How to conduct a cyber-resilience assessment

What a cyber-resilience assessment evaluates

The following sections summarize information to collect and issues to address during a cyber-resilience assessment.

Business context

Determine the organization's risk tolerance for business-impacting events. For example, include acceptable levels of disruption, such as acceptable downtime, acceptable data loss and financial impact thresholds.

Cybersecurity risks

List the risks and threats that could enable cyberattacks, as well as systems to protect. Consider the following:

• Employees.
• IT systems.
• Business processes.
• Communications and network services.
• Desktop and other edge systems.
• Data storage facilities.
• Cybersecurity management systems.
• Network perimeter protection systems.
• Facilities systems, such as fire detection and suppression, building security, access control, HVAC systems and utilities.

Potential cyberattacks

Create a list of potential cyberattacks and vulnerabilities based on the current threat landscape. Consider how the organization assesses its specific risks, for example, by performing the following tasks:

• Cybersecurity risk assessments to identify the latest risks and threats. These could include phishing, DDoS and ransomware attacks, as well as risks to critical infrastructure and supply chains.
• Vulnerability assessments to identify where the organization's technology ecosystem might have points of failure or pathways for unauthorized access.
• Penetration tests to further identify potential vulnerabilities and failure points.

Business impact of a cyberattack

Identify how cyberincidents could affect revenue, operations, safety, compliance, customer trust and the firm's reputation. Establish which event characteristics could have the greatest impact -- for example, attacks on mission-critical systems and services the organization provides.

Attack entry points

Identify where attacks could infiltrate the network. Threat vector access points might include:

• Unprotected access points in the network.
• Vulnerable remote access technologies.
• Phishing and social engineering scams.
• Infected files and compromised code.
• Rogue employees who provide access to unauthorized users.

Dependencies

Determine the dependencies and interdependencies the organization maintains:

• Identify and map upstream and downstream dependencies for business and technology infrastructures, including regulatory and standards compliance and corporate governance.
• Identify applications, data flows, mission-critical systems, supply chains, cloud services, vendors and shared infrastructure.

Incident response

Examine and assess how the organization prepares for and responds to cyberattacks. Gather the following:

• Cybersecurity policies that address various cyberattack scenarios.
• Incident response plans that define how to capture malicious code for analysis and cybersecurity.
• Playbooks that document procedures from initial detection to resolution and reporting.
• Event management guidance that documents the overall cyberattack through to its resolution.
• After-action reports that detail what worked and what did not.
• Business continuity, disaster recovery and operational resilience plans that outline how to recover systems and return to normal business operations.
• Simulations and tabletop exercises that pinpoint the most critical events.

Document how the organization completes the following five phases of the incident response lifecycle:

1. Identify. Performing risk, threat and vulnerability assessments to identify potential threat actors and attack vectors.
2. Protect. Using technologies such as firewalls, intrusion detection and prevention systems (IDSes/IPSes), SIEM and SOAR to defend against cyberattacks.
3. Detect. Using hardware and software, such as endpoint detection and response, extended detection and response, IDS/IPS, threat intelligence platforms and AI-driven security tools, to detect and isolate malicious code.
4. Respond. Isolating, analyzing and neutralizing malware and attacks to prevent further damage. This includes using cybersecurity systems, software and incident response plans.
5. Recover. Performing activities to recover damaged systems and services, restore disrupted business activities and facilitate a rapid return to normal business operations.

Current security program processes

Identify and document how the organization manages cybersecurity for IT, software and network services. Include the following:

• Patch management.
• Antivirus and antimalware software updates.
• Password management.
• Access control.
• Data, database and application backups.
• Principles of zero trust and least privilege access.
• Hardware, network and facility security.
• Cybersecurity support from cloud-based vendors and MSPs.
• Third-party cybersecurity consulting services.
• Cyber insurance.

Testing procedures

Organizations must validate plans and procedures to ensure they address and mitigate the impact of cyberattacks. Document how the organization tests its capabilities for managing cyberthreats and vulnerabilities. Include the following:

• The cadence and maturity of tests, such as red team tests and pen tests, that uncover vulnerabilities in the organization's infrastructure.
• How test results are used to boost cybersecurity readiness and improve cybersecurity programs and incident response plans.
• How often tests are updated. Threat actors continually evolve and enhance their attack methods. Updating tests regularly ensures security teams and employees know how to respond to current and new threats.
• Documented steps that outline how to update systems in the event of vulnerabilities being found.

Training

Document training procedures for both the cybersecurity team and all employees.

For cybersecurity teams, include:

• How team members are kept up to date on critical threats, such as viruses, ransomware, phishing and other malware, both locally and globally.
• How security operations center resources are kept up to date.
• Training materials and frequency for cybersecurity teams on how to use all current cybersecurity applications and systems.

For all employees and senior management, include:

• How employees are made aware of the company's cybersecurity policy and any updates to it.
• How often and the contents of security awareness trainings that outline how employees should detect, react to and report suspected cyberincidents.

Post-incident procedures

Define what happens in the aftermath of a cyberattack:

• How post-event assessments provide an unbiased view of the organization's response to the cyberattack.
• How post-incident activities help identify actions that were successful and those that weren't.
• The process for launching follow-up actions to remediate any problems discovered during the process.
• How teams prepare an after-action report that summarizes the above and provides recommendations for improving the response to future attacks.

How to use the results of a cyber-resilience assessment

Cyber-resilience assessments provide timely insight into an organization's preparedness for cyberattacks and its ability to adapt and overcome the disruption they cause. If an assessment identifies areas for improvement, the organization should make those changes before an attack occurs. For example, consider the following responses to an assessment:

• Identify where cyberattacks are most likely to occur. Shore up defenses in those areas.
• Identify gaps in operational readiness, technology support, data backup and recovery, and other critical services. Develop a risk-based remediation roadmap with clear deadlines.
• Determine responsibility and accountability for cybersecurity response and recovery activities. Assign ownership to relevant internal teams.
• Identify missing tools or processes. Procure new or rework existing cybersecurity tools, processes, policies and other activities.
• Review training programs. Update and hold additional training to ensure all employees are kept up to date.

Be sure to retest and validate remediations and updates once implemented to ensure controls perform as intended.

After a cyber-resilience assessment, communicate results to senior leaders, stakeholders and employees from a business perspective. Set measurable KPIs or maturity benchmarks to track progress over successive assessments. Make cyber-resilience a standing agenda item tied to enterprise risk management processes.

Remember, a cyber-resilience assessment is not a one-off task. Perform them regularly to ensure fixes and updates hold, and to find any new gaps that have emerged. As cyber-resilience activities are updated and improved, ensure cybersecurity programs still comply with relevant regulations and standards, and update any documentation, policies and incident response plans as applicable.

Additional cybersecurity assessment resources are available, including the following:

• NIST Cybersecurity Framework.
• NIST Special Publication 800-53 Security and Privacy Controls for Information Systems and Organizations.
• ISO 27001.
• National Cyber Security Centre Cyber Assessment Framework.
• CISA Cyber Resilience Review: Method Description and Self-Assessment User Guide.
• CISA Cyber Resilience Review: Question Set with Guidance.
• U.S. Department of Homeland Security Cyber Resilience Review.

Paul Kirvan, FBCI, CISA, is an independent consultant and technical writer with more than 35 years of experience in business continuity, disaster recovery, resilience, cybersecurity, GRC, telecom and technical writing.