Information governance and information security

Information governance

Where InfoSec is coming from today Where InfoSec is coming from How InfoGov can work with InfoSec What Records Managers need to learn

The players Risk Audit Compliance Information Security Privacy IT Operations Legal

Information security CIA: Confidentiality, Integrity, Availability Prevent breaches of information Train and educate end users Patching Put in place CONTROLS Respond to Security Audits Access Controls Cyber Insurance Information security

Information security controls DLP or Data Loss Prevention NAC Network Access Controls Policies Procedures Access Controls Multi-Factor Authentication

Protecting Information PII Personally Identifiable Information PHI Personal Healthcare Information PCI Credit Card Information Attorney Client Privilege Trade Secrets

Information security Know what we have (PII or PHI) Know where it is Know how it is being used = Controls easily implemented

Information security alignment Standards & FRAMEWORKS Regulations HIPAA GDPR NACHA ISO NIST COBIT SOC2 ETSI CISQ NERC ISA/IEC 62443 IASME To build your Information Security Management System ISMS

The two professions 1995 1955 ARMA has been around since 1955 The first CISO was named in 1995

Information governance We know our organization’s information We know where the gaps are We know the players We have a good understanding of the playing field We know the end users We understand the process of getting information policies and processes pushed through

Information governance tasks Learn the language Learn Know the technology Know Understand the controls Understand See the priorities See

Organizations and certifications ISACA – Knowledge and practices for Information Systems https://www.isaca.org/Pages/default.aspx ISSA -- International Systems Security Association https://www.issa.org/ ISC Squared - Cybersecurity and IT Security Professional Organization https://www.isc2.org/ IAPP -- International Association of Privacy Professionals https://iapp.org/ IIA – Institute of Internal Auditors https://na.theiia.org/Pages/IIAHome.aspx CISA® validates skills and experience in auditing, control information security and cybersecurity. CRISC™… risk, information systems control and cybersecurity. CISM®… information security management and cybersecurity. CGEIT®… enterprise IT governance.

Remove duplicate efforts goals Pool resources Remove duplicate efforts Leverage controls Translate

You know your information landscape

THANK YOU! Jeff Lewis jlewisrecords@yahoo.com