4.10 SR 11-06-2023 - Laserfiche WebLink

Home Browse Search

City of Elk River L3 Assessment with Roadmap S20rg� Roadmap The primary purpose of the Security Program Roadmap is to empower you to be able to choose which tasks you want to take on and which tasks you want to assign to ea� ternal resources, and provide a strategic Roadmap for completion of all tasks. All actions are measurable and easily communicated. �nternal Risks frl e�nt i�ed � vC15� � MSP � �Ctwtsaurce Y l J 5�uri#y Rla �d�pl Improvement comes through putting the recommendations from the assessment into practice by: 1. Making risk-based decisions about what to do with each recommendation. 2. Assigning responsibility for actions that must be taken. 3. Determiiung the priority for such actions and assigning deadlines/timelines. Activities far the Roadmap are driven ti�om the S20rgOO assessment. The FRSecure Analyst creates the initial roadmap (or plan) for your information security program over the next 12, 24, and 36 months The Security Program Roadmap tackles the planning of "what", "who", and "when" far information security improvement: What are we going to do with each of the findings and recommendations from the S20rgOO ? There are four viable options for decision- making: Accept — the risk "as-is" and take no corrective actions but continue to monitor the risk • Mitigate — the risk and do what the recommendation says (or similar) • 1 ransfer — the risk and/or defer it far insurance (or similar) • Avoid — the risk and stop doing the actions that led to the risk in the first place Who is going to do the actions and carry out the decisions that were made? Decisions such as"Mitigate" and "Avoid" made in the previous step will require somebody to do something. Some of the tasks and/or projects can be done internally with your own resources and some of the tasks and/or projects will require outside assistance. Those tasks and/or projects that require outside assistance can be assigned to the vCISO (Step 4) and some of the tasks and/or projects can be assigned to another party. When will the actions need to be taken to achieve your goals? It's best to assign the tasks and/or projects to a timeline based on quarters to accommodate day-to-day operational challenges along the way. The information ti�om S20rgOO and the Roadmap can be easily communicated to stakeholders (Board of Directors, executive management, exasnixiers/regulators, customers, etc.) includes: • What our current S2ScoreOO is. • What our S2ScoreOO goal is. • What tasks and/or projects are necessary to meet objectives. CONFIDENTIAL INFORNIATION Tltis document may contain information that is privileged, confidential or otherwise protected from disclosure. Dissemination, dis[ribution or copying of this document or the information herein is prohibi[ed without prior permission of FRSecure. Copyright 2022 FRSecure LLC, All Ri@iu`� ResPrvad. Document ID: FRSQ 5515