Blog

Building an information security program from scratch

A multi-step approach that defines plans and processes can drastically reduce time and resources to enhance security posture.

September 7, 2022

Three phases of building an IT security program
Phase 1: Define your InfoSec plan
Phase 2: Implement Information Security controls
Phase 3: Prove compliance
Final thoughts on building an InfoSec program

Navigating the ISO 27001 compliance journey

Download the eBook

The common question from Information Security professionals when implementing new programs is usually: How long will this take?

The main reason for this is that the process of building an InfoSec program is a dark art, made confusing by the myriad of different security frameworks, differing customer demands, and lack of InfoSec talent to help you figure it all out. In this blog we’ll provide guidance on the three stages of building your InfoSec program in more understandable terms, so you can get started getting more secure.

The three phases of building an information security program from scratch

To simplify, building an InfoSec program can be broken into three main phases:

Phase 1: Define your plan
Phase 2: Implement security controls
Phase 3: Prove compliance

Phase 1: Define your InfoSec plan

While many organizations skip this step, this is the best place to start to save time and money in the long run, not to mention to be prepared in advance when you have to go through a customer security due diligence process. I like to think of this phase as having three main steps.

Step 1: What is your goal? Are you looking to get a specific certification such as SOC 2, ISO 27001, HIPAA, etc.? Or are you simply looking to get secure based on a respected industry framework such as NIST CSF or GDPR? This is the best way to define what policies and controls you need to have.
Step 2: Conduct a risk assessment. Once you have defined your goal, sit down and think about what risks your product or service presents to your clients. What is the impact if your service is compromised and client data is lost or stolen? What is the likelihood that this may occur based on your architecture and where the client’s data travels and is stored? If you can have a clear response on these questions, you will greatly improve the trust from your prospects and customers.
Step 3: Document your InfoSec policies and controls. Your InfoSec program consists of two main components – policies and controls. Policies are more high-level guidelines approved by management that are “containers” for your specific security controls. Controls are the more “actionable” tasks that you can implement and prove are implemented by providing evidence. For example, a policy would be “Organization members use strong passwords” with all the requirements around password characteristics and protection standards, and a control within this policy would be “A password management system is implemented for all organization users”.

Expected Time Spent: This is dependent on whether you write these controls yourself or not. Working with an automated system that offers prebuilt policies and controls and mapped to industry security frameworks will reduce this time and effort drastically.

Phase 2: Implement Information Security controls

Once you have your game plan figured out, the next phase is where your team actually implements the plan. As said above, the actionable part of your InfoSec plan is all in the controls. Most security frameworks have between 20 and 150 specific security controls. In this phase, you will want to assign these controls much like any other development or IT task and track it to ensure it is implemented. This is the most time-consuming part of the project, because you actually have to do the work—no sugar-coating things here. If you have been practicing good security hygiene, then you may be off to a head start, but odds are there are missing controls.

To make this phase faster, your team could use an automated project management system to assign, track and remind control owners to implement these controls, as they can be numerous and difficult to manage.

Expected Time Spent: This varies depending on the size of organization and security maturity level, but this is always the longest part of the process. On average, it takes InfoSec programs 3-6 months to implement all security controls for a framework such as SOC 2 or ISO 27001.

Phase 3: Prove compliance

Now you’re in the home stretch. The final phase is the exam. You’ve done all your work, and now it’s time to prove you’re secure. Proving compliance can take many forms, from responding to security questionnaires to having independent auditors attest to your InfoSec plan. The most common method is a third-party audit for a framework such as SOC 2, ISO 27001, or others.

When the auditor comes in, they’ll give you a list of “evidence requests,” or “procedures”. These are requests to provide proof that the security controls have been implemented. Evidence can include:

Documentation of a specific policy
Screenshots of configuration screens
Checklists of decommissioned servers
Sample set of event logs

If you’ve done a good job implementing your controls in Phase 2, the evidence gathering phase will be much easier. Once complete, the auditor will review your evidence and provide their opinion along with a certificate of attestation that you can share with your clients.

Expected Time Spent: Most of the time spent in this phase is in collecting evidence for controls that may have not been implemented yet, or going back and forth with the auditor on requests for more information. You can accelerate this process by using an automated audit project management system that allows you to assign and track tasks with your team, as well as collaborate with your team and auditor on any questions that come up. With a compliance automation system, this phase can be completed in two months or less.

Final thoughts on building an InfoSec program

For many, the thought of building a security program or getting certified can cause anxiety. But it doesn’t have to be that way. Half the battle is having a clear plan of why you’re doing it. Once that’s clear, it’s a matter of organization and execution. OneTrust Compliance Automation’s mission is to demystify this process by giving you prebuilt plan creation tools, and then automate and accelerate the process with technology. While no solid InfoSec program is built in a day, if you follow the phases above, it’s possible to have a certified InfoSec program in less than six months, which will go a long way to establishing trust with your prospects and customers.

