ISSMP

Security Leadership & Strategic Alignment

Security management at the ISSMP level requires translating business strategy into information security strategy. Leaders must ensure that security investments support organizational objectives, enable revenue-generating activities, and protect brand value. Strategic alignment is achieved when security initiatives directly map to business goals, when the CISO participates in executive decision-making, and when security becomes a competitive differentiator rather than a cost center.

The modern CISO operates at the intersection of technology, risk, and business. Responsibilities extend far beyond technical controls to encompass board-level reporting, regulatory compliance, incident response leadership, workforce development, merger and acquisition due diligence, and digital transformation enablement. The CISO must communicate risk in business terms using financial impact, customer trust metrics, and operational resilience indicators.

CISO Reporting Structures

Governance Frameworks

• COBIT 2019 - ISACA framework for governance and management of enterprise IT; distinguishes governance (EDM domain: Evaluate, Direct, Monitor) from management (APO, BAI, DSS, MEA domains); 40 objectives mapped to enterprise and alignment goals.
• ISO/IEC 27014 - Governance of information security; six action-oriented principles: establish enterprise-wide security, adopt risk-based approach, set direction of investment decisions, ensure conformance with internal and external requirements, foster security-positive environment, review performance in relation to business outcomes.
• NIST Cybersecurity Framework (CSF 2.0) - Six functions: Govern, Identify, Protect, Detect, Respond, Recover; Govern added in CSF 2.0 to emphasize organizational context, risk management strategy, roles/responsibilities, policy, oversight, and supply chain risk.
• ISO/IEC 38500 - Corporate governance of IT; principles of responsibility, strategy, acquisition, performance, conformance, human behaviour.
• King IV Report - South African corporate governance code with explicit technology/information governance principles applicable globally.

Security Budget Management

Industry benchmarks suggest security budgets typically fall between 6% and 14% of total IT spend, with regulated industries trending higher. ISSMP candidates must understand zero-based budgeting, capital vs operational expenditure, total cost of ownership (TCO), and return on security investment (ROSI).

ROSI = (ALE_before - ALE_after - Control_Cost) / Control_Cost

ALE (Annualized Loss Expectancy) = SLE x ARO
SLE (Single Loss Expectancy) = Asset Value x Exposure Factor
ARO (Annualized Rate of Occurrence) = expected frequency per year

Example:
  Asset Value = $2,000,000
  Exposure Factor = 40%
  SLE = $800,000
  ARO (before control) = 0.25 (once every 4 years)
  ALE_before = $200,000
  ARO (after control) = 0.05
  ALE_after = $40,000
  Control Cost = $50,000/year
  ROSI = (200000 - 40000 - 50000) / 50000 = 2.2 = 220%

Key Performance Indicators (KPIs) & Metrics

• Mean Time to Detect (MTTD) - average time between intrusion and detection; aim to reduce quarter over quarter.
• Mean Time to Respond (MTTR) - average time from detection to containment/eradication.
• Patch Coverage - percentage of systems patched within SLA (e.g., critical within 7 days).
• Phishing Click Rate - simulated phishing click-through percentage; track training effectiveness.
• Security Training Completion - percentage of workforce completing mandatory training on time.
• Vulnerability Density - critical/high vulnerabilities per 1000 assets or per application.
• Control Maturity - CMMI-based (Initial, Managed, Defined, Quantitatively Managed, Optimizing).
• Risk Reduction - quantitative reduction in residual risk exposure (dollar value or risk score).

Executive Communication

Security leaders translate technical events into business impact. Board reports should focus on risk posture trends, regulatory exposure, peer benchmarking, major incidents, strategic investments, and talent readiness. Avoid technical jargon; use heat maps, risk dashboards, and scenario-based narratives. Establish a regular cadence (quarterly minimum) with the board risk or audit committee.

Stakeholder mapping is essential: identify influencers, decision-makers, detractors, and champions. Tailor messaging by audience: the CFO wants ROI and compliance cost; the COO wants operational resilience; the General Counsel wants legal exposure; engineering leaders want enablement over obstruction.

