Project #1: Cybersecurity Strategy & Plan of Action
Your Task:
You have been assigned to support the Padgett-Beale Merger & Acquisition (M&A) team working under the direct supervision of Padgett-Beale’s Chief Information Security Officer (CISO). The M&A team is in the planning stages for how it will integrate a new acquisition, Island Banking Services, into the company as its financial services arm (PBI-FS). Initially, PBI-FS will function as a wholly owned subsidiary which means that it must have its own separate cybersecurity program.
Your first major task (Project #1) will be to help develop a Cybersecurity Strategy & Plan of Action for PBI-FS. Island Banking Services never had a formal cybersecurity program so you’re starting from scratch. You will need to research best practices as well as relying heavily upon what you learned in your undergraduate studies in Cybersecurity Management and Policy. The CISO has provided detailed instructions for this task. (These appear after the Background section below.)
Background
After five years of operation, Island Banking Services — a non-U.S. firm — was forced into bankruptcy after criminal money laundering charges were filed against the company and its officers. Padgett-Beale, Inc. purchased the digital assets and records of this financial services firm from the bankruptcy courts. The purchased assets include licenses for office productivity software, financial transactions processing software, database software, and operating systems for workstations and servers. Additional assets included in the sale include the hardware, software, and licensing required to operate the company’s internal computer networks.
Figure 1. Island Banking Services IT Infrastructure Purchased by Padgett-Beale, Inc.
Padgett-Beale’s legal counsel successfully negotiated with the bankruptcy court and the criminal courts for the return of copies of the company’s records so that it could restart Island Banking Service’s operations. The courts agreed to do so after Padgett-Beale committed in writing to reopening the customer service call center (but not the branch offices) on the island. Reopening the call center will provide continued employment for 10 island residents including 2 call center supervisors. Padgett-Beale intends to relocate the call center to a company owned property approximately 10 miles away from the current location and adjacent to a newly opened Padgett-Beale resort.
Padgett-Beale’s Risk Manager has recommended that the Merger & Acquisition plan be amended such that Island Banking Services would be operated as a wholly owned subsidiary for a period of 5 years rather than being immediately and fully integrated as an operating element of Padgett-Beale. The company’s attorneys agreed that this would be the best approach given the potential for additional legal troubles related to the actions of the previous owners and employees. The Board of Directors has signed off on this amendment to the M&A plan and stipulated that the new subsidiary will be named PBI Financial Services (PBI-FS). The company officers and senior managers for PBI-FS will be named at a later date. For now, the leader of the M&A Team will serve as the Chief Operating Officer. Padgett-Beale’s Chief Information Security Officer will be loaned to PBI-FS while a search is conducted for a dedicated CISO for the subsidiary.
CISO’s Detailed Instructions to You
The CISO has given you and your team mates a set of instructions (below) which you should follow as you complete this task.
Task #0: Read and Analyze the Background Materials
If you have not already done so, read the Background information in this file. Next, review the Padgett-Beale M&A Profile 2020 which was posted to the LEO classroom. You should also review all materials from the classroom for Weeks 1 – 4 as these provide needed information about the Financial Services industry and the legal and regulatory requirements which apply to this industry.
Task #1: Perform a Gap Analysis & Construct a Risk Register
Using the information available to you, determine the most likely information technology/security gaps which existed at Island Banking Services prior to its being acquired by PBI. Next, determine which of these, if not addressed, will likely exist in the newly formed subsidiary PBI-FS. Document your analysis and evaluation in a Gap Analysis.
Your Gap Analysis should address operating issues relating to confidentiality, integrity, and availability (CIA) of information, information systems, and information infrastructures owned or used by PBI-FS. Your analysis should also consider and use the People, Process, and Technology framework.
