of the project. The S20rgU Assessment is built to be the definitive and best information security risk assessment methodology available with reporting designed to be easy to manage and actionable. Each phase, control category, control subcategory, and the overall S20rgOO assessment is calculated based upon 1. The size of the organization 2. The industry in which the organization operates 3. Historical threat and incident data obtained from a variety of source. Scope The intended scope far the S20rgOO is the entire organization. Information security is a very broad topic so to ensure a comprehensive assessment, that is still easy to understand, the S20rgOO assessment is segmented into four (4) phases. In-Person Assessment Remote Assessment Assessor does an on-premise walkthrough of the facility. Assessor requests a look at key areas of the facility from staff over video Review includes a facility walkthrough and the Assessor is able to conference. validate controls such as: Review includes what client provides the assessor a view of. * facility visitor process. Recommended for clients that have had an independent security review within * clear desk/clear screen practices. the last 12 months. * doors to sensitive areas are locked. No travel costs. * other exceptions from policy. Client covers assessar travel costs. CONFIDENTIAL INFORMATION Tltis document may contain information that is privileged, confidential or otherwise protected from disclosure. Dissemination, dis[ribution or copying of this document or the information herein is prohibi[ed without prior permission of FRSecure. Copyright 2022 FRSecure LLC, All Ri@iu`� ResPrv¢d. Document ID: FRSQ 5515