1. Robert Fullagar CISSP CISM CRISC Clas CEH “Security is everyone’s responsibility”

2. Security Programme Structure and Methodology Contents People Structure –Key positions –Roles of individuals Methodology/Approach –Deliverables

3. People Senior Manager/Board Member Senior Security SME Business Representatives Programme Manager Project Managers Delivery Teams External Resource Security SME

4. Delivery Team Structure Security SME Programme Manager Project Manager Infrastructure Lead External Resource Do’ers

5. Other People Security Architects Legal SpecialistPMO Support Technical Architects ProcurementHR Etc

6. Roles Influencer Has a vested interest in improving security Can keep the momentum going Able to procure budget Senior Manager/Board Member

7. Roles Set/agree scope for the business area Set priority based on risk for the business area Monitor progress They are decision makers Business Representatives

8. Roles Senior Security SME Programme Manager Project Managers Action the decisions of the business representatives Translate the business and technical requirements Bring resource and structure to deliver the scope Provide budgetary figures to the programme board Select and evaluate solutions

9. Roles These are the do’ers, the engine room The detail people, they bring to bear that detailed specific knowledge They do the actual work, hands on work They help make the projects boards scope a reality Delivery Teams External Resource Security SME

10. Initiator Legislative Contractual External standards Business driver or direction Infrastructure replacement project Consolidate security in finished project Because its “Best Practice”

11. What happens when Phase 0 Discovery 6-18 Months Risk Assessment provides Input to phase 1 Phase 1 Foundation 18 months – 2 years Phase 2 Leverage 2-5 Years + Delivery phase 1 scope Delivery phase 2 scope Phase 0 – Eye on Phase 1 scope and long term strategy Phase 1 – Define long term strategy BAU Security Cycle

12. Board Deliverables Senior Manager/Board Member Business Representatives Phase 0 - Scope –Business area –Drivers – why –Financial commitment –Time and resource commitment –Draft strategy

13. Phase 0 –Plan – Resource and tasks –Budget +/- 100% –Approach –Quick wins Minimal cost –Risk Assessment Programme Deliverables Senior Security SME Programme Manager Project Managers Delivery Teams External Resource Security SME

14. Board Deliverables Senior Manager/Board Member Business Representatives Phase 1 –Priorities the items from the risk assessment –Financial support –Allocate and commit resource –Long term strategy

15. Phase 1 –Risk assessment –Proposals to remediate –Accurate costs –Plan, time and resource –Deliver agreed scope Programme Deliverables Senior Security SME Programme Manager Project Managers Delivery Teams External Resource Security SME

16. Board Summary Programme Phase 0 –Business Driver Vision –Initial Budget –Commitment

17. Phase 0 –Plan –Budget –Approach –Quick wins Board Summary Programme Phase 0

18. Board Summary Phase 1 GO

19. Phase 1 –Risk Assessment –Remediation actions –Budget to remediate –Outline plan Board Summary Programme Phase 1

20. Board Summary Programme Phase 1 –Priorities Risks –Financial support –Commitment –Agree plans

21. Board Summary Phase 1 Long term strategy

22. BAU Security Plan Do Check Act

23. Thank You Questions