Step 1: Identify 10 or more significant cybersecurity issues/challenges/risks which the background information and M&A profile indicate currently exist at PBI-FS / Island Banking Services. You are allowed to “read between the lines” but must be able to map your analysis and findings to specific statements from these documents. These items will become your “Gaps” for the Gap Analysis. Use one or more cybersecurity frameworks or standards (e.g. NIST CSF; People, Processes, and Technologies; Confidentiality, integrity, availability) to organize your analysis.
Note: there was significant criminal behavior found at Island Banking Services. Your analysis must address internal weaknesses which allowed this to occur without being discovered by the employees who were not involved in the crimes.
Step 2: Using your Gap Analysis (step 1) create a Risk Register in which you list 10 or more specific and separate risks. For each risk, assign a category (confidentiality, integrity, availability, people, process, technology) and a severity (impact level using a 1 – 5 scale with 5 being the highest potential impact).
Step 3: Review the laws and regulatory guidance which apply to the Financial Services industry and companies like Island Banking Services. For each entry in your risk register, identify and record the laws, regulations, or standards which provide guidance as to how the identified risks must be addressed or mitigated. Record this in your risk register.
Step 4: Review laws and regulations which apply to all companies, i.e. Sarbanes Oxley, IRS regulations for Business Records, SEC regulations and reporting requirements, etc. Review your Risk Register and either map these requirements to existing entries in your risk register or insert new entries for significant legal or regulatory requirements which you were not able to map to your previously identified risks. (Include risk related to non-compliance.)
Step 5: Review section 1.2 Risk Management and the Cybersecurity Framework in the NIST Cybersecurity Framework v1.1 (https://nvlpubs.nist.gov/nistpubs/CSWP/NIST. CSWP. 04162018.pdf)
Using this information, determine the best strategy for addressing (“treating”) each of your identified risks. Remember the four types of risk mitigation strategies (accept, avoid, control, transfer).
Consider the business impact for each of your mitigation strategies (e.g. if you applied an “avoid” strategy across the board, the company would not be able to operate in the financial services industry because it would need to shut down all operations).
Record your risk mitigation strategy for each risk in your risk register. For each of your “control” entries, include the corresponding control category and subcategory (if applicable) from the NIST Cybersecurity Framework (see Tables 1 and 2 in version 1.1). Examples: ID.AM Asset Management or PR.AC Identity Management and Access Control. Remember to cite your sources.
Step 6: Develop a Cybersecurity Strategy that presents five or more specific actions (strategies) that the company should take to implement your recommended risk mitigations. Include information from your gap analysis, legal and regulatory analysis, risk analysis and proposed risk mitigations. Under each strategy include information about how the strategy will affect or leverage people, policies, processes, and technologies (hardware, software, infrastructure). Include examples and other pertinent information about Island Banking Services and Padgett-Beale. You should have at least one technology related strategy which includes an updated Network Diagram. This diagram must show the to-be state of the IT infrastructure including recommended mitigating or “control” technologies, e.g. intrusion detection, firewalls, DMZ’s, etc. (start with the diagram provided in this assignment file).
Note: Your strategy will be presented to the Board of Directors by the executive who is leading the Merger & Acquisition Team so make sure that you write in appropriate language and include sufficient detail to explain your recommended strategy.
Step 7: Develop and document a proposed plan of action and implementation timeline that addresses each element of the cybersecurity strategy that you identified previously (in step 6). Provide time, effort, and cost estimates for implementing your recommended actions (include appropriate explanations of your reasoning). Include the resources (people, money, etc.) necessary for completing each task in the timeline.
Step 8: Develop a set of 5 or more high-level summary of recommendations regarding the next steps to take in mitigating the risks that you identified in steps 1-7. These recommendations should logically flow from your analysis and be supported by your Cybersecurity Strategy and Plan of Action.
