# Address Threat Management challenges, ensuring all the fragmented components of an organization are tied together

Relevant ISO 27001 clauses/controls:
- [[ISO 27001 C 9.2 Internal audit]]
- [ISO 27001 C 6.1.2 Information security risk assessment](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20C%206.1.2%20Information%20security%20risk%20assessment.md)
- [ISO 27001 A 18 Compliance](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2018%20Compliance.md)
- [ISO 27001 A.18.2 Information security reviews](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A.18.2%20Information%20security%20reviews.md)

Related:
- [Assets, Vulnerabilities, Threats, Risks](../../🎇%20Sparks/Assets,%20Vulnerabilities,%20Threats,%20Risks.md)

Author: [Gerardus Blokdyk](https://www.linkedin.com/in/gerardblokdijk/)
Retrieved from [LinkedIn](https://www.linkedin.com/pulse/address-threat-management-challenges-ensuring-all-tied-blokdyk) on January 9, 2022

1.  Have you fully considered how cloud services and mobile working affects your risk and threat management models?
2.  Does your organization have a Threat Management Team (TMT) to conduct threat evaluations?
3.  Does your organization have a working, clearly defined security standards development process?
4.  What are the top 3 future challenges your organization will need to address regarding overall IT security threat management in the next two years?
5.  If your organization does not have forensic cyber threat analysis in-house, does local law enforcement have a resource?
6.  Does your organization have a defined insider threat management program that involves cooperation among multi disciplinary areas of your organization as human resources, IT and legal?
7.  Does your organization have integrated threat management and mitigation across client, server and edge?
8.  Does your system have inventory control procedures for access badges, uniforms, and equipment?
9.  Does your company have any routines about risk identification in conceptual design stages?
10.  How do threat management services help you measure your overall security effectiveness?
11.  By what percentage have security breaches been reduced because of using threat intelligence solutions?
12.  Does your organization have a defined application development extranet security process?
13.  Does your organization have procedures for investigation of all reported incident/ accidents?
14.  Do you have good cyber threat management practices, including protective, detective and response capabilities?
15.  What critical information does the cyber criminal already have on your organizations operations?
16.  Do your service providers have structured protocols in place to assess and provide duty to warn and send notifications to your organization?
17.  Do you need to show that your organization meets compliance obligations, and have procedures in place to control data access?
18.  Does your organization have adequate and dynamic processes in place to identify existing and new risks faced?
19.  Do you have the right gauges to measure the success of your cyber threat management program?
20.  Does the person of concern have the means, knowledge, intent, motivation, and ability to carry out the threat?
21.  Does the vendor have experience in producing high quality information security products?
22.  Have all of your information partners been vetted to corporate security standards?
23.  Does your organization have a standardized tool or system that should be used in all projects?
24.  Which products/services have root access to IT networks, OT systems or sensitive platforms?
25.  In a typical week, what percentage of your threat management time is spent with alert triage or reactive response to security threats versus engaging in proactive and innovative detection methods?
26.  Does your organization provide employee training to raise information security awareness?
27.  Do you support decision makers when they make risk decisions within the parameters you have previously set?
28.  How are your organizations risk and threat management information used to guide in technical SIEM use case development?
29.  Do the results of the security categorization process reflect the organizations risk management strategy?
30.  Does your organization have the right balance of arrangements in place to deal with these risks?
31.  Do your suppliers have procedures for secure maintenance and upgrades following deployment?
32.  What benefits have you realized from outsourcing security to a third-party service provider?
33.  Does your organization have dedicated privacy professionals whose primary responsibility is privacy?
34.  What does it mean to your organization to have in place a risk-sensitive and risk-aware culture?
35.  Does the persistent use of security technologies contribute to a reduced cost of cyber crime?
36.  Does your organisation share information on information security attacks with third parties?
37.  Is the exposure or uncertainty isolated or does it have multiple effects?
38.  Does the supplier have the requisite experience, skills to ensure the supply chain delivers?
39.  What administrative policies and procedures do you have in place for insider threat management?
40.  Does your organization have a willingness to pursue security outcomes through disciplines other than security-specific solutions?
41.  If you have an Intrusion Prevention System, is it tied into the rest of your security infrastructure for automatic response?
42.  What percentage of external digital threat management tasks do you outsource to managed security service providers?
43.  Does the security development process apply to all types of application development?
44.  If HR tells information security that a person is going to leave and has turned in their resignation, can security look at what the person has been doing?
45.  Does the firewall support your network security policy, or does it impose the vendors policy?
46.  Just how capable does the enterprise want its risk management to be for each of its priority risks?
47.  Does each program/project test, validate, and verify security in its software and system components?
