4.10 SR 11-06-2023 - Laserfiche WebLink

Home Browse Search

City of Elk River L3 Assessment with Roadmap The four phases of a S20rgOO assessment are: • Phase 1: Administrative Controls — The "people" part of security, including risk management, security governance, policies, standards, training and employee awareness. • Phase 2: Physical Controls — Physical controls are an essential and often overlooked part of your security strategy. How much does your anti-virus protection mean to you if someone steals your server? • Phase 3: Technical Controls (Internal) — We ai�ectionately call this "the gooey center". Most organizations do a pretty good job at securing the technical perimeter (firewalls, intrusion detection, etc.), but sometime neglect the controls that are essential for an effective defense-in-depth strategy. • Phase 4: Technical Controls (External) — This category covers how effective your organization is at securing the perimeter of your netwark. The S20rgTM process and simple and efficient. We understand that our clients have other wark to do, so the process needs to be focused and time- sensitive. Each phase of the S20rgOO assessment is slightly different in the manner that information is gathered and assessed. Phase 1— Administrative Security Controls Assessment Administrative Controls form the framewark far managing an etfective security program and they are sometimes referred to as the "human" part of information security. Administrative Controls inform people on how organizational leadership expects day-to-day operations to be conducted and they provide guidance on what actions or activities warkforce members are expected to perform. Common Administrative Controls include policies, awareness training, guidelines, standards, and procedures. Administrative Controls are derived ti�om the NIST Cybersecurity Framewark (CSF), ISO/IEC 27001:2013, NIST SP 800-53, and the CIS Critical Security Controls for reference, comparison, gap analysis, and risk rating. Where there are applicable gaps, the following metrics are applied using the S20rgOO proprietary algorithm: • Information Security Maturity ("ISM") - a measure of control quality and maturity, • Likelihood of an adverse event or realized threat, and the potential lmpact suffered by the organization; resulting in a Risk Rating. CONFIDENTIAL INFORMATION .. Tltis document may contain information that is privileged, confidential or otherwise protected from disclosure. Dissemination, dis[ribution or copying of this document or the information herein is prohibi[ed without prior permission of FRSecure. Copyright 2022 FRSecure LLC, All Ri@iu`� ResPrv¢d. Document ID: FRSQ 5515