Assignment Prompt & Instructions
## Final Report: Leading and Managing a Robust and Comprehensive Cybersecurity Program
### Objective
The objective of this assignment is to prepare a comprehensive final report that integrates various aspects of cybersecurity leadership and management including cybersecurity principles, practices, and strategies in the governance of an enterprise’s cybersecurity program. Students are required to research and analyze use cases, real-world examples and existing documentation and standards to make informed recommendations and strengthen a cybersecurity program.
### Assignment Details
The final report should be between 8-12 pages, excluding appendices. It should use APA or MLA formatting guidelines for citations and references and include the following sections.
The report should include the following sections:
01. **Section 1: Introduction (Recommend completing after Unit 1)**
Introduce your report and summarize what you will be entailing. Introduce the topics that will be covered in the report: Executive Cybersecurity Leadership, Cybersecurity Policy and Planning, Security Control Assessment, Privacy Compliance, Cybersecurity Workforce Management, Systems Security Management, Incident Response, and Secure Project Management.
02. **Section 2: Executive Cybersecurity Leadership (Recommend completing after Unit 1)**
Describe the importance and role of leadership in cybersecurity. Provide specific examples of leadership's impact on organizational success.
Make recommendations on how cybersecurity executives can influence organizational strategy, culture, and resilience against cyber threats.
03. **Section 3: Case Studies and Analysis of Leadership (Recommend completing after Unit 2)**
Research and analysis of 2 case studies that demonstrate effective cybersecurity leadership. Show clear insights on leadership's impact on organizational cybersecurity
04. **Section 4: Cybersecurity Planning and Goals (Recommend completing after Unit 3)**
As a small business owner with a mission of supporting services for the health, energy, and finance sectors, you want to begin to create a strategic plan that aligns the [National Cybersecurity Strategic Plan](https://www.cisa.gov/cybersecurity-strategic-plan) and the [CISA FY2024-2026 Cybersecurity Strategic Plan](https://www.cisa.gov/sites/default/files/2025-01/FY2024-2026_Cybersecurity_Strategic_Plan508.pdf).
For the first phase of this plan, you need at least two goals with corresponding and appropriate objectives that will support your overall mission. List and describe the goals and objectives. Also, explain how they align with National and CISA cybersecurity strategic plans.
05. **Section 5: Cybersecurity Policy and Justification (Recommend completing after Unit )**
Review existing policy templates from this content from this week and select at least 5 policies you would start to develop to support your business. Justify why you selected these policies and how they would help mitigate risks and possible threats.
06. **Section 6: Security Control Assessment (Recommend completing after Unit 4)**
[Tabletop exercises](https://www.cisa.gov/sites/default/files/publications/Cybersecurity-Tabletop-Exercise-Tips_508c.pdf) are often included as a critical part in preparing for cybersecurity incidents.
[Security controls found in the NIST Special Publication 800-53r5](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf) specifically discuss and recommend tabletop exercises to be included as part of testing incident response, contingency and other plans. For example, consider security control IR-3 INCIDENT RESPONSE TESTING:
Control: Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency] using the following tests: [Assignment: organization-defined tests].
Discussion: Organizations test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, and simulations (parallel or full interrupt). Incident response testing can include a determination of the effects on organizational operations and assets and individuals due to incident response. The use of qualitative and quantitative data aids in determining the effectiveness of incident response processes. ( [CISA.gov](https://csf.tools/reference/nist-sp-800-53/r5/ir/ir-3/))
Consider the following threat scenario found in [CISA’s cyber insider threat situation manual](https://www.cisa.gov/resources-tools/resources/cybersecurity-scenarios).
“A disgruntled former employee takes advantage of their new position at one of your third-party vendors to exploit vulnerabilities in your systems created by a supply chain issue. An error by another employee discloses personally identifiable information (PII). “
Assume you are working as a cybersecurity manager for a medium-size company in the second year of a 50-million-dollar Department of Defense (DoD) contract award to support the Army. Your tasks are to support the growing cloud infrastructure program, but you also must support multiple off-site Windows and Linux server machines.
Using resources that include cybersecurity risk management best practices, and the implementation of appropriate security and privacy controls answer the following questions.
Note, since this is a fictional company, you will need to respond based on best practices and recommendations. When responding, be sure to reference and/or justify your answer.
01. What are the greatest cybersecurity threats to your organization?
02. What cybersecurity threat information does your organization receive?
1. What cyber threat information is most useful?
2. How is information disseminated across your organization and by whom?
3. What actions would your organization take following an alert like the one presented in the scenario?
03. Has your organization conducted a risk assessment to identify specific cyber threats, vulnerabilities, and critical assets?
1. What information technology (IT) systems or processes are the most critical to your organization?
2. Describe your organization’s asset management plan and how you prioritize critical assets.
3. What improvements have been implemented to enhance cyber resilience following recent risk assessments?
4. Does your organization have a vulnerability management program dedicated to mitigating known exploited vulnerabilities in internet-facing systems?
04. How does your organization mitigate insider threats? Does your organization have an insider threat management program?
1. What are some behavioral indicators of an insider threat?
2. What type of training do employees at your organization receive on identifying a potential insider threat?
05. Describe your organization’s cybersecurity training program for employees.
1. How often are employees required to complete this training?
2. Is training required during employee onboarding before granting system/network access?
3. What additional training is required for employees who have system administrator-level privileges?
4. What type of training methods or approaches have you found most beneficial?
06. How does your organization prevent the disclosure of PII?
07. What are your organization’s processes and procedures to revoke system access when an employee resigns or is terminated?
