Certified Cybersecurity Compliance Professional.PREVIEW.pdf

CERTIFIED CYBERSECURITY COMPLIANCE PROFESSIONAL

130 pages
Chapter 1: Establish a Cybersecurity Management Strategy
Chapter 2: Cybersecurity Maturity Assessment
Chapter 3: Configure Maturity Requirements
Chapter 4: Identify Cybersecurity Risk
Chapter 5: Perform Risk Assessment
Chapter 6: Define Risk Responses
Chapter 7: Monitor and Control Risk
Chapter 8: Develop Cybersecurity Management Plan
Chapter 9: Reference: Security Risks in Projects
Chapter 10: Reference: Operational Risk for Information Technology
Chapter 11: Reference: Risk Governance and Compliance

COPYRIGHT © 2020 ZULK SHAMSUDDIN, PHD / GAFM ACADEMY
All rights reserved.
ISBN: 9781716287077

INTRODUCTION
The Certified Cybersecurity Compliance Professional ™ (CCCP) is an ISO-
standard certification for individuals with experience in cybersecurity management that
includes developing a cybersecurity strategy, cybersecurity plan, cybersecurity policies,
risk assessment, guidelines, and procedures that are required to achieve the strategic
cybersecurity compliance requirements of the organization.
It forms the basis of the assessment that applicants must pass to gain the Certified
Cybersecurity Compliance Professional status and inclusion in the Register of The
GAFM Academy of Finance and Management ® Directory of Certified Professionals.
This book shall assist candidates to sit for the Certified Cybersecurity Compliance
Professional examination.
Stand out above the rest with the accredited Certified Cybersecurity Compliance
Professional certification and get noticed by top recruiters.
Benefits of becoming a Certified Cybersecurity Compliance Professional
Cybersecurity Compliance Professionals are individuals who implement the
cybersecurity systems and ensure compliance with the organization cybersecurity
policies, guidelines, procedures and regulatory requirements. Becoming a certified
cybersecurity compliance professional has its benefits, some of them are:
• Global recognition
• Enhanced your CV to stand out in the job market, get noticed by top recruiters.
• Get noticed by top recruiters.
• International recognition with the exclusive certification card.

• Assurance for clients of high standards and ethical practice.
• Use of the post-nominal CCCP or Certified Cybersecurity Compliance Professional
™
What are the Benefits of implementing Cybersecurity?
The benefits of implementing and maintaining cybersecurity practices include:
• Business protection against cyberattacks and data breaches.
• Protection for data and networks.
• Prevention of unauthorized user access.
• Improved recovery time after a breach.
• Protection for end users and endpoint devices.
• Regulatory compliance.
• Business continuity.
• Improved confidence in the company's reputation and trust for developers,
partners, customers, stakeholders and employees.
IT professionals and other computer specialists are needed in cybersecurity roles, such
as:
• Chief Information Security Officer (CISO) is the individual who implements
the security program across the organization and oversees the IT security
department's operations.

• Chief Security Office (CSO) is the executive responsible for the physical
and/or cybersecurity of a company.
• Cybersecurity Engineers protect company assets from threats with a focus on
quality control within the IT infrastructure.
• Cybersecurity Architects are responsible for planning, analyzing, designing,
testing, maintaining and supporting an enterprise's critical infrastructure.
• Cybersecurity Analysts have several responsibilities that include planning
security measures and controls, protecting digital files, and conducting both
internal and external security audits.
• Penetration testers are ethical hackers who test the security of systems,
networks and applications, seeking vulnerabilities that could be exploited by
malicious actors.
• Threat hunters are threat analysts who aim to uncover vulnerabilities and
attacks and mitigate them before they compromise a business.
There are eleven chapters to prepare a candidate to sit for the CCCP examination.
The first six represent the pillars of the Cybersecurity Compliance Professional
processes and the remaining chapters discuss how these processes are being applied in
the respective industries.