Learn more about building out an InfoSec program and gaining compliance with a well-known framework by downloading this eBook about the ISO 27001 journey. To request a demo for OneTrust’s Compliance Automation tool, go here.

Blog

Building an information security program from scratch

Table of contents

Navigating the ISO 27001 compliance journey

The three phases of building an information security program from scratch

Phase 1: Define your InfoSec plan

Phase 2: Implement Information Security controls

Phase 3: Prove compliance

Final thoughts on building an InfoSec program

You may also like

Third-Party Risk

How OneTrust helps SMEs stay ahead of third-party risk

Join us for an engaging webinar designed specifically for dynamic small and mid-market businesses seeking to take advantage of their third-party management processes.

December 09, 2024

Third-Party Risk

Live Demo EMEA: Building a robust third-party risk management program with OneTrust

Join to explore how OneTrust's TPRM solution can revolutionize your third-party risk management approach. We will cover best practices for implementing and leveraging the software to minimize risks.

October 10, 2024

Third-Party Risk

APAC - Third-party risk management and due diligence: What’s the difference and why does it matter?​

Join this APAC webinar to learn the unique competencies of third-party risk and due diligence programs and examine when and how to align them to maximize the effectiveness of each.

September 18, 2024

Third-Party Risk

Third-Party operational risk: Shifting from reliance to resilience

Join this webinar to learn best practices for building a resilient third-party ecosystem and maintaining operational continuity in the face of unforeseen challenges.

August 15, 2024

Technology Risk & Compliance

Tech risk & compliance masterclass: The anatomy of a framework

Master the fundamentals of constructing robust compliance frameworks that can seamlessly integrate with organizational operations while aligning with regulatory and strategic mandates to deliver measurable insights on your progress and gaps.

August 14, 2024

Technology Risk & Compliance

Tech risk and compliance masterclass

Unlock tech risk management & compliance excellence. Master risk management, build robust frameworks, and foster cross-functional collaboration for long-term resilience.

August 07, 2024

Technology Risk & Compliance

Introducing OneTrust Compliance Automation

Join us as we explore OneTrust Compliance Automation, a holistic and fully integrated solution that streamlines and optimizes workflows, compliance, and attestation.

July 25, 2024

Trust Intelligence

TPRM Virtual Roundtable Series

Join the series of expert Roundtables on the topic of Third Party Risk Management

July 01, 2024

Third-Party Risk

TPRM privacy compliance: Questions to ask when working with third parties

Download this checklist to learn what questions to ask when designing a third-party risk management program that enables privacy compliance.

May 31, 2024

GRC & Security Assurance

Empowering your cyber defense: Key insights into the latest NIST CSF update with PwC

Join this webinar with OneTrust and PwC and gain insights into the upcoming NIST CSF update and learn how to effectively deploy it across your organization.

May 08, 2024

Third-Party Risk

Streamline compliance with the Digital Operational Resilience Act (DORA)

Download our infographic to learn about the new DORA regulation, who needs to comply, and how OneTrust can help streamline the process.

April 29, 2024

Third-Party Risk

5 Best practices for increasing resilience when working with third parties webinar

Learn how to leverage financial, operations, compliance, ESG, and cyber scores to drive resilience insights and detect possible supply chain disruptions.

April 18, 2024

GRC & Security Assurance

Certification Automation live product demo

Learn how OneTrust Certification Automation can help you scope, track, and manage security compliance holistically across complex operations.

April 10, 2024

Third-Party Risk

OneTrust third-party management demo video

Watch this demo video to learn how OneTrust third-party management helps organizations create resilient, secure, and scalable third-party ecosystems.

April 04, 2024

Third-Party Risk

6 steps to effective third-party risk management

See the path to managing third-party risk effectively with a checklist that outlines the six steps for a sound TPRM program.

March 29, 2024

Third-Party Risk

TPRM privacy compliance: 10 best practices when working with third parties

How can you build a privacy-focused TPRM program? In this webinar, we discuss best practices for privacy compliance when working with third parties, from onboarding to offboarding.

March 13, 2024

Technology Risk & Compliance

Rethinking risk assessments: Bridging the gap between best practices and action

Download our infographic to learn the main challenges faced during risk assessments, proven frameworks for assessing risks, and how to translate guidance into action.

March 07, 2024

Third-Party Risk

6 must-know trends in third-party management

APAC - Third-party risk management and due diligence: What’s the difference and why does it matter?