Understanding the Requirements
- current and planned future business, infrastructure and application landscape
- criteria for risk categorization
- industry regulations and best practices
- organizational policies
- business size, risk tolerance
Security Gap Assessments
- identification of legal, process, and technical gaps in meeting security policies
- impact of gaps in terms of risk
- risk based remediation approach recommendations
Gap Remediation Planning
- management controls, e.g., definition of roles, processes, change management
- technical controls, e.g., infrastructure, services and application security including network segmentation, encryption, authentication
Management of Remaining Risks
- Risk level determination based on potential for loss of confidentiality, integrity or availability
- Risk mitigation and remediation approaches
- Recommendations for residual risk acceptance
Maintenance: Ongoing Security Conformance / Compliance
- Penetration testing and review of reports
- Review of vulnerablility scans and prioritizing remediation
- Assessment of technology upgrade options
- Migration to newer and better technologies