Chapter 1: Establish a Cybersecurity Management Strategy
Chapter 2: Cybersecurity Maturity Assessment
Chapter 3: Configure Maturity Requirements
Chapter 4: Identify Cybersecurity Risk
Chapter 5: Perform Risk Assessment
Chapter 6: Define Risk Responses
Chapter 7: Monitor and Control Risk
Chapter 8: Develop Cybersecurity Management Plan
Chapter 9: Reference: Security Risks in Projects
Chapter 10: Reference: Operational Risk for Information Technology
Chapter 11: Reference: Risk Governance and Compliance
To apply: https://gafm.com.my/digital-certification/application-for-certification/

CHAPTER 1 : ESTABLISH CYBERSECURITY MANAGEMENT STRATEGY
A cybersecurity management strategy is a security management plan that will
guide your organization to secure its assets from cyber-attacks during the next three to
five years. Obviously, because technology and cyber threats can both change
unpredictably, you'll almost certainly have to update your strategy sooner than three
years from now. A cybersecurity strategy isn't meant to be perfect; it's a strongly
educated guess as to what you should do. Your strategy should evolve as your
organization and the world around you evolve.
The intended outcome of developing and implementing a cybersecurity strategy is
that your assets are better secured. This generally involves a shift from a reactive to a
proactive security approach, where you are more focused on preventing cyber-attacks
and incidents than reacting to them after the fact. But a solid cybersecurity strategy will
also better prepare your organization to respond to those incidents that do occur. By
preventing minor incidents from becoming major ones, your organization can preserve
its reputation and reduce harm to the organization and its employees, customers,
partners and others.
How do you build a cybersecurity strategy for your business? Building a
cybersecurity strategy for your business takes effort, but it could mean the difference
between surpassing your competitors and going out of business in the coming years.
Here's the basic steps you can follow to develop your strategy.
STEP 1. UNDERSTAND YOUR CYBER THREAT LANDSCAPE
Before you can understand your cyber threat landscape, you need to examine the
types of cyber-attacks that your organization faces today. Which types currently affect

your organization the most often and most severely: malware, phishing, insider threats
or something else? Have your competitors had major incidents recently, and if so, what
types of threats caused them?
Next, get yourself up to speed with predicted cyber threat trends that would affect
your organization. For example, many security researchers feel that ransomware is
going to become an even bigger threat as ransomware businesses flourish. There's also
increasing concern about supply chain threats, like purchasing compromised
components and either using them within your organization or building them into
products you sell to consumers. Understanding what threats, you'll face in the future
and the likely severity of each of those threats is key to building an effective
cybersecurity strategy.
STEP 2. ASSESS YOUR CYBERSECURITY MATURITY
Once you know what you are up against, you need to do an honest assessment of
your organization's cybersecurity maturity. Select a cybersecurity framework. Use it
first to assess how mature your organization is in dozens of different categories and
subcategories, from policies and governance to security technologies and incident
recovery capabilities. This assessment should include all of your technologies, from
traditional IT to operational technology, IoT and cyber-physical systems.
Next, use the same cybersecurity framework to determine where your organization
should be in the next three to five years in terms of maturity for each of those
categories and subcategories. If distributed denial-of-service attacks will be a major
threat, for example, then you may want your network security capabilities to be
particularly mature. If ransomware will be your biggest security issue, ensuring that
your backup and recovery capabilities are highly mature may be key. If the remote
work policies driven by COVID-19 become permanent, temporary tools deployed
during the pandemic will need to be hardened. The maturity levels you are targeting are
your new strategic objectives.
STEP 3. DETERMINE HOW TO IMPROVE YOUR CYBERSECURITY PROGRAM
Now that you know where you are and where you want to be, you need to figure
out the cybersecurity tools and best practices that will help you reach your destination.
In this step, you determine how to improve your cybersecurity program so that you
achieve the strategic objectives you have defined. Every improvement will consume
resources such as money, staff time, et cetera. You will need to think about different
options for achieving the objectives and the pros and cons of each option. It may be that
you decide to outsource some or all of your security tasks.
When you have selected a set of options, you'll want to present them to upper
management at your organization for their review, feedback and hopefully support.
Changing the cybersecurity program may affect how business is done, and executives
need to understand that and accept it as being necessary in order to sufficiently
safeguard the enterprise from cyber threats. Upper management may also be aware of
other plans for the coming years that your efforts could take advantage of.

