Do you fear you don't have the talent or funds to be able to keep your business secure? Is your IT person maxed out on projects that adding infosec to her plate might be too much? How can you find the balance between getting the cybersecurity expertise your business requires while not breaking the bank?

The Information Security space has become a multi-billion dollar industry and has a wide range of diverse jobs within it. Whether someone goes down the development path, the testing/forensics path, or even the strategic path there is much opportunity and it's extremely competitive retaining people. Cybersecurity Ventures predicts there will be 3.5 million cybersecurity job openings by 2021.  Additionally, just because you get someone to fill the role also doesn't mean 1) They have the skillset to accomplish everything you need or 2) be a strong culture fit that can get their heads out of the technical weeds and talk to you in the business terms you need.

Often fulfilling those needs can be done in an outsourced way. You have a great Technology audit experience or a great relationship with a fractionalized Information Security Officer that is able to align all the technical projects into the business strategic plans or even better, both! But wait, isn't that a conflict of interest? Having auditors and ISOs from the same company? At quick glance, I could see why one would think that. But, if managed properly, we believe you could have an even better experience by utilizing one company for both. Here are some of things you can plan for to ensure achieving good separation of duty.

1) People can't intermingle into projects - If you have a company doing audits and ongoing consulting make sure you ask who is doing the work behind the scenes and make sure the audit line doesn't get crossed into managing or mitigating audit findings. Bigger organizations quite often have one person or team handle the audit function and another person manage the mitigation. It's simple checks and balances.

 

2) Create organizational clarity on how any security projects are managed - You can do yourself a favor at the front end of a project or even during annual planning process to discuss as a team on how we will achieve separation of duty. Setting separate responsibilities as a part of the project template can create the consistent clarity your team requires.

 

3) Conduct an After Action Review / Debriefs - In Michael Hyatt's book, Your Best Year Ever, he shared a tool they use (and it comes out of the military) once a project is complete. It's called an 'After Action Review'. Here's what you go through with your team post-project:

What would the obstacle be if you want to work with a company who does both?

At Vala Secure there is no obstacle. There is no legal requirement to use separate companies. Our clients understand our processes and have been successful in passing exams and adding regulated clients.

 

Download the full infographic: Technology Audits and Consulting - Achieving Separation of Duty