Building a Security-First Culture in Any Organization

How to use this guide

• ✓Adopt the policy statements in Section 2 as a baseline and tailor them to your risk appetite.
• ✓Assign the responsibilities in Section 3 to named owners with clear authority.
• ✓Operate the schedule in Section 4 and the vulnerability standard in Section 5.
• ✓Run the tabletop program in Section 6 and the incident, ransomware, backup, and recovery requirements in Section 7.
• ✓Track the metrics in Section 10 and the roadmap in Section 11.

Role responsibilities

Recommended operating cadence

Model remediation deadlines

Operating requirements

• ✓Maintain an authoritative asset, identity, and application inventory to scope scans accurately.
• ✓Run authenticated internal scans and external scans on the cadence in Section 4.
• ✓Triage findings, assign owners, and track to closure in a single register.
• ✓Risk-accept exceptions in writing with an owner and review date; do not let them persist silently.
• ✓Prioritize internet-facing, public-exploit, and privileged-access exposure.
• ✓Verify remediation with a re-scan before closing a finding.

Program requirements

• ✓Define objectives, scope, participants, and a facilitator before each exercise.
• ✓Rotate scenarios: ransomware, business email compromise, cloud compromise, data theft, destructive attack, and third-party failure.
• ✓Include executives, legal, communications, IT, security, HR, and business owners where relevant.
• ✓Capture decisions, gaps, and timings; produce an after-action report (see Section 13).
• ✓Convert lessons into corrective actions with owners and due dates; track to closure.

Exercise questions

• ✓Who declares an incident, and how is the team activated after hours?
• ✓How do we communicate if email or identity systems are compromised?
• ✓What is our decision path for isolating critical systems or paying extortion?
• ✓How quickly can we restore identity and critical services from trusted backups?
• ✓Who notifies the insurer, counsel, customers, regulators, and law enforcement, and within what deadlines?
• ✓What evidence do we preserve, and how do we maintain chain of custody?
• ✓What manual workarounds keep safety- and revenue-critical operations running?
• ✓How do we validate the attacker is gone before restoring production?

Incident response requirements

• ✓Maintain an approved incident response plan with clear activation criteria and a 24x7 reporting path.
• ✓Define an incident commander, technical lead, and communications lead before an incident.
• ✓Preserve logs with synchronized time, defined retention, and protected storage.
• ✓Run a post-incident review after every significant incident and feed lessons into the corrective action register.

Ransomware readiness

• ✓Maintain offline or immutable backups of critical systems and test restores.
• ✓Protect identity, backup, hypervisor, and management platforms as tier-0 assets.
• ✓Require phishing-resistant MFA for privileged and remote access.
• ✓Pre-negotiate contacts for breach counsel, cyber insurance, and external incident response.
• ✓Document a ransom/extortion decision framework with defined authority.

Crisis management

• ✓Maintain an out-of-band communications channel independent of corporate email and identity.
• ✓Prepare holding statements for employees, customers, partners, regulators, and media.
• ✓Define who speaks publicly and the approval path for external statements.

Backup and recovery

• ✓Define recovery point and recovery time objectives per critical service.
• ✓Store backups isolated from production identity and admin accounts.
• ✓Test restores quarterly per critical system and after major changes.
• ✓Rebuild from trusted images; do not return compromised systems to production unverified.

Recommended metrics

First 30 days

• ✓Approve and communicate the cybersecurity-first policy.
• ✓Assign role owners and establish a 24x7 incident reporting path.
• ✓Stand up an asset, identity, and critical-service inventory.
• ✓Confirm MFA on all privileged and remote access.
• ✓Verify backups exist, are isolated, and a restore has been attempted.

First 90 days

• ✓Begin monthly external and quarterly internal vulnerability scans.
• ✓Launch the vulnerability register with risk-based deadlines.
• ✓Run a phishing simulation and schedule annual training.
• ✓Complete onboarding security reviews for critical vendors.
• ✓Deliver the first executive cyber risk report.

12 months

• ✓Run a full tabletop exercise and an annual penetration test.
• ✓Complete quarterly restore tests for all critical systems.
• ✓Complete access reviews and third-party reviews on the operating cadence.
• ✓Report metrics to the board at least semi-annually.
• ✓Refresh the risk register and update policy from lessons learned.

Readiness checklist

• ✓Approved policy, plan, and ransomware annex with activation criteria.
• ✓Named role owners and a documented authority matrix.
• ✓Asset, identity, data-flow, and dependency inventories current.
• ✓Centralized logging with synchronized time and protected retention.
• ✓Offline or immutable backups with tested restores.
• ✓Phishing-resistant MFA on privileged and remote access.
• ✓Pre-negotiated external IR, breach counsel, and insurer contacts.
• ✓Vulnerability scanning operating on the required cadence.
• ✓Tabletop exercise completed in the last 12 months.
• ✓Metrics reported to executives and the board.

Corrective action register

Track every finding, exercise lesson, and audit issue to closure. Maintain at minimum: finding, corrective action, owner, due date, priority, and validation method. Review open items monthly and escalate past-due items to leadership.

Government and professional references