Cybersecurity policies establish expectations for the protection of information against deliberate and accidental threats and vulnerabilities. Many organizations struggle with embedding these expectations into day-to-day operations. What’s more, board and senior leadership expectations regarding cybersecurity may not always translate into viable policies and procedures. During this session, we will discuss moving toward principle-based policy governance based on widely available cybersecurity control standards. Participants will be invited to share their current experience with governance and provide feedback on the value of a principle-based approach.

. List the challenges associated with defining, implementing and managing cybersecurity policies and procedures

2. Describe the traditional approach to cybersecurity policy management and its limitations

3. Explain a framework to more effectively define, organize, implement and manage organizational cybersecurity policy expectations

Adam Nunn, Principal Consultant, Clearwater