1. Are there any additional processes implemented if the employee’s termination is contentious?
2. Does your organization retrieve all information system-related property (e.g., authentication key, system administration's handbook/manual, keys, identification cards, etc.) during the employment termination/off boarding process?
08. How often are your cybersecurity plans, policies, and procedures externally reviewed or audited?
1. What were the most recent results and action items that followed?
09. What training does your cybersecurity incident response team undergo to detect, analyze, and report malicious activity?
10. As a leader in your organization what cybersecurity resilience goals have you set?
07. **Section 7: Privacy Compliance (Complete during Unit 5)**
According to the Department of Defense, A Privacy Impact Assessment (PIA) , “is an analysis of how personally identifiable information is collected, used, shared, and maintained. The purpose of a PIA is to demonstrate that program managers and system owners consciously incorporated privacy protections throughout the development life cycle of a system or program. PIAs are required by the E-Government Act of 2002, which was enacted by Congress in order to improve the management and promotion of Federal electronic government services and processes. PIAs allow us to communicate more clearly with the public about how we handle information, including how we address privacy concerns and safeguard information.” ( [Defense.gov](https://dpcld.defense.gov/Privacy/Privacy-Impact-Assessment/))
A [template](https://leocontent.umgc.edu/content/dam/course-content/tus/csia/csia-300/document/CSIA%20300%20Final%20Report%20Template%20V2.docx?ou=1375886) from the Department of Homeland Security and [DD Form 2930](https://leocontent.umgc.edu/content/dam/course-content/tus/csia/csia-300/document/DD%20Form%202930%20PIA.pdf?ou=1375886) is used to document the impact on privacy for a given system. Assuming the role of a privacy compliance officer, you have been tasked to complete some of the sections of DD Form 2930. Specifically, you need to complete section II – PII Risk Review.
Complete the DD Form 2930, Section II, with thorough, detailed responses, including appropriate and effective controls to mitigate PII risks, justified with best practices.
08. **Section 8: Privacy Compliance and Best Practice (Complete during Unit 5)**
Cybersecurity best practices must be complemented by strong privacy compliance to ensure data protection and legal accountability. As part of your PIA documentation, you are also responsible for demonstrating awareness of major privacy frameworks and recommending measures to maintain compliance.
Explain how cybersecurity best practices integrate with privacy compliance to protect user data within the Privacy Awareness Training Application. Summarize the importance of GDPR, U.S. federal privacy laws, and other applicable industry compliance frameworks (e.g., Privacy Act of 1974, HIPAA, or state-level privacy laws).
09. **Section 9: COOP Best Practices (Recommend completing after Unit 6)**
Continuity of operations plans (COOPs) include technical aspects of dealing with impactful business disruptions such as natural disasters, war, cyber-attacks and more. Planning for a major disruption in service minimizes the impact and overall downtime of Enterprise IT assets.
In this section you will provide best practices for a COOP specifically aimed at a ransomware attack for a large federal organization in the Energy sector. Using the CISA Best Practices for COOP (Handling Destructive Malware) and other internet and library resources dedicated to preventing and restoring ransomware attacks, list and describe the best practices.
10. **Section 10: Training and Cyber Awareness Justification (Recommend completing after Unit 6)**
To align the task with workforce management, recommend responsible parties (e.g. CISO, Cybersecurity Analyst, Software Developer, System Administrator…) that would lead and be a part of the COOP efforts.
Explain the training activities that each job role would need to fulfill their duties. Discuss cyber awareness and role-specific training options and recommended frequency for completing the training.
Highlight the importance of regular and updated cybersecurity training to retain both technical and maintain an excellent cyber hygiene for a company or organization.
11. **Section 11: Systems Security Management Methodologies (Recommend completing after Unit 6)**
Discuss methodologies for managing systems security throughout their lifecycle. Research and analyze lifecycle models such as the Microsoft Security Development Lifecyle, Agile, DevOps and others to illustrate effective system security management strategies.
Recommend an approach or model to adopt for your company that integrates security into system development and maintenance processes. Consider selecting tasks and examples listed in the [Secure Software Development Framework (SSDF) Version 1.1](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf) and SDL practices listed in the [Security Development Lifecycle (SDL) Practices document](https://www.microsoft.com/en-us/securityengineering/sdl/practices/).
12. **Section 12: Incident Response Plan Components (Complete during Unit 7)**
Draft the major components of an incident response plan for a public organization of your choice. The mission, strategies, goals, leadership structure and other details about most public organizations can be revealed by searching for this information.
The incident response plan should be 3-5 pages and include the following sections:
– Organization Mission
– Organization Strategies and goals
– Incident Response Leadership – structure and organization of the incident response capability
– Organizational approach to incident response – Best practices the organization will implement as part of the incident response program.
– Defines reportable incidents – A list and brief description of incidents that will be reported and their severity (High, moderate, Low)
– Internal and External communication overview – How the incident response team will communicate with the rest of the organization and with other organizations
– Key Performance Indicators (KPI) – Metrics for measuring the incident response capability and its effectiveness
13. **Section 13: Conclusion (Complete during Unit 7)**
Summarize key findings and recommendations across all topics studied for this course. Reinforce the significance of continuous improvement and adaptation in cybersecurity practices. Be sure to include the importance of effective leadership in managing and governing an enterprise cybersecurity program at a company or organization
#### **Appendices and Reference**
All references used to be listed on the last page in your preferred pedagogical format. Appendices should be included under each section as required. Include supplementary materials such as detailed case studies, additional analyses, or supporting data.