As you've seen in the last article, given the workload involved the CISO/ISM needs to be in regular contact with management teams. This is to ensure that their Security programme is successfully implemented throughout the enterprise.

Given this reality, it's important to put together a group called the security working group (SWG) or security steering committee. This group needs to meet routinely to govern and promote good security practices throughout the organisation. Its primary role is to discuss all information assurance matters across the organisation.

The working group should be chaired by the information security manager and should be attended by line-of-business heads from all parts of the enterprise. External stakeholders should also be included if they're required to support planning or governance. This group will be a high-level forum to discuss security matters. The group needs to meet regularly and it's important that membership includes all stakeholders.

Earlier you saw the risk register, and the SWG group needs to manage that register. The SWG must participate in the approval of standards, policies, and initiatives. SMEs should also be involved so that they can provide advice if required.

The security working group should become the voice and advocate for Information Security matters throughout the business. Attendees should have written terms and conditions and they should be encouraged to popularise information assurance (IA) principles in their own work areas to create the security culture that will make IA a company success. It's important that this group meets regularly and consistently in order to successfully develop the security culture within the business.

Not always possible in house

Depending on the size of the company, it may not be viable to handle all issues internally. If this is the case, the company may employ an external specialist organisation to perform the necessary actions, for example penetration testing for regular system health checks. Developing an appropriate relationship with a trusted, accredited and certified company may help a company meet some security requirements without the cost of a permanent internal team of experts.

Equally, as a company grows it will need to revise its SWG. This will ensure that there is appropriate representation of all relevant departments and that they continue to develop the security culture throughout the firm.

Presently, you’ll be moving on to looking at company individuals outside the SWG and how you can best employ policy and procedures to embed best practice across the organisation. To achieve this, you’ll need to provide appropriate training, promote awareness and also use assessment. This is to identify awareness levels among the staff and to identify which aspects of the security culture need most attention.

Choosing members of your SWG

Before finishing, think about your own current organisation, who would you have in your SWG?

Key points

Let’s take a look at the key points from this lecture:

The security working group (SWG) or security steering committee needs to meet routinely to govern and promote good security practices throughout the organisation.
The SWG must participate in the approval of standards, policies, and initiatives and manage any risk registers.
Developing an appropriate relationship with a trusted, accredited, and certified company may help a company meet some security requirements without the cost of a permanent internal team of experts.

Responsibilities of management teams in implementing effective security practices