Does your organization have a formal process to review and update its cybersecurity strategy following security incidents?
Explanation
Learning from incidents is what this probes: whether you systematically review and update your cybersecurity strategy in the wake of security events.
Organizations should analyze what happened during incidents, why existing controls failed, and how the strategy needs to evolve to prevent similar incidents in the future.
This process helps identify gaps in security controls, training needs, or resource allocation issues that contributed to the incident.
Evidence could include documented post-incident review procedures, meeting minutes from strategy review sessions following incidents, updated strategy documents with tracked changes showing modifications made in response to specific incidents, or formal reports outlining lessons learned and strategic adjustments implemented after security events.
Implementation Example
Review strategy in light of cybersecurity incidents
ID: GV.OV-02.062
Context
- Function
- GV: GOVERN
- Category
- GV.OV: Oversight
- Sub-Category
- The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
Related questions
- Has your organization established metrics to evaluate the effectiveness of risk management decisions in achieving business objectives?
- Does your organization regularly review and adjust cybersecurity risk strategies that may be impeding business operations or innovation?
- Has your organization reviewed recent audit findings to verify that your cybersecurity strategy effectively ensures compliance with both internal policies and external regulatory requirements?
- Does your organization regularly evaluate the performance of cybersecurity roles to identify necessary policy improvements?
- Does your organization regularly review key performance indicators (KPIs) to verify that security policies and procedures are achieving their intended objectives?
- Does your organization regularly review key risk indicators (KRIs) to identify, assess, and prioritize cybersecurity risks based on their likelihood and potential impact?