STEP 4. DOCUMENT YOUR CYBERSECURITY STRATEGY
Once you have management approval, you need to ensure your cybersecurity
strategy is documented thoroughly. This includes writing or updating risk assessments,
cybersecurity plans, policies, guidelines, procedures and anything else you need to
define what is required or recommended in order to achieve the strategic objectives.
Making it clear what each person's responsibilities are is key.
Be sure that, as you are writing and updating these documents, you are getting
active participation and feedback from the people who will be doing the associated
work. You also need to take the time to explain to them why these changes are being
made and how important the changes are so that, hopefully, people will be more
accepting and supportive of them. And don't forget that your cybersecurity strategy also
necessitates updating your cybersecurity awareness and training efforts. Everyone in
the organization has a role to play in mitigating security issues and improving your
enterprise cybersecurity program. As your risk profile changes, so must your
cybersecurity culture.
Developing and implementing a cybersecurity strategy is an ongoing process and
will present many challenges. It's critically important that you monitor and reassess
your organization's cybersecurity maturity periodically to measure the progress you are
making or not making toward your objectives. The sooner you identify an area that's
falling behind, the sooner you can address it and catch up. Measuring progress should
include internal and external audits, tests and exercises that simulate what would
happen under different circumstances, like a major ransomware incident.
The process “Establish Cybersecurity Compliance Strategy” is the first process out
of the six processes associated with managing cybersecurity and compliance.
In this process, the following topics will be discussed:
• Role and Responsibilities
• Importance cybersecurity risk and compliance in projects
• Governance structure and stakeholder responsibilities
• Role of compliance in risk governance
• Define Cybersecurity compliance strategies
ROLES AND RESPONSIBILITIES
As a Cybersecurity Compliance officer, it is imperative to know what your roles
and responsibilities are. A risk compliance officer ensures that the organization
conducts its business processes in compliance with laws and regulations, professional
standards, international standards, and accepted business practices. These professionals
perform audits at regular intervals and execute design control systems, advising the
management on possible risks that might occur, and organization policies.

The major task of a compliance officer is to uphold the ethical integrity of the
organization and also ensure that business activities are conducted using a regulatory
framework. These professionals carry out the risk management process by thorough
planning of business and implementing the policies within the organization.
Risk cybersecurity officers are considered to be a vital component of corporate
governance. They are also responsible to determine how an organization could be
handled and governed. These responsibilities include maintaining good rapport
between the stakeholders and adhering to the objectives set by the organization.
The roles and responsibilities of a cybersecurity officers vary depending upon the
industry, but typical responsibilities are compiled below:
• They are accountable for ensuring all the essential guidelines are put in proper
place accurately adhering to industry rules and regulations
• They conduct internal audits and reviews at regular intervals to ensure that
compliance procedures are regularly followed
• They conduct environmental audits adhering to environmental standards
• The compliance risk manager role involves the safety of employees and
businesses as well. It’s their part of duty to ensure all the tasks are done with
higher accuracy. This job role is apt for the individual who gives attention to
all the minute details within the organization.
• They have to ensure that all the employees are thoroughly updated about the
organization’s policies, regulations, and processes
• Resolve employee issues about the legal risk compliances
• They should advise the management regarding the implementation of
compliance programs
• They must adhere to the training and supervising the staff that needs attention
to rules and regulations
• Revise rules, reports, and procedures at regular intervals to recognize the risks

SKILLS FOR CYBERSECURITY AND COMPLIANCE OFFICER
Cybersecurity and Compliance Officers should be self-motivated, extremely
organized, and have strong communication and project management aptitude.
Employers typically seek candidates with a bachelor’s degree, and the following skills:
Communication skills - Irrespective of domain and job role having excellent
written and verbal communication skills are indeed very much essential. Similarly, the
risk compliance manager should be capable to communicate with level employees.
Risk assessment capabilities - The major steps involved in risk management are
identification, analysis, planning, monitoring, reporting, and controlling risks. Hence,
the risk compliance manager should thoroughly these steps and should be able to
implement accordingly. In order to assess risk and interpret them properly, having
fundamental knowledge about rules and regulations must be defined clearly.
Attention to detail - Most of the rules, regulations, and policies within the
organization need detailed analysis. It’s essential to pay attention to all the minute
details.
Thorough knowledge about vulnerability - A Risk Management and
Cybersecurity Officers should have comprehensive knowledge about security policies
such as ISO standards, control, and abuse policies, regulations, monitoring, evaluation,
review, and report associated with auditing.
Business knowledge - Having an in-depth knowledge of business and IT will
definitely ensure a smooth audit session. Essential IT tools and risk-compliance related
technology should be always mastered by the compliance manager.
Problem-solving skills - There are chances of risk cybersecurity officers coming
up with imprecise regulatory policies and business issues. Thus, having problem-
solving capability requires implementation and monitoring the solution. The process
should be carried out in considering pre-defined steps and appropriate feedback should
be given to the chosen solution.
Organizational skills - The risk compliance manager should possess multi-tasking
skills. They should be clear about what has to be done and how the process has to be
carried out.
Strategic planning – the primary job of risk manager is determining the best
possible risk mitigation plan for a project to get completed on time and within budget
Project management – understanding how to identify and assess risks to ensure
project completion within the timeframe and budget allotted
Computer skills – risk managers use specialized computer software for project
management purposes, and also to produce visual presentations, using bar charts and
graphs to explain the impact of risks to key project activities.
CYBERSECURITY COMPLIANCE
In recent years, throughout the world we have followed the high level of corruption
in various economic sectors. Several companies end up having their image and
reputation weakened due to their proven involvement, both at the business level and in

