Detect Changes in Compliance Posture

Learning Objectives

After completing this unit, you’ll be able to:

• Describe a cybersecurity compliance analyst’s role in detecting changes in your organization’s compliance posture.
  
• Explain how a cybersecurity compliance analyst continuously monitors for cyber gaps to determine appropriate changes to existing processes and controls.
  

Detect Changes in Your Organization’s Cybersecurity Compliance Posture

Enhancing your organization’s data protections requires staying vigilant to detect changes in your organization’s cybersecurity compliance posture. Changes can occur when your organization undergoes a merger or acquisition, integrates a new technology, or discovers a new vulnerability. 

Your posture can also change due to environmental factors and world events. For example, the COVID-19 pandemic resulted in many organizations transitioning to full-time remote work overnight, necessitating a reevaluation of the information technology (IT) and security practices available to support a newly remote workforce. Such changes require a reassessment of an organization's compliance posture to see what adjustments must be made to remain secure. For example, is your organization’s virtual private network (VPN) solution easy to use? Can it support the increased volume of traffic associated with a workforce that works remotely from home, often in different geographical locations?

It’s also necessary to continue to monitor your organization’s security posture when new components and technologies are acquired, integrated, deployed, and maintained to ensure your protections are not undermined by changes. Adding or modifying existing security controls should be done with care and planning. Your security team needs to test the environment to ensure that changes to controls don’t break important functionality or introduce new risks.

As the organization’s infrastructure changes constantly, you—as the cybersecurity compliance analyst—have to reorganize the security requirements and change security settings with the help of recurrent audits. You must also detect any changes in the regulatory or policy environment and adapt accordingly.

Monitor for Issues with Existing Processes and Controls

As a cybersecurity compliance analyst, you don’t just sit around waiting for a breach to happen and then react. You proactively monitor your organization to identify, analyze, and report on enterprise cybersecurity compliance and control deficiencies to system owners, business executives, and leadership. This ensures that the organization stays on top of maintaining a secure compliance posture and is proactive rather than reactive to potential incidents.

Let’s meet Jason. He’s a cybersecurity compliance analyst at a financial institution. He’s been asked to help monitor the organization’s cybersecurity compliance posture for issues with existing processes and controls. One of the key parts of Jason’s job is to work with the vulnerability scanning and penetration testing teams to detect security weaknesses. He then monitors for systemic issues by looking for these vulnerabilities across the environment. This investigation allows him to know if controls are working and effective, and to adjust accordingly. 

In addition, Jason monitors key performance metrics to keep a finger on the pulse of his organization's cybersecurity compliance posture. He collects and analyzes these metrics, and reports on them periodically to his organization’s leadership. For example, he monitors how many (and what percentage of) endpoints are fully patched and up to date. He also investigates how long it takes to update to the new version of a software when it’s released, as well as how long it takes the organization to achieve full adoption. 

As Jason monitors the organization’s cybersecurity compliance posture, he reports regularly on the status of compliance activities and remediation efforts, escalating potentially risky situations as needed. He tracks and detects any anomalies and immediately notifies security managers about a possible breach or incident. He also periodically reviews his organization’s risk appetite with the cybersecurity risk manager, adjusting the cybersecurity compliance strategy as needed. All of these tasks set him up for success and ensure he’ll be a high-performing cybersecurity compliance analyst.  

Resources

• External Site: World Economic Forum: COVID-19 Has Disrupted Cybersecurity, too — Here’s How Businesses Can Decrease Their Risk
  
• External Site: Digital Guardian: Information Security Posture: Experts on the Most Overlooked Factors in Evaluating Organizational InfoSec Posture