Putting It All Together
- Format your work for Steps 1-7 as a Cybersecurity Strategy and Plan of Action. The six major elements listed below should appear in this order in a single file. Your MS Word format document file must include:
- Introduction (what is in this document and to what organization does it apply)
- Gap Analysis (Step 1)
- Legal & Regulatory Requirements Analysis (Steps 3, 4)
- Risk Analysis & Risk Register (Steps 2, 3, 4, 5)
- Cybersecurity Strategy (Step 6)
- Plan of Action and Implementation Timeline (Step 7)
The Cybersecurity Strategy and Plan of Action is a comprehensive MS Word document that includes a separate title page followed by the six major elements (see list under step 7) and ending with a reference list. Your document must include a reference list and appropriate citations throughout. You will need 10 – 12 pages to fully document your strategy and plan. Use section headings and sub headings to organize your work. You may use internal title pages (section titles) to make it clear where each of the major elements begins and ends. Title pages and reference pages are not included in the recommended length.
- Format your recommendations from Step 8 as a Cover Letter / Recommendations Memo to accompany your Security Strategy document.
The Recommendation Memo is a 2 page, professionally formatted memorandum addressed to the Merger & Acquisition Team. This cover letter / memo should summarize why this package is being forwarded to the M&A team for “review and action.” The memo should introduce and provide a brief summary of the purpose and contents of the Cybersecurity Strategy and Plan of Action (name and describe each of the major sections). Use a professional format for your memo (consider using one of the MS Word templates). The memo does not include citations or references but, you may need to name laws or regulations.
Notes on Constructing Your Network Diagram (for step 6):
Your diagram must be based upon the provided network diagram with additions or deletions that are clearly your own work. You may use MS Word’s drawing tools, Power Point, or other drawing program. When you have completed your diagram, you may find it helpful to take a screen snapshot and then pasted that into your deliverable file(s).
You may use commercial or “free” clip-art to represent individual end point devices or network appliances such as routers, firewalls, IDPS, etc.) Clip art does not need to be cited provided that it is clip art (not screen captures from another author’s work).
Additional Information
- Consult the grading rubric for specific content and formatting requirements for this assignment.
- Your paper should be professional in appearance with consistent use of fonts, font sizes, margins, etc. You should use headings and page breaks to organize your paper.
- Your paper should use standard terms and definitions for cybersecurity.
- The CSIA program recommends that you follow standard APA formatting since this will give you a document that meets the “professional appearance” requirements. APA formatting guidelines and examples are found under Course Resources > APA Resources. An APA template file (MS Word format) has also been provided for your use CSIA_Basic_Paper_Template(APA_6ed,Nov2014).docx.
- All submission files must begin with a cover page with the assignment title, your name, and the due date. Your reference list must be on a separate page at the end of your file.
- You are expected to write grammatically correct English in every assignment that you submit for grading. Do not turn in any work without (a) using spell check, (b) using grammar check, (c) verifying that your punctuation is correct and (d) reviewing your work for correct word usage and correctly structured sentences and paragraphs.
- You are expected to credit your sources using in-text citations and reference list entries. Both your citations and your reference list entries must follow a consistent citation style (APA, MLA, etc.).
Discuss how the master’s prepared nurse (depending upon the chosen track) can promote improvement in clinical quality outcomes and patient safety by incorporating proactive interventions that identify potential hospital acquired conditions (HAC). Be specific in the answer.
Uncategorized250 WORDS 2 REFERENCES WITHIN 5 YEARS (NURSING JOURNALS ONLY!! IN TEXT CITATIONS ARE A MUST!!
Since October 1, 2008, hospitals no longer receive additional payment for cases in which certain select conditions (e.g., foreign object obtained after surgery, urinary tract infection (UTI) were not present on admission.
List three dimensions of organizational culture
Nursing HomeworksPersonality in
Each person’s personality is unique, although the dimensions along which we all vary have been identified. The Big Five personality traits are five broad dimensions of personality that are used to describe human personality. The Big Five has been preferably used rather than other models because it is able to account for different traits in personality without overlapping. In studies, the Big Five personality traits show consistency and have been found across a wide range of participants of different ages and of different cultures (Schacter, Gilbert, & Wegner, 2011). Personality influences/impacts many aspects of organizational behavior.
