cybersecurity

3159 readers

23 users here now

An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!

Community Rules

Be kind
Limit promotional activities
Non-cybersecurity posts should be redirected to other communities within infosec.pub.

Enjoy!

founded 1 year ago

MODERATORS

[email protected]

How to manage and document decisions (infosec.pub)

submitted 16 hours ago* (last edited 16 hours ago) by [email protected] to c/[email protected]

1 comments fedilink hide all child comments

Big or small, we make decisions every day. Rules, policies, processes, templates, etc.

How do you document the process and results of your decision making and track changes?

To give you some background, a lot of departments discuss certain topics every two weeks, but nothing is written down - it takes a lot of time and worse, some decisions change every two weeks.

I've been trying to fight this battle with OneNote atm and was inspired by some software change management frameworks (wild mix of things):

Each decision/problem gets a new page.

What is the question/problem?
Why is this decision necessary?
What are the pros and cons?
Which departments need to be involved? What is the scope? (department, site, country, continent, international, etc.)
What are the alternatives and consequences of not implementing?
plus changelog
plus metadata, such as parties involved, who proposed it, dates, etc.

Still a work in progress, but it is a mix of RFC, ADR, and some other frameworks.

How do you handle that?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 15 hours ago* (last edited 12 hours ago)

It sounds like you're working towards building change management governance, and you are potentially looking for an enterprise resource planner "ERP". ServiceNow, Atlassian and Oodo are a few examples of these. CIO/CISO/Enterprise Architecture and IT Business organization consultants are some of the likely personas to help get this set up correctly.

Depending on the size of your shop, and since this is in cybersecurity, you may want to look at your overall IT governance structure. Gaps in your governance can lead to some big security and GRC holes and the lens of cybersecurity is the right view to drive change.