The scope of the cloud risk assessment included:
- Identifying all business processes related to customer data
- Assessment of data security controls
- Evaluation of written policies
- Recommendations for improved security posture
- Development of White Paper for customers and prospects outlining the organizations formal Data Security program
Kaliber undertook the project in the following phases:
- A review with management of systems, hosting providers and data storage repositories
- An assessment of the scope of customer data stored within the environment
- A review of architecture and networks/subnets
- Identification of third-party or service provider dependencies
- A review of the asset inventory, system inventory and network diagrams
- A review of any compliance regimes that the company would be subject to
- An analysis of controls that were in place compared to those recommended by the NIST Cybersecurity Framework
Kaliber provided a set of deliverables established to both improve the security posture of the client as well as give comfort to their prospects and clients. This output included:
- A Written Information Security Policy
- An Incident Response Policy
- A Disaster Recovery and Business Continuity Policy
- Recommendations for Employee Security Awareness Training
- Establishment of regular phishing training
- Development of improved HR policies around background checks, onboarding, transfers and offboarding
- Validation of secure access policies
- Implementation of software vulnerability management and intrusion detection programs
The outcome of this project was a comprehensive road map for a formal Information Security Management System which could be clearly communicated to outside stakeholders while, at the same time, providing a program which increased the organization’s risk and improved business outcomes.
