1. Information governance and information security

2. Information governance

3. Where InfoSec is coming from
today
Where InfoSec is coming from
How InfoGov can work with InfoSec
What Records Managers need to learn

4. The players Risk Audit Compliance Information Security Privacy
IT Operations
Legal

5. Information security CIA: Confidentiality, Integrity, Availability
Prevent breaches of information
Train and educate end users
Patching
Put in place CONTROLS
Respond to Security Audits
Access Controls
Cyber Insurance
Information security

6. Information security controls
DLP or Data Loss Prevention
NAC Network Access Controls
Policies
Procedures
Access Controls
Multi-Factor Authentication

7. Protecting Information
PII Personally Identifiable Information
PHI Personal Healthcare Information
PCI Credit Card Information
Attorney Client Privilege
Trade Secrets

8. Information security Know what we have (PII or PHI) Know where it is
Know how it is being used
= Controls easily implemented

9. Information security alignment
Standards & FRAMEWORKS
Regulations
HIPAA
GDPR
NACHA
ISO
NIST
COBIT
SOC2
ETSI
CISQ
NERC
ISA/IEC 62443
IASME
To build your
Information Security Management System ISMS

10. The two professions 1995 1955 ARMA has been around since 1955
The first CISO was named in 1995

11. Information governance
We know our organization’s information
We know where the gaps are
We know the players
We have a good understanding of the playing field
We know the end users
We understand the process of getting information policies and processes pushed through

12. Information governance tasks
Learn the language
Learn
Know the technology
Know
Understand the controls
Understand
See the priorities
See

13. Organizations and certifications
ISACA – Knowledge and practices for Information Systems
ISSA -- International Systems Security Association
ISC Squared - Cybersecurity and IT Security Professional Organization
IAPP -- International Association of Privacy Professionals
IIA – Institute of Internal Auditors
CISA® validates skills and experience in auditing, control information security and cybersecurity.
CRISC™… risk, information systems control and cybersecurity.
CISM®… information security management and cybersecurity.
CGEIT®… enterprise IT governance.

14. Remove duplicate efforts
goals
Pool resources
Remove duplicate efforts
Leverage controls
Translate

16. You know your information landscape

17. THANK YOU!
Jeff Lewis