the political sphere. The imperative need to know and practice compliance in day-to-
day activities arose in the midst of this reality, which affects companies of all sizes and
industries. The concept of compliance in business aims to generate value for an
organization and ensure its survival. This practice arises from the great financial
impacts caused by factors such as:
• Absence of normative guidelines
• Misalignments to applicable laws
• Lack of adequate preventative tools
• Process management failures
• Operations without a structured information system.
WHAT IS COMPLIANCE IN BUSINESS?
The verb comply means to conform to a rule, which explains much of the concept
of the word. The meaning of the word compliance is related to the conduct of a
company and its compliance with the rules of regulatory bodies. What is compliance in
business, in short? It means to comply with laws and regulations. This concept covers
all the policies, rules, internal and external controls to which an organization must
conform. When in compliance, an organization’s activities will be in full accordance
with the rules and laws applied to its processes. Both the company and all its people,
including suppliers of interest, need to behave in accordance with the rules of
regulatory bodies. In addition, they must ensure faithful compliance with the various
internal normative instruments. Only in this way will the company comply with
regulations for environment, labor, finance, work safety, operations, accounting, et
cetera.

HOW IMPORTANT IS COMPLIANCE IN BUSINESS?
Being able to say that a company is in strategic compliance is by itself a
fundamental business strategy. It means that there is transparency and an increasing
degree of management maturity. Being in compliance shows that managers and teams
are in control of the processes and procedures, implemented and executed with
effective political, commercial, labor, contractual and behavioral compliance. Not
being in compliance means being unnecessarily high risk, which can lead to financial,
equity and market losses, among many others. Risk management and compliance are
closely linked. It is necessary to reflect and change management styles, adjust the way
company information is handled and how people behave on a day-to-day basis, in order
to achieve a level of excellence in compliance regardless of the business sector and size
of the company.
HOW TO ALIGN MANAGEMENT WITH THE CONCEPT OF COMPLIANCE
Now that you know what compliance in business is, check out some tips:
• Use information systems that support monitoring of the company’s activities and
that conform to compliance processes;
• Have contract management for services and materials that is aligned with the levels
of compliance established by the company;
• Strengthen inspection and inspection routines of activities, including those that do
not usually have certifications;
• Focus on process compliance at the municipal, state, and federal levels;
• Have an active and updated system of standardization in the company;
• Have internal audit processes focused on the requirements to achieve compliance;
• Have control systems with adequate depth degrees;
• Have structured communication about the normative instruments of the company.
WHAT IS A COMPLIANCE FRAMEWORK?
Formally, a compliance framework is a structured set of guidelines to aggregate,
harmonize, and integrate all the compliance requirements that apply to your
organization. In practice, a compliance framework lets you take a collection of
documents, policy manuals, procedure descriptions, mission statements, regulatory
mandates, control documentation and meld those things into one cohesive whole. A
compliance framework brings order to the ceaseless stream of regulatory mandates that
rain down on a large organization so that when something new comes along, you have
a method for integrating that new requirement into your existing approach to
compliance. Compliance frameworks are usually tailored to a specific issue. For
example, you might follow one framework to guide your anti-graft compliance, another
to guide your data privacy compliance, and a third to guide anti-discrimination
compliance. Your compliance program would use those frameworks to measure its
progress on all three issues.

