Call us now:
John Mackenzie AARPI GRCP M.ISRM NIT.SIG MAISA training is always used as the way to solve the problem, it’s not unique to Australia. But cyber requires more than training, it requires recognition by Industry that cyber is a problem and the ‘burning bridge’ to be lit. One only has to look at the U.S DoD CMMC program as an example, it’s been put in place to address the failure by companies to address DFARS requirements from 2017. That now requires compliance to 110 cybersecurity practices for contract award.
A leaf should be taken from the Accounting, Engineering, Legal or Medical professions, and their approaches to the professionalization of these sectors. You don’t just train an Engineer and say so forth and practice, there is an infrastructure that supports their professional development that includes training and practical skills. Cyber professionals cannot understand all of the intricacies of a NIST CSF profile or ISO 27001 and then apply it in practice without on the job help. That requires companies to develop their cybersecurity risk management capabilities.
It is not possible for an organisation to manage everything, small businesses simply cannot manage 110 cybersecurity controls (NIST SP 800-171). Transfer cybersecurity practices from organisations to other sources through controls inheritance. Companies still own the risk but it is managed else where.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #cybereducation #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A6975398344982417408