Information Systems Security
Information Systems Security is too often considered as a tactical response, while the organization's adversaries take a decidedly strategic world view. TPP works with companies to approach information systems security from a strategic, process point of view and craft an approach that's specific to the organization's overall threat landscape and risk profile.
TPP offers the following Systems Security services:
For further information
Contact Practice Leaders
Michael Lyman
Nate Kostoulakos
Information Security Risk Assessments
​
Widely considered the most important aspect of an organization's security posture, risk assessments are often the most overlooked. They are considered too time consuming and costly, and the results are usually put on a shelf, only to be dusted off when the auditors visit. But a risk assessment can provide a clear, concise means to highlight critical organizational infrastructure, focus scarce resources, and provide management with a clearer picture of the organization's security, and even business, landscape.
TPP works with industry accepted security frameworks, or the client's own security framework, to create a risk assessment that gets to the heart of the organization's critical assets and risk tolerance. TPP's risk assessment services can provide "board ready" packages that can help guide decisions at the highest level in the organization, can help the organization better understand the risk landscape, and lower risk related costs by focusing resources on the areas that need the most attention.
Policy and Control Development & Implementation
​
NIST, the agency responsible for Federal Information System Security and Privacy, defines 256 controls across 18 control groups. And other frameworks are just as comprehensive. Defining and implementing the right controls across different assets, risks, departments and resources is a serious challenge in any organization.
TPP helps clients define security controls in a way that fits the organization's culture and focus, develop a comprehensive project planand then help to implement the controls throughout the organization. By creating a smooth transition, providing opportunities for staff training, and creating a robust project structure for new controls, TPP can help clients realize faster time to maturity in their control environment.
Security Audit Preparation
​
Security Audits are expensive, both in terms of dollars and reputation. Before the auditors arrive, let TPP work to create the most favorable environment possible for the auditors and the business.
TPP has experience working with third party audit teams within SOx, SOC, ISO, and other frameworks. TPP can work with an organization to quickly determine any gaps in the control environment that might cause red flags for the auditor.
In addition, TPP helps organizations select auditors and can work directly with the third party audit team on behalf of the organization to ensure the auditors always have what they need to increase the chances of a favorable opinion.
Security Operations Development and Management
​
With an almost daily barrage of news about security breaches, hacking, and other computer crimes, many organizations are trying to ramp up a new internal security function as fast as possible. TPP has extensive experience in both IT and Security Governance and Operations and can help organizations make both the strategic and tactical decisions necessary to deploy an internal security team that fits budget, culture, and risk tolerance. Options can range from strategic consulting on a security roadmap to fractional-CISO/CSO arrangements that build and manage the right security team on-premises.
TPP's fractional CISO/CSO engagements allow our clients to take advantage of IT Security Governance and Operations Management as a Service. Typically part-time, the fractional CISO/CSO works to create a mature security organization in companies that want to maintain a security posture without maintaining a full-time team.
TPP's interim CISO/COS engagements help companies cover the gaps when in-house security management isn't available. Typically full-time, the interim CISO/CSO provides an organization unbroken security management coverage, allowing the company time to find a new full time replacement.