Deura Information Security Consulting LLC (DISC) offers services in Cyber Security, ISO 27001 (ISMS), ISO 27701 (PIMS), ISO 22301 (BCMS), NIST CSF, GDPR, CCPA, PCI DSS and HIPAA compliance solutions in information security and protection controls to meet industry security standards. DISC specializes in ISO implementation and helps to build Management Systems (ISMS), (PIMS) and (BCMS) to achieve certification.  We focus on delivering comprehensive solutions to businesses of all sizes in the area of information security and compliance. DISC is a trusted North Bay business that provides a reliable information security solutions tailored to individual business needs and our mantra is securing the business.

                                                               Risk Management Life Cycle Process

We analyze your current information security management system in relation to industry standards, and our recommendations are based on industry regulations and your business needs.  We protect the bottom line of businesses by mitigating potential risks, and by keeping it safe from business limiting incidents. DISC helps customers with short term information security goals and developing successful long term strategic information security business plan. You will know where to focus your time and resources with DISC roadmap.

Many SMB companies are seeking InfoSec advisors. Are you interested?

DISC InfoSec vCISO as a Service 

  DISC Main Services

Information Security Strategic Plan:

Information Security Strategic planning is about setting long-term goals, establishing the directions and constraints, which allows executives, management and employees to see where they are expected to go, focus their efforts in the right direction.

What’s Included in an Information Security Strategic Plan?

An information security strategic plan can position an organization to mitigate, transfer, accept or avoid information risk related to people, processes and technologies. An established strategy also helps the organization adequately protect the confidentiality, integrity and availability of information. The business benefits of an effective information security strategic plan are significant and can offer a competitive advantage. These may include complying with industry standards, avoiding a damaging security incident, sustaining the reputation of the business and supporting commitment to shareholders, customers, partners and suppliers.

An information security strategic plan include:

• Defining consistent and integrated methodologies for design, development and implementation;
• Detecting and resolving problems;
• Proactively making decisions to more efficiently deliver results;
• Eliminating redundancy to better support achievement of objectives;
• Planning and managing human resources, relying on external expertise when required to augment internal staff;
• Evolving into an organization where security is integrated as seamlessly as possible with applications, data, processes and workflows into a unified environment.

A gap assessment of an organization’s current state and existing efforts is an important first step in establishing a security strategic plan. A documented information security program assessment against a defined InfoSec international standard or framework such as ISO/IEC 27002, 27701, 22301 or NIST CSF — especially when that standard is a part of the strategy — enables more efficient planning. Additional steps to building a policy include defining the vision, mission, strategy, initiatives and tasks to be completed so they enhance the existing information security program. The plan should contain a list of deliverables or benchmarks for the initiatives, including the name of the person responsible for each control.

• Security Strategic Planning and Information Security Governance
• ISO 27001/2 assessment for as-is security posture
• Build ISMS (ISO 27001/2) for to-be security posture
• Perform comprehensive security risk assessment including but not limited to Pen Test
• vCISO as a Service, supplement the security management staff on as needed basis
• TPRM Third-Party Risk Management based on ISO 27001/2/5 or ISO 31000 frameworks
• Alert management to potential risks
• Train employees on security control and provide awareness training
• Design defense in depth architecture (design control)
• Review and revise security policies, standards and procedures
• Guide management in its selection of information security services
• Help evaluate qualifications for information security personnel

Click the link below to email your query to DISC and feel free to ask a question regarding your Annual Security HealthCheck Assessment

DISC online store for recommended InfoSec products

DISC InfoSec blog | DISC InfoSec Page |  Subscribe by email | Email Info@DeuraInfoSec.com

DISC T Shirt  | InfoSec Books| InfoSec Webinar and InfoSec blogs feed