For this assignment, use the Internet to find a free online version of the Big Five personality test. Then, using the Argosy University online library resources, research your personality type and gain strong understanding of each of the five dimensions.
Respond to the following:
Write your initial response in approximately 400–500 words. Apply APA standards to the citation of sources. Use scholarly references to support your work.
Management homework help
Uncategorized1. You will identify competencies you have been able to demonstrate during your internship and outline those that have improved throughout the semester while reflecting on what may have caused the improvement. You will also write about how you may or may not have been able to improve other competencies and discuss what the contributing factors were. Your reflective paper will also address the IDP as follows: The reflective paper should be a minimum of 4 -5 pages.
Plant Transpiration
Nursing HomeworksUnit VIII Homework
Plant Transpiration
Introduction
If you have not already, you or someone you know will try to grow a variety of plants either inside your house or outside in a garden. What type of soil do you need? How often should you water the plants? Should you plant them in full sun? Why do some plants need less water and some more? These are questions that many people have about plants. In this activity, you will have a chance to manipulate different variables to see how much water some plants use and how much some lose through transpiration.
Objectives
1. Conduct virtual experiments to determine factors that affect transpiration.
2. Compare and contrast sustainable and unsustainable farming practices.
Materials
Computer with internet access
Directions
1. Go to: http://glencoe.mcgraw-hill.com/sites/dl/free/0078695104/383946/BL_10.html
2. Read the PURPOSE and OBJECTIVES.
3. Read and follow the information under PROCEDURES, and complete the lab for all 4 plants and all 3 variables.
4. Reset the lab and complete the lab for the next set of 4 plants and 3 variables.
5. Record your information in the Results Table provided on this sheet.
6. During and after the lab, answer the questions below.
7. Type all answers directly on the data sheet.
8. Select Save As, and use your last name and student ID as a file name.
9. Upload the data sheet as a .doc, .docx, or .rtf file when finished.
Questions 1 – 10 are short answer questions and should be answered in two to three words or one to two complete sentences. Total: 40 points
1. Explain how the heater, the fan and the lamp are being used to test environmental factors as they relate to plant transpiration. (4 points)
SHAPE \* MERGEFORMAT
2. State a scientific question you have based on what you know of the experiment. (4 points)
SHAPE \* MERGEFORMAT
3. State your hypothesis. (4 points)
SHAPE \* MERGEFORMAT
4. In your own words, explain the process of transpiration. (4 points)
SHAPE \* MERGEFORMAT
5. Which environmental factors that you tested increased the rate of transpiration? Did the rate of transpiration increase for all plants tested? Explain. (4 points) SHAPE \* MERGEFORMAT
1. Of the environmental factors tested, did any affect the transpiration rate more than the others? Explain. (4 points) SHAPE \* MERGEFORMAT
2. Which species of plants that you tested had the highest transpiration rates? Why do you think different species of plants transpire at different rates? (4 points) SHAPE \* MERGEFORMAT
3. What is your conclusion? (4 points)
SHAPE \* MERGEFORMAT
1. Did your results support your hypothesis? If so, how? If not, why not? (4 points)
SHAPE \* MERGEFORMAT
2. State another question about transpiration that you would like to have answered that you did not answer in this lab activity. (4 points)
SHAPE \* MERGEFORMAT
Results Table: You should include data for eight different plants. Make sure you reset the lab (upper right corner) to receive four more plants. Total: 20 points
Amount of water transpired after 1 hour (mL)
Question 11 is a short essay. Your response should be at least 200 words in length. Total: 40 points
3. You want to reduce the amount of money that you are spending at the grocery store. You and your family decide to plant a small garden to provide a variety of foods. Since you completed the activity above, you know that plants require certain nutrients in order to survive.
Read the information in the textbook concerning the future of agriculture (pages 586 – 592). What are some methods that you would implement into your garden? What would you try to avoid? In addition to your textbook, locate at least one article in the CSU Online Library that provides further information on your chosen methods. Make sure you provide a detailed response.