Systems Lifecycle Security Management

Security must be integrated throughout the entire systems development lifecycle (SDLC), not bolted on at the end. ISSMP professionals oversee secure design, development, testing, deployment, operation, and decommissioning of systems. Shift-left principles, threat modeling during design, automated security testing in CI/CD pipelines, and secure-by-default architectures are central to modern lifecycle management.

SDLC Phases & Security Activities

Threat Modeling Methodologies

• STRIDE (Microsoft) - Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
• PASTA (Process for Attack Simulation and Threat Analysis) - 7-stage risk-centric methodology aligning business objectives with technical requirements.
• DREAD - Damage, Reproducibility, Exploitability, Affected Users, Discoverability (scoring model; deprecated by Microsoft but still used).
• VAST (Visual Agile Simple Threat) - scales for Agile/DevOps environments.
• LINDDUN - privacy-focused threat modeling: Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance.
• OCTAVE Allegro - asset-driven qualitative risk assessment focused on operational risk.
• Attack Trees - Schneier's hierarchical decomposition of attacker goals.

Agile & DevSecOps Integration

In Agile environments, security must keep pace with rapid iteration. Embed security champions on each scrum team, include abuse stories alongside user stories in the backlog, and automate security gates in CI/CD pipelines. DevSecOps maturity progresses from manual review, to automated scanning, to policy-as-code, to chaos security engineering.

CI/CD Security Gate Pipeline:

  1. Pre-commit:       Secret scanning (git-secrets, trufflehog), linting
  2. Commit:           SAST (Semgrep, SonarQube), SCA (Snyk, Dependabot)
  3. Build:            Container scan (Trivy, Clair), SBOM generation (CycloneDX/SPDX)
  4. Test:             DAST (ZAP, Burp), IAST, API fuzzing
  5. Staging Deploy:   IaC scanning (Checkov, tfsec), policy (OPA, Kyverno)
  6. Pre-prod:         Penetration test, red team, compliance validation
  7. Production:       RASP, WAF, runtime monitoring, CSPM
  8. Continuous:       Drift detection, anomaly detection, threat hunting

Secure Procurement & Supply Chain

• RFP security requirements - include security questionnaires (SIG, CAIQ) in all vendor selection.
• Contractual controls - right-to-audit clauses, breach notification timelines, data residency, liability caps, subcontractor restrictions, encryption requirements, SLAs, termination assistance.
• Third-party risk management (TPRM) - tiered assessments based on data sensitivity and system criticality; continuous monitoring via BitSight, SecurityScorecard, RiskRecon.
• SOC 2 Type II reports - AICPA audit of Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy) over a 6-12 month period.
• ISO 27001 certification - evidence of documented ISMS.
• Supply chain attacks - SolarWinds, Kaseya, Log4Shell demonstrate need for SBOM, dependency pinning, signed commits, and reproducible builds.
• NIST SP 800-161 - Cybersecurity Supply Chain Risk Management (C-SCRM) practices.
• Executive Order 14028 - US federal requirements for SBOM and secure software development attestation.

Vendor & Contract Management

Vendor management extends through the entire relationship lifecycle: initial due diligence, onboarding (access provisioning, NDA), ongoing monitoring (annual reassessment, SLA review, incident cooperation), and offboarding (access revocation, data return/destruction certification, transition services). Escrow arrangements protect against vendor bankruptcy; escape clauses protect against M&A-driven service degradation.

Data Sanitization & Decommissioning

Reference: NIST SP 800-88 Rev.1 - Guidelines for Media Sanitization. Always obtain Certificate of Destruction from qualified vendors (NAID AAA certified). Maintain chain of custody throughout disposal process.

Enterprise Risk Management Program

Information security risk management must align with and feed into Enterprise Risk Management (ERM). The ISSMP designs, implements, and continuously improves a formal risk program with documented methodology, governance structures, risk appetite statements, and integration with strategic planning. Risk is defined as the effect of uncertainty on objectives (ISO 31000) - inherently neutral, with both upside and downside consequences.

