Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Continuous Improvement of the Security Program
Never finished
Threats evolve, the business changes, controls degrade and people move on. A security program that stands still slowly falls behind. Continuous improvement builds learning into how the program runs, so it gets better with every cycle.
Plan-Do-Check-Act
| Step | In the security program |
|---|---|
| Plan | Set objectives and priorities; update the roadmap |
| Do | Implement and operate controls |
| Check | Measure with metrics, audits, tests, incidents and reviews |
| Act | Fix root causes; update policies, controls and plans |
This is the same cycle that drives an ISO 27001 ISMS.
Where improvement comes from
- Measurement: metrics and KRIs drifting from their targets.
- Assurance: audits, assessments and penetration tests.
- Incidents and near misses, including lessons from other organisations’ incidents.
- Exceptions and feedback: many exceptions to one control show it doesn’t fit.
- Change: new business strategy, regulation, technology or threats.
- Benchmarks: maturity assessments and peer comparisons.
Every improvement action gets an owner and a date, and is tracked to completion. The same audit finding repeating year after year means the root cause was never fixed.
Management review
Like ISO 27001’s management review, senior management periodically steps back and asks whether the program is still suitable, adequate and effective:
- held at planned intervals, at least yearly
- reviews objectives, metrics, audit results, incidents, risks and changes
- decides on improvements, resources and updated objectives
Example. At the annual management review, the leadership team notes three repeat audit findings on supplier access, rising phishing report rates and a planned acquisition. Decisions: fund an automated supplier-access tool, keep the awareness approach, and bring the acquired company into scope within 90 days.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Model for continuous improvement | Plan-Do-Check-Act |
| The same finding repeats every year | Fix the root cause |
| Who decides whether the program is suitable and effective? | Management, through management review |
| When to realign the program | When strategy, appetite, regulation or technology change |
| A proactive source of improvement | Near misses and other organisations’ incidents |
In short
- Continuous improvement follows Plan-Do-Check-Act: plan objectives, do the work, check results, act on what's learned.
- Inputs include metrics, audits, assessments, tests, incidents, near misses, exceptions, stakeholder feedback and changes in threats and the business.
- Management review, as in ISO 27001, periodically decides whether the program is still suitable, adequate and effective.
- Fix root causes, not just symptoms, and track improvement actions to completion.
- The program is re-aligned when the business strategy, risk appetite, regulation or technology changes.
- Mature programs learn from near misses and other organisations' incidents, not only their own.
Exam traps
- Improvement actions without owners and dates rarely happen.
- Repeating the same audit finding year after year means the root cause wasn't fixed.
- Waiting for an incident to drive improvement is reactive and costly.
- A program aligned to last year's strategy can drift out of alignment without anyone noticing.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Plan-Do-Check-Act
1 / 8