Basic Information Security Functions

When I started my career in information security over 20 years ago, ‘Security’ was generally a role reporting into IT. The mandate at a high level was to prevent viruses and worm, develop processes based on controls from BS 7799, NIST SP 800-53, ITIL etc.  Technology, HR, facilities and other support functions within the enterprise as well as facilitate internal and external audits and respond to client queries on the security posture.

Fast forward to the present day the Information Security function including Cyber Security has evolved into a complex and dynamic organization within the enterprise, with specialized activities spanning both Operations (First line), Risk & Oversight (Second line). With annual budget averaging between 7-12% of the IT budget. Reporting into usually the CIO, Information Security has become more autonomous and complex in the multifaceted role it plays in managing risks and maintaining the security posture of the enterprise.

Information Security and Cyber Security functions are pretty mature in the financial sector as they are highly regulated and incidents would have a direct impact on bottom lines.  The recent ransomware incidents recently is a one example why many other sectors such as the manufacturing, auto, hospitality, retail, healthcare etc. have now begun to recognize the need to develop a security function within their organizations.

I have a presentation below that shows the most important functions/teams that a modern security organization should have to be effective.

I'd like to hear your thoughts please leave your comments and feedback.