Risk Management Frameworks

• ISO 31000:2018 - Generic risk management principles, framework, and process. Principles: integrated, structured, customized, inclusive, dynamic, best-available information, human/cultural factors, continual improvement.
• ISO/IEC 27005:2022 - Information security risk management guidance aligned with ISO 27001.
• NIST SP 800-37 Rev.2 - Risk Management Framework (RMF): Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.
• NIST SP 800-39 - Managing Information Security Risk at organization, mission/business, and information system tiers.
• NIST SP 800-30 Rev.1 - Guide for Conducting Risk Assessments.
• COSO ERM (2017) - Enterprise Risk Management - Integrating with Strategy and Performance; 5 components, 20 principles.
• FAIR (Factor Analysis of Information Risk) - Quantitative model decomposing risk into Loss Event Frequency and Loss Magnitude.
• OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) - CERT methodology focused on operational risk.

Risk Management Process (ISO 31000)

                   Communication & Consultation
                               |
    +--------------------------+--------------------------+
    |                                                     |
    v                                                     |
Establish Context                                         |
    |                                                     |
    v                                                     |
Risk Assessment:                                          |
   1. Risk Identification                                 |
   2. Risk Analysis            <--> Monitoring & Review
   3. Risk Evaluation                                     |
    |                                                     |
    v                                                     |
Risk Treatment                                            |
    |                                                     |
    +-----------------------------------------------------+
                               |
                   Recording & Reporting

FAIR Quantitative Methodology

FAIR (now an Open Group standard as O-RT and O-RA) provides a taxonomy for decomposing risk into measurable factors. Rather than qualitative High/Medium/Low, FAIR produces probabilistic loss distributions expressed in monetary terms.

Risk = Loss Event Frequency (LEF) x Loss Magnitude (LM)

Loss Event Frequency (LEF):
  = Threat Event Frequency (TEF) x Vulnerability (Vuln)
  TEF = Contact Frequency x Probability of Action
  Vuln = Threat Capability (TCap) vs Resistance Strength (RS)

Loss Magnitude (LM):
  = Primary Loss + Secondary Loss
  Primary Loss: productivity, response, replacement
  Secondary Loss: fines/judgments, reputation, competitive advantage

Output: Monte Carlo simulation producing probability distribution
   e.g., "90% chance annual loss between $1.2M and $4.8M"

Risk Treatment Options

Risk Register Essentials

• Unique risk ID and title
• Risk description (threat, vulnerability, asset, potential consequence)
• Risk category (operational, strategic, compliance, financial, reputational)
• Inherent risk rating (likelihood x impact before controls)
• Current controls and control effectiveness
• Residual risk rating (after controls)
• Risk owner (accountable executive)
• Treatment strategy and action plan
• Target residual risk and due date
• Review cadence and last reviewed date

Risk Appetite, Tolerance & Capacity

Risk Capacity is the maximum risk an organization can bear before jeopardizing viability. Risk Appetite is the aggregate level of risk the organization is willing to accept in pursuit of objectives. Risk Tolerance is the acceptable variation around specific objectives. Risk Thresholds are quantitative triggers for escalation.

Risk Appetite Statement Example:

"Acme Corp will accept moderate cybersecurity risk to enable digital
innovation and customer experience improvements, but will maintain
low tolerance for risks that could result in:
  - Regulatory fines exceeding $5M
  - Disclosure of PHI or PCI data
  - Sustained outage of Tier 1 services over 4 hours
  - Loss of customer trust measured by NPS decline > 10 points"

Key Risk Indicators (KRI) Thresholds:
  Green:  < 10 critical vulns open > 30 days
  Amber:  10-25 critical vulns open > 30 days
  Red:    > 25 critical vulns open > 30 days  [Escalate to CRO]

Key Risk Indicators (KRIs)

KRIs are leading indicators of increasing risk exposure, distinct from KPIs which measure performance. Effective KRIs are measurable, comparable over time, predictive, and tied to specific risks. Examples: percentage of unpatched critical vulnerabilities, number of privileged accounts without MFA, third-party risk score trend, phishing simulation failure rate, frequency of after-hours privileged access, volume of data egress anomalies.

