Table of contents

Introduction

Up until recently, I worked on building a comprehensive SaaS governance program within the US government. Doing so made me understand the importance of having a structured framework to guide the organization’s approach to cybersecurity. In my past role, we structured our governance efforts around three key pillars. This framework helped us gain an understanding of our SaaS application landscape, evaluate the necessary policies and controls, and continuously validate the effectiveness of our security measures.

While the specific pillars in the previous program differ from the Assess, Manage, and Validate framework outlined in this post, the overall approach of addressing cybersecurity holistically was the inspiration for developing this new framework. The goal is to provide businesses with a detailed, yet practical, blueprint for building a robust cybersecurity program that protects critical assets, ensures compliance, and builds resilience against emerging threats.

In the sections that follow, I will dive deeper into the specific elements of this cybersecurity program framework, drawing on my previous experience to illustrate how this approach can be effectively applied in practice. Let’s get started!

Assess

First there is the “Assess” pillar. This pillar focuses on identifying critical assets, understanding risks and vulnerabilities, and prioritizing security and compliance actions based on potential impact.

The main elements within this pillar include:

• Identify the critical assets and data within the systems.
• Understand and evaluate the risks and vulnerabilities associated with the assets.
• Understand the regulatory and compliance requirements relevant to the system(s).
• Prioritize the security and compliance actions based on potential impact.

Manage

The “Manage” pillar involves developing and implementing policies, configuring security technologies, conducting employee training, and working with engineering teams on recovery processes.

The main elements within this pillar include:

• Develop, implement, and oversee policies and procedures to protect assets and ensure compliance.
• Configure and maintain security technologies to defend against threats.
• Conducting training and awareness programs for employees.
• Review and work with engineering teams on recovery processes to mitigate the impact of security breaches.

Validate

The “Validate” pillar emphasizes the continuous monitoring of security controls, regular auditing and testing of security practices, and ensuring the overall effectiveness of the organization’s security and compliance efforts.

The main elements within this pillar include:

• Continuously monitor security controls and compliance measures to detect and respond to threats in real time.
• Regularly audit and test security practices and compliance status to identify gaps or weaknesses.
• Review and adjust security measures based on the findings from continuous monitoring and audits.
• Ensure that the organization’s security and compliance efforts are effective and meet industry standards and regulations.

What About Governance?

Governance is an integral component of each pillar:

Within Assess

Governance ensures that assessments are aligned with business objectives, risk tolerance levels, and regulatory requirements. It provides the framework for decision-making regarding which risks to prioritize and how to allocate resources effectively.

Within Manage

Governance sets the policies and standards for managing security and compliance, ensuring that practices are consistent, aligned with organization goals, and effectively implemented across all departments and functions.

Within Validate

Governance mandates the mechanisms for validation, such as audits and monitoring, ensuring they are conducted with integrity and are actionable. It drives the response to validate findings, ensuring that corrective actions are taken and improvements are made.

Conclusion

By adopting this cybersecurity program framework, you can build a resilient and proactive approach to protecting an organization’s critical assets, ensuring compliance, and staying ahead of new threats.