1. Implementing an Information Systems Security Plan THE MONTANA OFFICE OF PUBLIC INSTRUCTION

2. First Step - Planning Create a “Plan for the Plan” that describes Why? (Policy, risk, etc.)

3. First Step - Planning Create a “Plan for the Plan” that describes Why? (Policy, risk, etc.) What is affected? (Entire organization)

4. First Step - Planning Create a “Plan for the Plan” that describes Why? (Policy, risk, etc.) What is affected? (Entire organization) Who? People keeping the plan in motion People you need help from

5. First Step - Planning Create a “Plan for the Plan” that describes Why? (Policy, risk, etc.) What is affected? (Entire organization) Who? People keeping the plan in motion People you need help from What is being changed? (Focus on 18 control families)

6. First Step - Planning Create a “Plan for the Plan” that describes Why? (Policy, risk, etc.) What is affected? (Entire organization) Who? People keeping the plan in motion People you need help from What is being changed? (Focus on 18 control families) When? Order of action Best estimates

7. First Step - Planning Create a “Plan for the Plan” that describes How? Designate Categorize Secure

8. First Step - Planning Create a “Plan for the Plan” – Other topics to include

9. First Step - Planning Create a “Plan for the Plan” – Other topics to include Short-term mitigation considerations i.e. current events/threats

10. First Step - Planning Create a “Plan for the Plan” – Other topics to include Short-term mitigation considerations i.e. current events/threats Targeted mitigation considerations Market research (i.e. Verizon DBIR top threats for your industry) Industry best practices

11. Second Step – Get Organizational Support Our approach: communicate, repetition Present to Leadership Present to Division Heads Present to Staff

12. Second Step – Get Organizational Support Our approach: communicate, repetition Present to leadership, division heads, staff Elaborate on driving factors for security Policy, audit, breach, reputation, etc.

13. Second Step – Get Organizational Support Our approach: communicate, repetition Present to leadership, division heads, staff Elaborate on driving factors for security Policy, audit, breach, reputation, etc. Explain NIST topics at a relatable level i.e. student data at the copier, sensitive data on your desk

14. Second Step – Get Organizational Support Our approach: communicate, repetition Present to leadership, division heads, staff Elaborate on driving factors for security Policy, audit, breach, reputation, etc. Explain NIST topics at a relatable level i.e. student data at the copier, sensitive data on your desk Sample Slides:

15. Let’s Minimize Security Risk Across OPI NIST provides guidance on: USB drives Student data at the copier The OPI ISSP

16. Let’s Minimize Security Risk Across OPI NIST provides guidance on: USB drives Student data on your desk Student data at the copier Desktops The OPI ISSP

17. Let’s Minimize Security Risk Across OPI NIST provides guidance on: USB drives Student data on your desk Emailing sensitive information Student data at the copier Phones, Tablets Traveling with a laptop Social Engineering Desktops The OPI ISSP And Many More… Internet Use

18. Second Step – Get Organizational Support Our approach: communicate, repetition Present to leadership, division heads, staff Elaborate on driving factors for security Policy, audit, breach, reputation, etc. Explain NIST topics at a relatable level i.e. student data at the copier, sensitive data on your desk

19. Second Step – Get Organizational Support Our approach: communicate, repetition Present to leadership, division heads, staff Elaborate on driving factors for security Policy, audit, breach, reputation, etc. Explain NIST topics at a relatable level i.e. student data at the copier, sensitive data on your desk Introduce your ISSP Plan

20. Second Step – Get Organizational Support Our approach: communicate, repetition Present to leadership, division heads, staff Elaborate on driving factors for security Policy, audit, breach, reputation, etc. Explain NIST topics at a relatable level i.e. student data at the copier, sensitive data on your desk Introduce your ISSP Plan Ask for help

21. Lessons Learned Time

22. Lessons Learned Time Resources

23. Lessons Learned Time Resources Buy-in

24. Next Steps for OPI Update Roles and Responsibilities Categorize Systems Project Planning for Controls Planning family Risk assessment family

25. Contact Curt Norman CNorman@mt.gov 406-444-3536