Three Lines of Defense Model

• First Line - Operational Management: Business units own and manage risk; implement and operate controls (e.g., IT operations, application owners).
• Second Line - Risk & Compliance Functions: Oversight of risk management; CISO, risk management, compliance, legal. Policy setting, guidance, monitoring.
• Third Line - Internal Audit: Independent assurance over effectiveness of governance, risk management, and internal controls. Reports to audit committee.

Threat Intelligence & Incident Management

Threat intelligence transforms raw data about adversaries into actionable knowledge that informs defensive decisions. Incident management ensures that when preventive controls fail, the organization detects, contains, eradicates, recovers, and learns quickly. ISSMP candidates must understand how to design these capabilities strategically, not just operate them tactically.

Cyber Threat Intelligence (CTI) Lifecycle

• 1. Planning & Direction - Define Priority Intelligence Requirements (PIRs) aligned with business risks.
• 2. Collection - Gather data from internal telemetry, OSINT, commercial feeds, ISACs/ISAOs, dark web, HUMINT.
• 3. Processing - Normalize, deduplicate, enrich (STIX/TAXII format), translate.
• 4. Analysis - Apply analytic tradecraft (ACH, diamond model) to produce strategic, operational, tactical intelligence.
• 5. Dissemination - Deliver to stakeholders: executives (strategic), SOC (tactical), hunters (technical), engineers (detection rules).
• 6. Feedback - Consumers evaluate usefulness; cycle refines PIRs.

Intelligence Types

Threat Intelligence Platforms & Standards

• TIP platforms: ThreatConnect, Anomali ThreatStream, MISP (open-source), Recorded Future, EclecticIQ.
• STIX 2.1 - Structured Threat Information Expression; JSON-based object model (indicators, threat actors, campaigns, TTPs, etc.).
• TAXII 2.1 - Trusted Automated Exchange of Intelligence Information; REST API transport for STIX.
• OpenIOC - Mandiant's XML format for indicators.
• YARA - Pattern matching rules for malware classification.
• Sigma - Generic signature format for SIEM detection rules.

MITRE ATT&CK Framework

ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) catalogs adversary behavior across the attack lifecycle. 14 Enterprise tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact. Each tactic contains techniques and sub-techniques with detection guidance and mitigations.

Related MITRE projects: D3FEND (defensive countermeasures), CAR (Cyber Analytics Repository), ATT&CK Navigator (coverage visualization), ATT&CK Evaluations (vendor benchmarks).

Analytical Models

• Cyber Kill Chain (Lockheed Martin) - 7 phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives.
• Diamond Model - Intrusion analysis linking Adversary, Infrastructure, Capability, Victim with meta-features.
• Pyramid of Pain (Bianco) - Difficulty to attacker when defender blocks indicators: Hashes (trivial) -> IPs -> Domains -> Artifacts -> Tools -> TTPs (tough).
• Unified Kill Chain (Pols) - 18 phases merging Kill Chain + ATT&CK.

Incident Response (NIST SP 800-61 Rev.2)

         +----------------+
         | Preparation    |  Policy, plan, team, training, tools
         +-------+--------+
                 |
                 v
         +----------------+
         | Detection &    |  Monitoring, alert triage, validation
         | Analysis       |  Scoping, prioritization (functional, info,
         +-------+--------+      recoverability impact)
                 |
                 v
         +----------------+
         | Containment,   |  Short-term: isolate; long-term: rebuild
         | Eradication &  |  Eradicate: remove malware, close vectors
         | Recovery       |  Recover: restore, monitor, validate
         +-------+--------+
                 |
                 v
         +----------------+
         | Post-Incident  |  Lessons learned, evidence retention,
         | Activity       |  metrics, process improvement
         +----------------+

