Example of a Management Objective Part 2

00:00

Let's talk about an example of a management objective

00:04

in this video. We're going to talk about a P 0 13 management objective example, and we're going to talk about it with respect to process, organizational structures, information and people skills and competencies. We're also going to talk about how each component in the goals cascade contributes to the fulfillment of this management objective.

00:26

So let's take an example objective from the A p o Domain.

00:30

We'll talk about the 13th objective which has managed security.

00:34

The description of this objective is to ensure that an information security management system is implemented within an enterprise and done so efficiently.

00:43

The purpose of this objective is to minimize the impact and occurrence of security incidents well within the realm of the enterprises risk appetite levels.

00:53

The enterprise goals that support this management objective is to manage business risk and to allow for business service, continuity and availability of I T systems, re sources and information

01:04

This alliance with the alignment goals of the overall security of information I t infrastructure applications and privacy of data and processes.

01:15

Example metrics for the enterprise goal of manage security includes the number of customer service or business process interruptions.

01:23

An example metric oven alignment goal would be the number of confidentiality related cyber incidents that caused loss, business disruptions or public embarrassment.

01:34

Let's take a look at the first enabler or component of this objective, which is the process.

01:41

There are multiple processes within the A P 0. 13 objective. We'll take a look at the first process for this management objective a p 0. 13.1.

01:49

There are three different process components that relate to this objective.

01:53

The three processes are establishing and maintaining an information security management system, defining and managing, managing an information security and privacy risk treatment plan and monitoring and reviewing the information security management system.

02:10

This components management practice is to establish and maintain an information security management system.

02:16

This is to manage the risk of cyber security related incidents and ensure that this risk falls well within the risks that enterprises risk appetite.

02:25

It is to manage the security system and safeguard it against loss of confidentiality, availability, financial loss and public embarrassment or harm to the business's reputation.

02:38

The example metrics for this component can be the level of stakeholder satisfaction with the security plan.

02:44

For example, do stakeholders believe this plan will uphold the ideal risk and should it fall within the acceptable risk level defined by the business?

02:53

The activities for this component include defining the scope and boundaries of the SMS,

02:59

defining the management system, aligning it with the overall enterprise approach to the management of security, obtaining management authorization, preparing and maintaining a statement of applicability, describing the scope of this system,

03:14

defining and communicating security, management and the roles involved in it and communicating the overall approach.

03:22

It's important to note that the current capability level of the SMS and related activities

03:28

at what level is the organisation's I SMS already functioning

03:31

define the capability level and included in the governance program documentation.

03:37

The related guidance to this process is Eitel version three missed 853 Revision five and there is a section for detailed guidance on where to specifically defined guidance.

03:51

Let's talk about how organizational structures is a component of this management objective.

03:55

For the organ organizational structure, you will relay the key management practice which we discussed earlier in this process component.

04:03

The three process components are establishing and maintaining an I S M s defining and managing information, security and privacy risk treatment plan and monitoring and reviewing the SMS.

04:16

We will then relate that back to the organizational role and assign who was accountable and who was responsible

04:23

list at the organizational structures that will be included in this objective and key governance practices of evaluating, directing and monitoring risk management for overall insured risk optimization.

04:35

In this example, Chief information security officer is accountable for these management practices, and the chief information officer is the one responsible.

04:45

You'll also want a layout related guidance and detailed reference of where you can find what specifically relates to the accountability and responsibility of key governance practices

04:57

in the information, flows and items component of this management objective. We're referring back to the three management practice processes which are to evaluate and maintain an I. S. M s define and manage and information security and privacy treatment plan and monitoring and reviewing

05:13

correspondingly will have inputs and outputs of information and information flows.

05:18

The inputs for establishing and maintaining in I SMS, or a P 0 13.1, will be the enterprise security approach, and it's corresponding. Output will be the SMS scope statement, which defines what is in scope and what is out of scope for this security system

05:34

in regards to defining and managing and information security and privacy risk treatment plan. The input will be the gaps and changes required to get to a target capability that is within the risk appetite levels.

05:47

Then the output will be an information security risk treatment plan to mitigate those gaps and implement changes

05:55

in relation to monitoring and reviewing the SMS. The input will be prioritized incidents and service requests.

06:02

The output will be an SMS audit report that continually monitors and reviews Enterprise security

06:10

in this component will also talk about related guidance and detailed reference of where to find information that helps with this management objective.

06:18

Do you now see how management practices defined in the process Component affects the inputs and outputs that contribute to the overall objective of management information security.

06:30

Let's keep going with people, skills and competencies

06:34

in this component of the governance objective of managing information, security will address the skills needed to fulfill the objective.

06:43

The skills would be information security and information security, strategy, development.

06:48

As in other places, there's a related guidance listed here and the detailed reference

06:55

that should be included of where to find specific skills and competencies that relate to supporting this objective.