WHY DO COMPLIANCE FRAMEWORKS EXIST?
Compliance frameworks exist to help cybersecurity officers build a compliance
program efficiently. You would miss too many steps, or take certain steps out of ideal
order and end up repeating your work, or repeat the same step over and over and waste
program resources. Some parts of the enterprise might be managing compliance risk
brilliantly, while another part is managing the same risk terribly and you, the
compliance officer, might not be aware of the discrepancy. Which could lead to
awkward conversations with regulators if you experience a compliance failure, and
those regulators start asking about the effectiveness of your compliance program.
Let’s remember that all large organizations already have at least some compliance
activities happening around their enterprise, and many will even have quite a lot of
compliance activity happening. Your job as a compliance officer is to wrestle all that
activity into one disciplined program that meets all the regulatory obligations your
company has. A compliance framework lets you proceed through that work in a
methodical way, so you can reap the most benefit for the least expense of time,
resources and your own sanity!
Moreover, compliance frameworks provide a standard that others can use to judge
your compliance program. That is, when regulators or the board, or auditors, or
business partners ask, “How strong is your compliance program? You can map your
program and its activities to what those frameworks require. Those parties can then
better understand the program improvements you have already made or the ones you
still need to make.
HOW DO YOU IMPLEMENT A COMPLIANCE FRAMEWORK?
You implement a compliance framework first by finding a framework that you can
use and then comparing what that framework requires against what your company
already does. That analysis reveals the gaps in your compliance program, and you
remediate those gaps one step at a time. Of course, the reality of implementing a
framework is more complicated than that abstract theory. Let’s consider an example
from the anti-bribery world. You would begin by researching where you could find an
anti-bribery framework. For example, the U.S. Department of Justice (DOJ) has
published lengthy guidance in the form of the FCPA Resource Guide. The U.K. Serious
Fraud Office has published its own guidance about adequate procedures for the U.K.
Bribery Act. Any number of professional services firms could also help you identify an
anti-bribery framework or fashion one together from regulatory guidance. Then comes
the gap analysis where you will be comparing what that framework requires for a
compliance program against what your compliance program already does. Take for
example the compliance framework requires that your company has an anti-bribery
policy; procedures to help employees follow that policy, and controls to assure that
employees can’t easily evade those policies and procedures.
COMPLIANCE WITH COMPANY POLICIES
A policy is a written statement about how your company views certain risks. It can
be a simple rule that states what the company’s compliance objective is. For example,
for anti-bribery, the policy could be something like the one below:

The company is committed to conducting its business in an ethical, honest, and
transparent manner. Bribery and corruption are not consistent with our values, and
present significant risks to its business. Therefore, employees should never offer, give,
solicit, or accept a bribe; whether cash or other inducement to or from any person or
company. The company is committed to the prevention, deterrence, and detection of
bribery and corruption.
Corporate policies are the backbone of a compliance program. Unto itself,
however, a policy usually does little to teach employees or agents and other third
parties how to act when faced with a particular temptation or risk. That’s where
procedures come in.
WHAT ARE COMPLIANCE PROCEDURES
Procedures provide employees and agents with guidance about how to act under
certain circumstances, to ensure that they don’t violate corporate policies.
For example, you could require employees to seek approval from the legal or
finance department demonstrating a legitimate business purpose before offering to pay
travel and lodging expenses for a foreign government official. You could also require
prospective agents to complete a due diligence questionnaire, or have employees
complete their own due diligence checklists as part of the agent pre-hire process.
A compliance framework will help you understand what procedures you should put
into place. As you can imagine, the total number of procedures necessary to operate a
global anti-bribery program can grow quite large procedures to submit requests,
procedures to review requests, procedures to document decisions, and so forth. A
framework can identify which ones make the most sense for your organization, and
clarify the work that will be necessary to put those procedures into effect.

Certified Cybersecurity Compliance Professional.PREVIEW.pdf

Related slideshows

Recommended for you

Recommended for you

Recommended for you

Recommended for you

More Related Content

Similar to Certified Cybersecurity Compliance Professional.PREVIEW.pdf

Similar to Certified Cybersecurity Compliance Professional.PREVIEW.pdf (20)

More from GAFM ACADEMY

More from GAFM ACADEMY (19)

Recently uploaded

Recently uploaded (20)

Certified Cybersecurity Compliance Professional.PREVIEW.pdf