Incident Handling Loop: iterate Detection & Analysis with
Containment/Eradication/Recovery as needed

Digital Forensics (NIST SP 800-86)

• Order of Volatility (RFC 3227): CPU registers/cache -> routing table/ARP/process -> kernel stats/memory -> temporary file systems -> disk -> remote logging/monitoring -> physical config/topology -> archival media.
• Chain of Custody - documented record of every person who handled evidence, with timestamps, locations, and purposes; critical for admissibility.
• Hashing - SHA-256 (or stronger) of evidence at acquisition and before analysis; mismatch indicates tampering.
• Write blockers - hardware or software preventing modification of source media during imaging.
• Tools - EnCase, FTK, Autopsy/Sleuth Kit, Volatility (memory), X-Ways, Cellebrite (mobile).
• Locard's Exchange Principle - every contact leaves a trace; applies equally to cyber.

IR Team Models

Tabletop & Simulation Exercises

Exercises validate plans, build muscle memory, and expose gaps. Progression: Tabletop (discussion-based) -> Walkthrough (step-by-step validation) -> Functional (parallel execution without impact) -> Full-scale (live drill with real systems). Inject realistic scenarios: ransomware double extortion, supply chain compromise, insider exfiltration, destructive wiper, cloud account takeover, OT/ICS intrusion. Document actions, decisions, and issues; track remediation to closure.

Breach Notification Timelines

• GDPR - 72 hours to supervisory authority; without undue delay to data subjects if high risk.
• HIPAA - 60 days from discovery to affected individuals; annual summary to HHS for <500 affected, immediate if >=500.
• SEC Cyber Disclosure Rule (2023) - 4 business days from determination of material cybersecurity incident.
• NIS2 Directive (EU) - 24h early warning, 72h incident notification, 1 month final report.
• State breach laws (US) - 50 states + DC; varies 30-90 days; often requires AG notification.
• PCI-DSS - immediate to acquirer and card brands.

Contingency Planning, BCP & Disaster Recovery

Contingency planning ensures organizational resilience against disruptions ranging from isolated system failures to catastrophic regional disasters. The ISSMP leads enterprise resilience strategy, integrating Business Continuity Planning (BCP), Disaster Recovery (DR), Crisis Management, and Emergency Response into a cohesive program governed by ISO 22301 or NIST SP 800-34.

Key Standards

• ISO 22301:2019 - Business Continuity Management Systems (BCMS) requirements; certifiable standard.
• ISO 22313 - Guidance for 22301 implementation.
• ISO 22317 - Business Impact Analysis guidance.
• ISO 22320 - Emergency management guidance.
• NIST SP 800-34 Rev.1 - Contingency Planning Guide for Federal Information Systems.
• NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management.
• ISO 27031 - ICT Readiness for Business Continuity (IRBC).

Business Impact Analysis (BIA)

The BIA identifies critical business processes, the resources they require, the impact over time of their disruption, and the recovery priorities. It is the foundation upon which all continuity strategies are built. Conducted via workshops, interviews, and questionnaires with process owners.

Key relationship: RTO + WRT <= MTD. If RTO + WRT exceeds MTD, the recovery strategy is inadequate.

Recovery Site Strategies

Backup Strategies

• Full - complete copy; largest storage, fastest restore.
• Differential - changes since last full; moderate storage, 2-tape restore.
• Incremental - changes since last backup (full or incremental); smallest storage, slowest restore.
• Synthetic Full - server constructs virtual full from prior full + incrementals.
• Snapshot - point-in-time copy at storage layer; fast but not a true backup if not offloaded.
• CDP (Continuous Data Protection) - near-zero RPO via continuous journaling.
• Immutable Backups - WORM storage, object lock, air-gapped; critical for ransomware resilience.
• 3-2-1-1-0 Rule - 3 copies, 2 different media, 1 offsite, 1 offline/immutable, 0 errors verified.

