Case Study: At a Glance
Challenges:
- 6 weeks to plan and deliver
- Operational independence in ecosystem
- Multiple locations and languages
- Limited process standardization
Results:
- Current Maturity: 2.50
- Target Maturity: 3.50
- North and South America scored well, Europe and Asia average, and Australia scored the worst
Services Rendered:
- Cyber Security Review (CSR)
Situation
The client, an international bank with operations spanning across the globe, was working to kickstart a security improvement program. The client Steering Committee previously completed the initial planning, budgeting, and scheduling.
- Customization of location-specific initiatives occured before the current state assessment
- 6 weeks to plan and deliver
- A high degree of operational independence in bank's IT ecosystem
- Limited standardization of processes across locations
- Multinational team with local languages
Task
The client engaged NCC Group to conduct Cyber Security Reviews (CSR) of all their regions leveraging the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF). NCC Group stood up a global but local team that was centrally managed byt staffed locally to align regional culture and language requirements. Planning and client communications were handled centrally to ensure NCC Group consultants functioned as a cohesive team with one voice.
Action
NCC Group worked with the client technology and security leadership to conduct a collaborative CSR. The assessment was performed through the dual lens of transportation and SaaS while strategizing a roadmap that could deliver measurable improvements in the year before the client went public.
- Established business context of regional and global vision, culture, risk appetite, and resource constraints
- Performed business-focused threat modeling to identify relevant threat actors and attack vectors targeting critical business applications
- Performed NIST CSF-driven maturity-based controls assessment
- Defined current state of security measures and identified gaps
- Presented a detailed report with recommendations to the Board of Directors
Results
- Globally, the clinet was assessed at a 2.50 (Risk Informed) level of cyber security maturity as per NIST Implementation Tiers
- Assessed maturity was lower than the client's desire to have a robust and repeatable program that translated to a target rating of 3.50 (Repeatable)
- Assessment findings drove localization and prioritization of initiatives as part of the global security improvement plan
- Significant regional variances were found across all five NIST functions, such as:
- North and South America scored well on Recovery controls, with Europe and Asia around the middle and Australia scoring the worst
- On Detect controls, European and Asian operations trounced the Americas
This engagement has been a Godsend before the rollout of our global security improvement program, helping us understand where to focus our efforts.
The highlights for us were the NCC [Group] consultants' deep knowledge and experience, their focus and concentrated way of working... [They] always would make the sometimes abstract concepts vert tangible, which helped us... provide them with the right answers and also collect the evidences.
Download this case study or learn more about Cyber Security Review.
Doing research on CSR? Download this case study, read more about CSR, or reach out to a cyber security expert to see how CSR could work for your business.