Cyber Risk
Oversight, management, and reporting on all risks
pertaining to information security, including all forms of
cyber risk and all risks relating to the protection of personal
data throughout the businesses in all locations.
Developing and monitoring Key Risk Indicators (KRI) and
Key Performance Indicators (KPI), relating to the information
security controls of the businesses.
Assist in the ongoing assessment of risk to the security of
information, assets, and personnel.
Assist in management of cyber risk including risk reviews and
mitigation planning.
Risk assessments carried out to
standard, to agreed schedule,
and as required.
Ensure complete and
accurate risk register in place
and monitored
Governance / Standards
Assist with the initial certification and ongoing adoption of
NIST framework.
Develop and maintain information security documentation
to agreed standards.
Facilitation of external information security audits,
management reviews and internal information security
audits.
Define and manage the monitoring of key measures of ISMS
performance.
NIST alignment and
accreditation
Documentation that meets
standards and drives
processes.
Audits progressed smoothly
and with least disruption to the
business as possible.
All agreed security KPIs
(Including security controls)
monitored and reported as
required.
Information Security Strategic leadership
Drive and coordinate the management of security through
the sharing of ideas between key security players; the
monitoring of threats and subsequent identification of
opportunities for improvement; and the on-going
monitoring of security activity (e.g., penetration testing
actions) to meet targets; and drive and manage the
development of information security to ensure approaches,
techniques and tools continue to meet needs.
Ensure that the team become an active part of projects at
an early stage to ensure that all projects take information
security into account; and to carry out - or oversee -
information security risk assessments and ensure that the
results are acted upon.
Provide training, coaching and internal consultancy to the
business at all levels in relation to the Information Security
Management System, the NIST framework and a wide
variety of IT controls and information security controls, and
in respect of new and evolving IT standards, cyber risks, and
information security issues.
Authorise the release of system changes into production
environments according to agreed parameters and
processes.
Provide information security guidance to IT team as part of
project and software development lifecycles.
Perform regular internal and external security audits and
testing including penetration testing.
Sharing of security ideas
actively promoted.
Audit actions (inc. penetration
tests) managed and followed-
up in a timely fashion.
Applicable threats identified
and actioned within agreed
timescales.
Ongoing measurable
improvements to approaches
implemented to ensure
information security is
maintained long term.
Guidance in security risk
assessments provided and
carried out as required.
Corrective changes
documented and agreed
based on risk assessments and
carried out to plan.
Change releases checked
and authorised as required
and in a timely manner.
Project Security Risk
Assessments carried out as
required.