BCP/DR Testing Types

• Checklist (Read-through) - review plan for completeness and accuracy.
• Structured Walkthrough - team walks through plan step-by-step.
• Tabletop Exercise - discussion-based scenario, no system impact.
• Simulation - role-play with injects; may exercise communications but not systems.
• Parallel Test - actual recovery systems brought online in parallel; production unaffected.
• Full Interruption - shut down production, failover to DR; highest risk, highest value.

Crisis Communication

During incidents, controlled, consistent, and timely communication is essential. Establish a crisis communication plan identifying internal stakeholders (employees, board, investors), external stakeholders (customers, regulators, media, law enforcement, partners), approved spokespersons, pre-drafted message templates, and out-of-band communication channels (in case primary systems compromised). Designate a single source of truth (typically an incident portal or dark site).

Pandemic Planning

• Workforce sustainability - remote work infrastructure, succession planning, cross-training.
• Absentee projections - planning for 30-40% workforce unavailability peaks.
• Supply chain diversification - multiple sources, geographic distribution.
• Health protocols - HR coordination, legal considerations (ADA, FMLA).
• Technology scaling - VPN capacity, collaboration platforms, endpoint security for remote.
• Communication cadence - daily situational updates, employee helpline.

Plan Maintenance

BCP/DR plans decay rapidly. Mandate review after: any significant organizational change (M&A, restructuring), major technology change (cloud migration, ERP), test exercise results, actual incidents, or at minimum annually. Assign a plan owner and document change control. Store copies offsite and offline; ensure key personnel can access the plan even when primary systems are unavailable.

Law, Ethics & Security Compliance

ISSMP professionals operate in a legal and ethical context that spans multiple jurisdictions and industries. Understanding applicable statutes, regulations, contractual obligations, and professional codes of ethics is essential for designing compliant programs and avoiding personal or organizational liability. Compliance is the floor, not the ceiling; mature programs exceed regulatory minimums to build trust and competitive advantage.

Privacy Laws (Global)

GDPR Key Concepts

• Data Controller - determines purposes and means of processing (primary accountability).
• Data Processor - processes on controller's behalf (e.g., cloud providers).
• Six lawful bases: Consent, Contract, Legal Obligation, Vital Interests, Public Task, Legitimate Interests.
• Data Subject Rights - access, rectification, erasure (right to be forgotten), restrict processing, portability, object, rights related to automated decision-making.
• DPIA required for high-risk processing (Art. 35); DPO required for public authorities, large-scale systematic monitoring, or special category data processing (Art. 37).
• International transfers - adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs); Schrems II invalidated Privacy Shield.
• Privacy by Design & by Default (Art. 25) - embedded from inception.

Healthcare - HIPAA / HITECH

• HIPAA Privacy Rule - governs use and disclosure of Protected Health Information (PHI).
• HIPAA Security Rule - administrative, physical, technical safeguards for ePHI; required vs addressable implementation specifications.
• HIPAA Breach Notification Rule - unsecured PHI; 60 days to individuals; media if >= 500 in state.
• HITECH Act - extends HIPAA to business associates; increased penalties (up to $1.5M/year per violation category).
• Business Associate Agreement (BAA) - required contract between covered entities and their vendors handling PHI.
• Minimum Necessary principle - limit PHI use/disclosure to what is necessary.

Financial Sector

• SOX (Sarbanes-Oxley Act 2002) - Section 302 (executive certification), Section 404 (internal controls over financial reporting); ITGC scope.
• GLBA (Gramm-Leach-Bliley Act) - financial institutions; Safeguards Rule, Financial Privacy Rule, Pretexting Protection.
• PCI-DSS 4.0 - 12 core requirements, 6 control objectives; applies to all entities storing, processing, transmitting cardholder data; SAQ and ROC reporting.
• NYDFS 23 NYCRR 500 - cybersecurity regulation for NY financial services; CISO, risk assessment, MFA, encryption, IR plan, board attestation.
• DORA (EU Digital Operational Resilience Act) - 2025 effective; ICT risk, incident reporting, resilience testing, third-party oversight.
• FFIEC - guidelines for US financial institutions.

