Developing a Model for Cybersecurity Maturity Assessment

Cybersecurity has become a topic at the top of the priority list for most university IT operations across the country. CIOs have spent a lot of time, rightfully placed, on; understanding the magnitude of the cybersecurity... [ view full abstract ]

Cybersecurity has become a topic at the top of the priority list for most university IT operations across the country. CIOs have spent a lot of time, rightfully placed, on; understanding the magnitude of the cybersecurity problems that they face, educating their Boards, putting in place strategies around preventing breaches, preparing for breaches, and responding to breaches.  A lot of dollars have been invested, but did it really make a difference?  “I think so” is the last answer that your Board wants to hear.  Did your university achieve more cybersecurity maturity in the process?  Can you quantify that?

There are multiple ways to assess cybersecurity maturity at your institution:

1. You can hire an external firm to assess your cybersecurity maturity.  Some firms will use their own methodology while others will utilize a blend of industry standards, such as ISO 27001 or the NIST Framework for Improving Critical Infrastructure Cybersecurity.   The key here is to be assessed to establish a baseline and to be assessed again at some future interval to demonstrate maturity growth. This can be expensive.
2. Try to assess maturity yourself by utilizing a canned survey (InfoTech Research or Gartner) or attempting to apply an established standard yourself.  The problem with self-assessment today is that there is not a set methodology on the approach. What are the key questions to ask?  Who do you ask these questions of?  Do you collect the data via a survey only or some other method?

This session will focus on presenting a model and tool for self-assessment based on the NIST Framework for Improving Critical Infrastructure Cybersecurity.   This model will address the following questions;

1. How do I organize a self-assessment?
2. What questions do I ask of whom?
3. What format do I ask these questions in?
4. How do I analyze the responses and quantify my cyber security measures?
5. What does my maturity profile look like?
6. What actions do I need to focus on following an assessment?
7. When should I complete my next assessment?

In addition to showcasing our efforts at developing this methodology, Trent University is happy to share what we have developed so it can be adopted at other institutions. It is our ultimate goal to use a subset of maturity scores and generalized data for benchmarking purposes across the whole university sector in Canada.