MRO SAC Hosted Webinar Information Risk Management Framework - - PowerPoint PPT Presentation
MRO SAC Hosted Webinar Information Risk Management Framework Catherine Sherwood, Manager Information Security Risk, MISO David Day, Information Security Risk Analyst, MISO Joe Polen, Executive Director, Security Controls and Engagement
“Information Risk Management Framework”
Catherine Sherwood, Manager Information Security Risk, MISO David Day, Information Security Risk Analyst, MISO Joe Polen, Executive Director, Security Controls and Engagement Management, MISO/MRO SAC Sponsor
July 8, 2020
Analyst, Xcel Energy/MRO SACTF Chair Sponsor on August 12, 2020
August 20, 2020 (Registration not open)
Catherine Sherwood Manager Information Security Risk csherwood@misoenergy.org
4
5 | Protected
Strategic Objectives – Enterprise
Risk
Inherent Risk - Risks at the IT Service
Line.
Residual Risk - Controls mitigate the
inherent risk at the IT Risk level.
Effectiveness - Testing the
effectiveness of the control.
Remediation - Remediate the gaps
that were identified.
ERM IT Risks Controls Assessments Plan of Action & Milestone
Process Assurance Gaps
Intake into the MISO Strategy
Service Line Enterprise
Identify what security standards have not been implemented Mitigate the identified gaps by prioritizing the highest impact controls first. Mature MISO’s overall security posture to the appropriate level of risk tolerance. Allow MISO to begin thinking about security at all levels of the company.
One Streamlined Process
Identify Gaps Mitigate Gaps Mature Security Program Security At Scale
NERC SOC
Best Practices
7 | Protected
Identify Protect Detect Respond Recover
Functions Categories
Implement Governance and Oversight Develop appropriate safeguards Establish continuous monitoring mechanisms Business aligned escalation and notification agreements Sustain MISO reliability and availability
Harmonize Standards
Management
Environment
Processes
and Access Control
Unified Controls Across the Organization
8 | Protected
Continuous Improvement Training
responsible for implementing MISO’s controls program Risk Assessment
identifying high risk NIST sub- categories
activities Control Design
RSAWs, etc.
high risk NIST CSF categories Governance, Monitoring and Reporting
tools and templates
monitoring and reporting mechanisms Gap Assessment + Remediation
not adequately address standards and policies
plans to eliminate gaps Control Testing
Information Security Risk Management Governance, Monitoring Reporting Training Risk Assessment Control Design Control Testing Gap Assessment + Remediation 9 | Protected
Line of Defense
Management Controls
Line of Defense Internal Audit Line of Defense
Internal Control Measures
1st 2nd 3rd
Standards and Assurance IT Validation Information Security Risk Management External Audit Regulator Line of Assurance Line of Assurance Line of Assurance
10 | Protected
Board Oversight Enterprise Risk Management MISO Management
Utilizing Security Controls Framework
Based on control categories, leadership establishes limits on risk in each area
Category Appetite
Allocate resources to address the most critical risks first
Prioritize Resources
Allows appropriate acceptance of risk to move one step closer to our vision, mission, and goals
Vision, Mission, and Goals
Design the harmonized controls
2018 Ongoing 2021 2020 2019 2022
Project End / Program Operational
Test & Assess the efficiency of those controls Remediate and implement controls with risk-based prioritization Monitor & Measure operational improvement
12 | Protected
IRM Tool implement a integrated risk management tool
Map Risks
Link IT Risks to ERM Risks
Risk Rating
Low, Moderate, High, Critical
Insight.
Provides insight into risks in MISO’s IT Service Line
14 | Protected
15
RISK Inherent Risk Ratings by CSF Functions CSF Function Low Moderate High Critical Grand Total Identify 3 8 15 26 Protect 2 22 19 43 Detect 1 9 10 Respond 8 3 11 Recover 1 2 10 13 Grand Total 5 22 65 103 RISK Residual Risk Ratings by CSF Functions CSF Function Low Moderate High Critical Grand Total Identify 15 9 2 26 Protect 5 6 30 2 43 Detect 1 2 5 2 10 Respond 2 5 3 1 11 Recover 1 3 5 3 12 Grand Total 7 31 41 9 103 Overall Risk Inherent Risk Score 3.55 Residual Risk Score 2.20 Inherent Risk Rating Critical Residual Risk Rating Moderate
Information Security Risk Management reviews/validates the risks and works with the owner to determine remediation approach, milestones and target dates.
Remediation Milestones & Dates Identified
POAMs are sourced from Information Security Risk Management assessments, Audits, and self identification
POAM Identified
Information Security Risk Management works with the owner/POC to follow-up on milestone targets, progress and implementation validation for POAM closure.
Monitoring & Implementation
17 | Protected
18 | Protected
19
Risk-based Decisions In Order To Optimize Resources
20 | Protected
Strategic Objectives Inherent Risk Residual Risk Effectiveness Remediation
ERM IT Risks Controls Assessments Plan of Action & Milestone
Process Assurance Gaps Service Line Enterprise
csherwood@misoenergy.org