Computer Crime Laws (US)

• Computer Fraud and Abuse Act (CFAA) - 18 USC 1030; prohibits unauthorized access; amended multiple times; Van Buren (2021) narrowed scope.
• Electronic Communications Privacy Act (ECPA) - Wiretap Act, Stored Communications Act, Pen Register Act.
• Digital Millennium Copyright Act (DMCA) - anti-circumvention; safe harbors for ISPs.
• Identity Theft and Assumption Deterrence Act - criminalizes identity theft.
• USA PATRIOT Act / USA FREEDOM Act - surveillance authorities post-9/11.
• CLOUD Act (2018) - US law enforcement access to data held by US providers globally.
• CISA (Cybersecurity Information Sharing Act) - liability protection for sharing threat indicators.

Intellectual Property

Sector-Specific Compliance

• FERPA - education records, US.
• COPPA - children under 13, US.
• FISMA - US federal agency information security; FedRAMP for cloud services.
• CMMC 2.0 - Cybersecurity Maturity Model Certification for DoD contractors; Levels 1 (Foundational), 2 (Advanced), 3 (Expert).
• NERC CIP - Critical Infrastructure Protection for bulk electric system.
• TSA Security Directives - pipeline, rail, aviation post-Colonial Pipeline.
• ITAR/EAR - export control of defense and dual-use technology.

(ISC)2 Code of Ethics

Adherence is a condition of certification. Preamble emphasizes safety, honorable service, certification trust.

Four Canons (in order of priority when in conflict):

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
2. Act honorably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principals.
4. Advance and protect the profession.

Other Ethical Frameworks

• RFC 1087 - IAB Ethics and the Internet; unethical to disrupt Internet, waste resources, destroy integrity.
• Computer Ethics Institute - Ten Commandments of Computer Ethics
• IEEE Code of Ethics - for engineers and technology professionals.
• ACM Code of Ethics and Professional Conduct - 24 principles for computing professionals.
• GIAC Code of Ethics, ISACA Code of Professional Ethics - complementary standards.

Compliance Program Essentials

• Compliance inventory - register of all applicable laws, regulations, contracts, standards.
• Control mapping - crosswalk requirements to implemented controls (e.g., Secure Controls Framework, UCF).
• GRC platform - ServiceNow GRC, Archer, OneTrust, LogicGate, Hyperproof for automation.
• Continuous controls monitoring - automated evidence collection reduces audit fatigue.
• Attestations & certifications - SOC 2, ISO 27001, HITRUST, FedRAMP, PCI-DSS AOC.
• Regulatory horizon scanning - track emerging requirements (AI Act, NIS2, CRA).
• Whistleblower program - Dodd-Frank, SOX whistleblower protections; confidential reporting channel.

Legal Evidence & eDiscovery

The Electronic Discovery Reference Model (EDRM) defines nine stages: Information Governance, Identification, Preservation, Collection, Processing, Review, Analysis, Production, Presentation. Legal holds suspend normal retention upon reasonably anticipated litigation. Spoliation - destruction of evidence - can trigger adverse inference instructions or sanctions (FRCP Rule 37(e)). Admissible evidence must be relevant, reliable, and legally permissible (best evidence rule, chain of custody, authentication via hash).

Contract Types in Security

• NDA - Non-Disclosure Agreement; unilateral or mutual.
• MSA - Master Services Agreement; governing contract with SOWs beneath.
• DPA - Data Processing Agreement (GDPR Art. 28 required).
• BAA - Business Associate Agreement (HIPAA).
• SLA - Service Level Agreement; measurable service commitments and remedies.
• MOU/MOA - Memorandum of Understanding/Agreement; less formal than contract.
• ISA - Interconnection Security Agreement; technical security terms between organizations.