Define transcultural nursing and how that can be applied in your daily nursing practice.
Uncategorized1 Define transcultural nursing and how that can be applied in your daily nursing practice.
2. Define anthropology and culture and how it is related to the practice of nursing care.
3. Describe the contributions of Dr. Madeline Leninger in the development of cultural nursing.
4. Mention and discuss some assumptions about transcultural nursing.
As stated in the syllabus present your assignment in an APA format word document Arial 12 font attached to the forum in the discussion board titled “Week 1 discussion questions”. A minimum of 2 evidence-based references (except the textbook) is required. You must post two replies to any of your peers sustained with the proper references. A minimum of 1100 words is required.
prove in turnitin
Human Resources and Staffing Crisis at Blumberg’s Nursing Home
UncategorizedAssignment 2: Human Resources and Staffing Crisis at Blumberg’s Nursing Home
Due Week 10 and worth 250 points
Blumberg’s Nursing Home (BNH) is a 100-bed Medicare and Medicaid certified facility in suburban Philadelphia, PA. The administrator recently terminated the facility’s Director of Nursing (DON), receptionist, and dietary aid for inappropriate conduct. They had all been involved in purchasing and using illegal substances on facility grounds. Facility staff, as well as many of the more lucid residents, have found out about the incident.
The charge nurse has been appointed interim DON. The human resource manager has sent a memo to all staff informing them of a mandatory staff meeting to discuss BNH’s code of ethics and to provide additional training on workplace culture. Because federal law requires that there be at least one (1) registered nurse on duty for a minimum of eight (8) hours a day, seven (7) days a week, and that the DON must be a registered nurse (RN) – which the interim DON is not – BNH is out of compliance.
Write a four to six (4-6) page paper in which you:
Assess the immediate staffing needs at BNH. Prioritize the order in which BNH should fill the main unstaffed position(s). Justify your selection(s). Considering the reason behind the termination of the employees, formulate a human resources policy that addresses inappropriate conduct in the workplace, the process of reporting inappropriate conduct, and the consequences of violating the policy. Explain your rationale. Per the text, an effective long-term care facility administrator must have both leadership and management skills. Propose at least one (1) way the administrator in this case must demonstrate quality leadership skills, and one (1) way the administrator must demonstrate quality management skills in the aftermath of this crisis so as to improve and maintain staff and resident morale. Recommend a strategy for BNH to use the Quality Indicator Survey to improve administrative practices and ensure future compliance at the facility. Justify your recommendation. Use at least three (3) quality academic resources. Note: Wikipedia and other similar websites do not qualify as academic resources.
Your assignment must follow these formatting requirements:
Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions. Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date. The cover page and the reference page are not included in the required assignment page length.
The specific course learning outcomes associated with this assignment are:
Differentiate the administrative functions of long-term care practices from those of other healthcare administrative services. Identify the factors that have led to the current realities of long-term care in the United States. Assess the various stakeholder groups of long-term care along with the nature of the relationship(s). Recommend how a company can use the Quality Indicator Survey to improve administrative practices. Use technology and information resources to research issues in long-term care management. Write clearly and concisely about long-term care management using proper writing mechanics.
ATTENTION-DEFICIT/HYPERACTIVITY DISORDER AND A LOCAL ORGANIZATION THAT PROVIDES MENTAL HEALTH SERVICES.
UncategorizedSelect a psychological disorder: Attention-Deficit/Hyperactivity Disorder and a local organization that provides mental health services. Research the organization’s website or speak to someone in the organization. Write a 700- to 1,050-word paper in which you examine your selected psychological disorder in the context of the chosen organization’s goals. Include the following in your paper: Identify multiple cultures the organization serves. Identify symptoms of your selected disorder and describe how the interpretation of the symptoms varies across cultures. Discuss how the impact of culture affects interpretations of symptoms and recommendations of services for that organization. Include a minimum of three credible, peer-reviewed references. Format your paper consistent with APA guidelines.
