Grip on Information Security: ownership, cooperation and progress in peace
A good approach to information security begins with ownership and grows by cooperation. This article shows in simple language how you conduct, involve people and step by step improves . With this approach, as a board member or IT manager, you increase your grip on information security, with clear choices in it risk management.
1. Ownership: who's the move?
the board and executive management shall determine the rate: What do we have to protect, how much risk do we find acceptable, and who makes what decisions? Record this briefly (who decides, who executes, who guards). Clarity gives rest and control over information security.
2. Collaboration: Everybody has a role
Information security only works optimally when departments are building up together. IT, operation, HR, procurement and communication each see a different piece of reality. Point a contact point per team and make reporting incidents at a low threshold. This makes digital safe working a common routine.
3. Run and reset plans
- Plans: Choose some clear targets based on the highest risk performance.
- Do: Take small, feasible steps. Every month a little works really better than once a year everything.
- Check: look at what works and what does not; adjust where necessary.
- Update: briefly capture choices and learning points. This way you build a reliable documentation, which will benefit during an audit.
4. The building blocks in plain language
- Baseline assessment: knowing where you are preventing discussions and helping prioritize.
- Clear policy: short and applicable; What do we do, what do we not do, and who decides?
- Training & Awareness: repeat works. Small, relevant and at the right time.
- Incidental approach: Who calls who, in how long, and how do we recover? Practice this.
- Suppliers: establish basic agreements (security, incident reporting) and periodically request evidence.
- Documentation: preserve decisions, test results and improvement points. Short is enough carburetor if it's findable.
5. NIS2 and ISO 27001 in brief
NIS2 (in NL the Dutch Cybersecurity Act) requires intense care and visibility of risks also in the chain. ISO 27001 provides a workable framework to regulate this structuredly. In practice: use ISO 27001 for routine and lay NIS2 requirements next to it. This way you avoid duplication of work and strengthen it risk management.
6. Each organisation is different
The implementation depends on your branch (e.g. care or industry), you position in the chain (supplier or buyer) and you environment (IT only or also OT/workfloor). Adjust measures to your reality; One standard list rarely fits exactly. This is the basis for smart cyber risk management.
7. Measuring what's important
- Patching: how quickly do we get rid of important updates?
- Detection & Recovery: How soon do we notice something and be in the air again?
- Awareness: Do people participate in training and report abnormalities?
- Backups: When was the last time that was really put back and did it happen within the time you wanted?
- Suppliers: Do they deliver the agreed statements or reports in time?
8. Where external assistance is useful
Additional hands or specific knowledge are useful in peak pressure, post-incident investigations, or policy and reporting setting up. Temporary support can give speed without fixed loads.
9. Common pitfalls
- Too much at once: better start small and hang on.
- Unclear responsibility: Name who decides and who executes.
- Do not practice: A plan that has never been tested rarely works under pressure.
- Forgot your chain: suppliers and links are included.
- No proof. Without notes and logs, improvement is difficult to show.
11. Short checklist
- Property and roles captured.
- Current risk assessments and clear priorities.
- Basic on order: updates, backups, access.
- Incidents can report and practice.
- Suppliers' arrangements are arranged and followed.
- Training repeatable and relevant.
- Monthly progress and brief minutes as evidence.
Keep the direction documented and simple, work together across departments, and improve in small steps. This gives you permanent control over information security.
