Structuring the Chief Information Security Officer ...
Structuring the Chief Information Security Officer Organization
Julia H. Allen Gregory Crabb (United States Postal Service) Pamela D. Curtis Brendan Fitzpatrick Nader Mehravari David Tobar
September 2015
TECHNICAL NOTE CMU/SEI-2015-TN-007
CERT? Division
Copyright 2015 Carnegie Mellon University
This material is based upon work funded and supported by USPS under Contract No. FA8721-05-C0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center sponsored by the United States Department of Defense.
Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of USPS or the United States Department of Defense.
This report was prepared for the SEI Administrative Agent AFLCMC/PZM 20 Schilling Circle, Bldg. 1305, 3rd floor Hanscom AFB, MA 01731-2125
NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
This material has been approved for public release and unlimited distribution except as restricted below.
Internal use:* Permission to reproduce this material and to prepare derivative works from this material for internal use is granted, provided the copyright and "No Warranty" statements are included with all reproductions and derivative works.
External use:* This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other external and/or commercial use. Requests for permission should be directed to the Software Engineering Institute at permission@sei.cmu.edu.
* These restrictions do not apply to U.S. government entities.
Carnegie Mellon? and CERT? are registered marks of Carnegie Mellon University.
DM-0002696
Table of Contents
Acknowledgments
vii
Abstract
ix
1 Introduction
1
2 Define Subfunctions, Activities, and Departments
3
2.1 Process
3
2.2 Departments, Subfunctions, and Activities
7
3 Derive and Describe the CISO Organizational Structure
11
3.1 Derive
11
3.2 Describe
11
3.2.1 Program Management
11
3.2.2 Security Operations Center
12
3.2.3 Emergency Operations and Incident Command
13
3.2.4 Security Engineering and Asset Security
13
3.2.5 Information Security Executive Council
15
4 Sizing the CISO Organization
16
5 Recommended Next Steps
18
Appendix A: Mappings of Functions, Departments, Subfunctions, and Activities
19
Appendix B: Complete List of Source Acronyms
29
Bibliography
33
CMU/SEI-2015-TN-007 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY
i
CMU/SEI-2015-TN-007 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY
ii
List of Figures
Figure 1: Four CISO Functions
2
Figure 2: Process for Deriving a CISO Organizational Structure
4
Figure 3: CISO Organizational Structure
11
CMU/SEI-2015-TN-007 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY
iii
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related searches
- chief business development officer duties
- navy chief information security officer
- chief business development officer salary
- information security officer job description
- bank information security officer duties
- information systems security officer job description
- bank information security officer role
- chief information security officer responsibilities
- chief information security officer requirements
- chief information security officer jobs
- chief security officer job qualifications
- chief security officer salary