Q2
Importance of Health Care Research Write a 700- to 1,050-word paper on the importance of health care research in current times. Include your views on health care research and why you feel it is important as it relates to one of the concepts outlined below: -The impact of health care research on evidence-based practice -Key components of research studies affecting rigor, validity, and ethical considerations -How leaders can integrate research into a practice or health care network setting -Share your opinions on proper research and its influence on business success. Include references in your paper. No plagiarism and in APA format.
>Biology homework help
UncategorizedReview Sheets
Based on your knowledge from the lab manual readings from this week, create a 2- to 3-page document in Microsoft Word for providing answers to questions in the following review sheets:
Submission Details:
Global Healthcare Comparison Matrix And Narrative Statement
UncategorizedIf you talk about a possible poor health outcome, do you believe that outcome will occur? Do you believe eye contact and personal contact should be avoided?
You would have a difficult time practicing as a nurse if you believed these to be true. But they are very real beliefs in some cultures.
Differences in cultural beliefs, subcultures, religion, ethnic customs, dietary customs, language, and a host of other factors contribute to the complex environment that surrounds global healthcare issues. Failure to understand and account for these differences can create a gulf between practitioners and the public they serve.
In this Assignment, you will examine a global health issue and consider the approach to this issue by the United States and by one other country.
To Prepare:
The Assignment: (1- to 2-page Global Health Comparison Matrix; 1-page Plan for Social Change)
Part 1: Global Health Comparison Matrix
Focusing on the country you selected and the U.S., complete the Global Health Comparison Matrix. Be sure to address the following:
Part 2: A Plan for Social Change
Reflect on the global health policy comparison and analysis you conducted in Part 1 of the Assignment and the impact that global health issues may have on the world, the U.S., your community, as well as your practice as a nurse leader.
In a 1-page response, create a plan for social change that incorporates a global perspective or lens into your local practice and role as a nurse leader.
&&&&&&&&&&&&&&&&> APA Resources. An APA template file (MS Word format) has also been provided for your use CSIA_Basic_Paper_Template(APA_6ed,Nov2014).docx. 5. All submission files must begin with a cover page with the assignment title, your name, and the due date. Your reference list must be on a separate page at the end of your file. 6. You are expected to write grammatically correct English in every assignment that you submit for grading. Do not turn in any work without (a) using spell check, (b) using grammar check, (c) verifying that your punctuation is correct and (d) reviewing your work for correct word usage and correctly structured sentences and paragraphs. 7. You are expected to credit your sources using in-text citations and reference list entries. Both your citations and your reference list entries must follow a consistent citation style (APA, MLA, etc.).
UncategorizedProject #1: Cybersecurity Strategy & Plan of Action
Your Task:
You have been assigned to support the Padgett-Beale Merger & Acquisition (M&A) team working under the direct supervision of Padgett-Beale’s Chief Information Security Officer (CISO). The M&A team is in the planning stages for how it will integrate a new acquisition, Island Banking Services, into the company as its financial services arm (PBI-FS). Initially, PBI-FS will function as a wholly owned subsidiary which means that it must have its own separate cybersecurity program.
Your first major task (Project #1) will be to help develop a Cybersecurity Strategy & Plan of Action for PBI-FS. Island Banking Services never had a formal cybersecurity program so you’re starting from scratch. You will need to research best practices as well as relying heavily upon what you learned in your undergraduate studies in Cybersecurity Management and Policy. The CISO has provided detailed instructions for this task. (These appear after the Background section below.)
Background
After five years of operation, Island Banking Services — a non-U.S. firm — was forced into bankruptcy after criminal money laundering charges were filed against the company and its officers. Padgett-Beale, Inc. purchased the digital assets and records of this financial services firm from the bankruptcy courts. The purchased assets include licenses for office productivity software, financial transactions processing software, database software, and operating systems for workstations and servers. Additional assets included in the sale include the hardware, software, and licensing required to operate the company’s internal computer networks.