48.  Do you monitor and log privileged access (administrator level) to information security management systems?
49.  Does your security infrastructure drain manpower and resources or does it make your staff more productive and nimble?
50.  How much management of user-owned devices connecting to corporate resources does your organization want?
51.  How does management develop a shared vision for the role of risk management in the organization?
52.  Do you have visibility into where sensitive data resides and do you have the ability to quickly remediate issues as they arise?
53.  Do any new features that may increase Cybersecurity risk also have an increased benefit?
54.  Is the security console and control room adequate in size and does it provide room for expansion?
55.  Where does lack of trained security experts in new and advanced threat management pose a caveat in your security fabric?
56.  What impact will the mitigation approach have on the technical performance of your systems?
57.  What is the function of security event data processed in real time for incident response and threat management?
58.  Does your organization have the appropriate controls to detect and prevent an insider attack?
59.  Do you have dynamic risk assessment processes to assess, manage and react to cyber threats?
60.  What options do system and organizational managers have to reduce the risk present on the system?
61.  Do your managers proactively support preventive security or is there a view that it will never happen to us?
62.  Which departments take part as an ad hoc member of your interdisciplinary threat management team?
63.  Have you identified your most critical assets and know where they are stored and transmitted?
64.  Which users have access to sensitive and highly confidential data and the ability to download this data to devices?
65.  What set of inputs, processes, and outputs does management use to provide oversight of an activity?
66.  Who is responsible for managing security risk in your organisation and who do they report to?
67.  Knowing what you know now about the COVID 19 pandemic, what is one thing you will do differently at your organization?
68.  You have identified a number of uncertainties, how do you quantify them?
69.  Do employees have round-the-clock security, or could someone gain access to the building after hours?
70.  Does your organization have your business continuity plan that allows for continuity of operations?
71.  Who are in your diverse workforce including remote / mobile users that need reliable access to applications?
72.  Does the threat information tell you that you should focus on one Element more than another?
73.  Do you have clear processes and procedures to obtain threat information in a timely manner?
74.  Do members of the team have adequate knowledge of the organizations hardware and software?
75.  Have your organizations personnel and partners been provided cybersecurity awareness training?
76.  Do you have a capability to use system geographic location as an authentication factor?
77.  What controls do you have to ensure that the integrity of your data is maintained?
78.  Have minimum controls been identified for each system in accordance with NIST SP 800-53?
79.  In circumstances where there is abundant supplement data, how much capacity would you have to deal with that data?
80.  Which members of your organization are involved in the security system development life cycle?
81.  Real time threat management goes beyond inspection of network logs and flow data alone. How is your organization improving network monitoring?
82.  What actions are taken by project teams to help encourage risk management activities?
83.  Does the SMS audit plan include the sampling of completed existing safety risk assessments?
84.  How do you address threat management challenges, ensuring all the fragmented components of your organization are tied together?
85.  What security procedures and practices are to be utilized in Operational Management?
86.  Where are the firewalls physically located to ensure physical security and protection from disasters?
87.  Does management involve the board when making decisions to accept or reject significant risks?
88.  Have policies been developed for the procurement and use of evaluated products as appropriate?
89.  What security advisory services are you outsourcing to a security service provider?
90.  Where is your organization in terms of the maturity of your application security strategy?
91.  Do your the service providers conduct criminal background checks on personnel they place in your workplace?
92.  If you are not currently using a managed security service provider, what would drive you to do so?
93.  Which devices have an expected end of support date for the software and how is this communicated?
94.  Traditional hardware security, corporate firewalls, Unified Threat Management (UTM) and routers are good places to start to protect endpoints on the LAN, what else do you install in you organization?
95.  What is the most critical barrier holding your organization back from implementing threat management more effectively?
96.  Do you have the right products and technologies in place in each of your organizations functional network segments?
97.  Do any of your suppliers or their suppliers manage or have access to your organizational data or systems?
98.  Have new employees and users been given proper instructions for protecting data and systems?
99.  Do you have the understanding required to make decisions potentially out of hours and under time pressure?
100.  Does your cyber risk training focus on the technology, the organization and the individual?

Relevant ISO 27001 clauses/controls:
- [ISO 27001 C 8 Operation](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20C%208%20Operation.md)
- [ISO 27001 A 16 Information security incident management](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2016%20Information%20security%20incident%20management.md)
- [ISO 27001 A 17 Information security aspects of business continuity management](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2017%20Information%20security%20aspects%20of%20business%20continuity%20management.md)
