Client: Public Corporation A (public institution)
Project duration: Conducted over one month in 2014; achieved an assessment result about 15 points higher than the previous year
Project background and subject
The client became an institution subject to the on-site assessment of the National Intelligence Service’s annual information security status assessment, and the previous year’s assessment result was evaluated as considerably lower than the earlier self-assessment.
As with other public institutions, supervisory results from a higher authority are sensitive for the head of the institution and related personnel. Because it was difficult to expect a high assessment result with only internal personnel of limited expertise, the client commissioned pre-consulting in preparation for the status assessment in order to obtain a better result.
The client allocated part of the existing integrated IT maintenance project budget to cover the consulting cost, so that the existing informatization budget would not bear an additional cost.
IT and Information Security Environment
Business and IT environment
The client’s main revenue comes from charges imposed on companies or local governments when they fail to comply with laws related to public services, so the business and IT environment was not particularly favorable. Relative to its size, however, the number of information systems in operation is smaller than at a typical company, and many small-scale services are scattered across the IT environment. To reduce the operating cost of numerous information systems and security systems, integrated IT maintenance is outsourced.
Information security environment
Like most public institutions of a similar size, the client has a common difficulty: a dedicated information security organization has not been established, and staff responsible for IT system operations hold the security role concurrently. The share of work devoted to information security and personal information protection is therefore relatively low, while disruptions to public-facing services and related project management account for a relatively high share.
On the technical side, the client had already deployed and was operating the security solutions that public institutions are required to adopt. Because of budget and other constraints, however, network separation had not yet been implemented. The environment therefore relies on media-control solutions, harmful-site blocking solutions, antivirus products, and similar controls to respond to malware, and it remains constrained.
The deployed security solutions were not complete. Problems such as access to harmful sites that bypassed them and file sharing between PCs were pointed out together with preparation for the status assessment, so that the client could request an upgrade or improvement of those security solutions.
Project CSF
- Accurately understand the requirements of status-assessment items, including items changed, consolidated, or newly added this year, and secure related evidence
- Build a status-assessment simulation to strengthen the organization’s own ability to respond to the assessment conducted every year
- Use the status-assessment simulation to select and prepare priority focus items from multiple perspectives
- Prepare for the assessment in advance by considering assessor trends and recent priorities of the status assessment
Key Activities and Deliverables
| Execution phase | Key activities | Deliverables |
|---|---|---|
| Status assessment item analysis and simulation development | – Identify changes to status-assessment items – Identify evaluation criteria by item and agree on target scores – Prepare a status-assessment result simulation | – Status assessment simulation |
| Review of internal materials by item and first interview | – Review materials related to each status-assessment item – First interview with practitioners for each item | – |
| Selection of priority focus items and first assessment simulation | – Based on the document review and interview results, select and agree on the priority focus items – First assessment simulation based on the priority focus items – Comparison and analysis of the first assessment simulation against the target score | – First status-assessment simulation |
| Development of evidence by item and second simulation | – Implementation of priority focus items and development of evidence (Examples: establishment and revision of policies and guidelines, drill plans and results, information security awareness training, practitioner security training, and similar items) – Development of evidence for other items and a second simulation – Comparison and analysis between the target score and the second simulation – Development of evidence for improvement items identified by the comparison | – Evidence by item – Final status-assessment simulation |
- Deliverable example: status assessment simulation