Figure 1. Island Banking Services IT Infrastructure Purchased by Padgett-Beale, Inc.
Padgett-Beale’s legal counsel successfully negotiated with the bankruptcy court and the criminal courts for the return of copies of the company’s records so that it could restart Island Banking Service’s operations. The courts agreed to do so after Padgett-Beale committed in writing to reopening the customer service call center (but not the branch offices) on the island. Reopening the call center will provide continued employment for 10 island residents including 2 call center supervisors. Padgett-Beale intends to relocate the call center to a company owned property approximately 10 miles away from the current location and adjacent to a newly opened Padgett-Beale resort.
Padgett-Beale’s Risk Manager has recommended that the Merger & Acquisition plan be amended such that Island Banking Services would be operated as a wholly owned subsidiary for a period of 5 years rather than being immediately and fully integrated as an operating element of Padgett-Beale. The company’s attorneys agreed that this would be the best approach given the potential for additional legal troubles related to the actions of the previous owners and employees. The Board of Directors has signed off on this amendment to the M&A plan and stipulated that the new subsidiary will be named PBI Financial Services (PBI-FS). The company officers and senior managers for PBI-FS will be named at a later date. For now, the leader of the M&A Team will serve as the Chief Operating Officer. Padgett-Beale’s Chief Information Security Officer will be loaned to PBI-FS while a search is conducted for a dedicated CISO for the subsidiary.
CISO’s Detailed Instructions to You
The CISO has given you and your team mates a set of instructions (below) which you should follow as you complete this task.
Task #0: Read and Analyze the Background Materials
If you have not already done so, read the Background information in this file. Next, review the Padgett-Beale M&A Profile 2020 which was posted to the LEO classroom. You should also review all materials from the classroom for Weeks 1 – 4 as these provide needed information about the Financial Services industry and the legal and regulatory requirements which apply to this industry.
Task #1: Perform a Gap Analysis & Construct a Risk Register
Using the information available to you, determine the most likely information technology/security gaps which existed at Island Banking Services prior to its being acquired by PBI. Next, determine which of these, if not addressed, will likely exist in the newly formed subsidiary PBI-FS. Document your analysis and evaluation in a Gap Analysis.
Your Gap Analysis should address operating issues relating to confidentiality, integrity, and availability (CIA) of information, information systems, and information infrastructures owned or used by PBI-FS. Your analysis should also consider and use the People, Process, and Technology framework.
Step 1: Identify 10 or more significant cybersecurity issues/challenges/risks which the background information and M&A profile indicate currently exist at PBI-FS / Island Banking Services. You are allowed to “read between the lines” but must be able to map your analysis and findings to specific statements from these documents. These items will become your “Gaps” for the Gap Analysis. Use one or more cybersecurity frameworks or standards (e.g. NIST CSF; People, Processes, and Technologies; Confidentiality, integrity, availability) to organize your analysis.
Note: there was significant criminal behavior found at Island Banking Services. Your analysis must address internal weaknesses which allowed this to occur without being discovered by the employees who were not involved in the crimes.
Step 2: Using your Gap Analysis (step 1) create a Risk Register in which you list 10 or more specific and separate risks. For each risk, assign a category (confidentiality, integrity, availability, people, process, technology) and a severity (impact level using a 1 – 5 scale with 5 being the highest potential impact).
Step 3: Review the laws and regulatory guidance which apply to the Financial Services industry and companies like Island Banking Services. For each entry in your risk register, identify and record the laws, regulations, or standards which provide guidance as to how the identified risks must be addressed or mitigated. Record this in your risk register.
Step 4: Review laws and regulations which apply to all companies, i.e. Sarbanes Oxley, IRS regulations for Business Records, SEC regulations and reporting requirements, etc. Review your Risk Register and either map these requirements to existing entries in your risk register or insert new entries for significant legal or regulatory requirements which you were not able to map to your previously identified risks. (Include risk related to non-compliance.)
