The Cybersecurity Guide to Governance, Risk, and Compliance

The Cybersecurity Guide to Governance, Risk, and Compliance Understand and respond to a new generation of cybersecurity threats Cybersecurity has never been a more significant concern of modern businesses, with security breaches and confidential data exposure as potentially existential risks. Managing these risks and maintaining compliance with agreed-upon cybersecurity policies is the focus of Cybersecurity Governance and Risk Management. This field is becoming ever more critical as a result. A wide variety of different roles and categories of business professionals have an urgent need for fluency in the language of cybersecurity risk management. The Cybersecurity Guide to Governance, Risk, and Compliance meets this need with a comprehensive but accessible resource for professionals in every business area. Filled with cutting-edge analysis of the advanced technologies revolutionizing cybersecurity, increasing key risk factors at the same time, and offering practical strategies for implementing cybersecurity measures, it is a must-own for CISOs, boards of directors, tech professionals, business leaders, regulators, entrepreneurs, researchers, and more. The Cybersecurity Guide to Governance, Risk, and Compliance also covers: Over 1300 actionable recommendations found after each section Detailed discussion of topics including AI, cloud, and quantum computing More than 70 ready-to-use KPIs and KRIs "This guide’s coverage of governance, leadership, legal frameworks, and regulatory nuances ensures organizations can establish resilient cybersecurity postures. Each chapter delivers actionable knowledge, making the guide thorough and practical." —GARY McALUM, CISO "This guide represents the wealth of knowledge and practical insights that Jason and Griffin possess. Designed for professionals across the board, from seasoned cybersecurity veterans to business leaders, auditors, and regulators, this guide integrates the latest technological insights with governance, risk, and compliance (GRC)". —WIL BENNETT, CISO

Purpose of the Book xvii Target Audience xix Structure of the Book xxi Foreword by Wil Bennett xxiii Foreword by Gary McAlum xxv Chapter 1 Governance, Risk Management, and Compliance 1 Chapter 2 The Landscape of Cybersecurity 19 Chapter 3 Cybersecurity Leadership: Insights and Best Practices 33 Chapter 4 Cybersecurity Program and Project Management 53 Chapter 5 Cybersecurity for Business Executives 69 Chapter 6 Cybersecurity and the Board of Directors 87 Chapter 7 Risk Management 109 Chapter 8 The NIST Risk Management Framework 131 Chapter 9 Cybersecurity Metrics 151 Chapter 10 Risk Assessments 171 Chapter 11 NIST Cybersecurity Framework 191 Chapter 12 Cybersecurity Frameworks 209 Chapter 13 NIST SP 800-53: Security and Privacy Controls Framework 231 Chapter 14 The FFIEC: An Introduction 245 Chapter 15 U.S. Federal Cybersecurity Regulations 267 Chapter 16 State-level Cybersecurity Regulations 287 Chapter 17 International Cybersecurity Laws and Regulations 299 Chapter 18 Privacy Laws and Their Intersection with Cybersecurity 315 Chapter 19 Auditing Cybersecurity: Guides for Auditors and the Audited 333 Chapter 20 The Challenging Role of the Regulator 355 Chapter 21 Understanding US Regulatory Bodies 377 Chapter 22 Managing Regulatory Visits and Requests for Information 395 Chapter 23 Understanding Regulatory Penalties 409 Chapter 24 Addressing and Remediating Regulatory Findings 429 Chapter 25 Cybersecurity Architecture 445 Chapter 26 Risk Mitigation 463 Chapter 27 Cloud Security 481 Chapter 28 Artificial Intelligence in Cybersecurity 497 Chapter 29 Quantum Computing: A New Frontier 511 Chapter 30 Incident Response and Recovery 521 Chapter 31 Navigating the Cyber Insurance Maze 541 Glossary 549 Cybersecurity Resources 555 Ready to Use KPI Examples 567 Ready to Use KRI Examples 599 The End 631 Index 633