The remediation stage a of cyber security improvement project or programme will fix identified problems and fill in the gaps.
You will need to identify and implement a range of controls to provide protection; there are various libraries, standards and frameworks that can support your assessment and choice of suitable controls. The prioritised risks determined during a completed risk assessment and/or gap analysis exercise will guide the sequence of control implementation.
To ensure your controls are effective, you will need to design ongoing assurance of residual risk levels. You may develop a ‘dashboard’ to demonstrate threat and risk levels and control effectiveness or use a benchmark to compare relative performance.
It is easy to assume that an international standard such as ISO 27001 gives you everything you need to be cyber secure. Whilst it goes along way towards it, implementing an effective vulnerability remediation is vital for protecting the security of a system or application. A thorough and structured assessment of the control options mapped against your prioritised risks will give you, your stakeholders and auditors the confidence that you have made well-informed choices.
Given that 80% of cyberattacks can be prevented by implementing basic controls, it makes sense to include a robust vulnerability mediation process that covers information security best practice and organisational policies and procedures.
Ongoing effectiveness relies on accurate metrics for evidence. Metrics also help pinpoint areas for improvement by identifying vulnerabilities and trends.
Ascentor can assist you with implementing a comprehensive vulnerability remediation process that begins with an assessment of your existing controls based on your prioritised risk baseline. If you have used the NIST Cyber Security Framework to guide your risk assessment work suitable controls will already be identified. We typically recommend a detailed check against the Centre for Internet Security (CIS) Top 20 Critical Security Controls as they are specific to the technical aspect of cyber security.
As well as technical controls, we consider procedural and policy controls and awareness training for all staff and for those with direct responsibility for cyber security.
To measure the effectiveness of controls, we advocate a maturity model approach. Cybersecurity Capability Maturity Model (C2M2) and ISACA both provide an effective method for measuring the effectiveness of your cyber security controls. Which one to choose (and there are others) should be driven by the business and ideally agreed on in a Cyber Security Strategy.
We leverage years of experience in cyber security to deliver comprehensive solutions tailored to your needs.
We're certified in ISO 9001:2015, Cyber Essentials Plus, IASME Gold and are a Crown Commercial Service Supplier.
NCSC (CESG) Certified Professionals CCP and Certified Information System Security Professional CISSP certified.
We're Certified Information Security Managers (CISM).
We're members of the Chartered Institute of Information Security (CIISec). CREST and Cyber Scheme Registered Pentesters.
We stay ahead of the curve, consistently updating our services to handle the rapidly evolving landscape of cyber threats.
We work closely with clients, fostering partnerships to better understand and address your cyber security needs.
We offer pragmatic, accessible solutions that balance security needs with the realities of your operational requirements.