Step 5: Review section 1.2 Risk Management and the Cybersecurity Framework in the NIST Cybersecurity Framework v1.1 (https://nvlpubs.nist.gov/nistpubs/CSWP/NIST. CSWP. 04162018.pdf)
Using this information, determine the best strategy for addressing (“treating”) each of your identified risks. Remember the four types of risk mitigation strategies (accept, avoid, control, transfer).
Consider the business impact for each of your mitigation strategies (e.g. if you applied an “avoid” strategy across the board, the company would not be able to operate in the financial services industry because it would need to shut down all operations).
Record your risk mitigation strategy for each risk in your risk register. For each of your “control” entries, include the corresponding control category and subcategory (if applicable) from the NIST Cybersecurity Framework (see Tables 1 and 2 in version 1.1). Examples: ID.AM Asset Management or PR.AC Identity Management and Access Control. Remember to cite your sources.
Step 6: Develop a Cybersecurity Strategy that presents five or more specific actions (strategies) that the company should take to implement your recommended risk mitigations. Include information from your gap analysis, legal and regulatory analysis, risk analysis and proposed risk mitigations. Under each strategy include information about how the strategy will affect or leverage people, policies, processes, and technologies (hardware, software, infrastructure). Include examples and other pertinent information about Island Banking Services and Padgett-Beale. You should have at least one technology related strategy which includes an updated Network Diagram. This diagram must show the to-be state of the IT infrastructure including recommended mitigating or “control” technologies, e.g. intrusion detection, firewalls, DMZ’s, etc. (start with the diagram provided in this assignment file).
Note: Your strategy will be presented to the Board of Directors by the executive who is leading the Merger & Acquisition Team so make sure that you write in appropriate language and include sufficient detail to explain your recommended strategy.
Step 7: Develop and document a proposed plan of action and implementation timeline that addresses each element of the cybersecurity strategy that you identified previously (in step 6). Provide time, effort, and cost estimates for implementing your recommended actions (include appropriate explanations of your reasoning). Include the resources (people, money, etc.) necessary for completing each task in the timeline.
Step 8: Develop a set of 5 or more high-level summary of recommendations regarding the next steps to take in mitigating the risks that you identified in steps 1-7. These recommendations should logically flow from your analysis and be supported by your Cybersecurity Strategy and Plan of Action.
Putting It All Together
The Cybersecurity Strategy and Plan of Action is a comprehensive MS Word document that includes a separate title page followed by the six major elements (see list under step 7) and ending with a reference list. Your document must include a reference list and appropriate citations throughout. You will need 10 – 12 pages to fully document your strategy and plan. Use section headings and sub headings to organize your work. You may use internal title pages (section titles) to make it clear where each of the major elements begins and ends. Title pages and reference pages are not included in the recommended length.
The Recommendation Memo is a 2 page, professionally formatted memorandum addressed to the Merger & Acquisition Team. This cover letter / memo should summarize why this package is being forwarded to the M&A team for “review and action.” The memo should introduce and provide a brief summary of the purpose and contents of the Cybersecurity Strategy and Plan of Action (name and describe each of the major sections). Use a professional format for your memo (consider using one of the MS Word templates). The memo does not include citations or references but, you may need to name laws or regulations.
Notes on Constructing Your Network Diagram (for step 6):
Your diagram must be based upon the provided network diagram with additions or deletions that are clearly your own work. You may use MS Word’s drawing tools, Power Point, or other drawing program. When you have completed your diagram, you may find it helpful to take a screen snapshot and then pasted that into your deliverable file(s).
You may use commercial or “free” clip-art to represent individual end point devices or network appliances such as routers, firewalls, IDPS, etc.) Clip art does not need to be cited provided that it is clip art (not screen captures from another author’s work).
Additional Information