Lessons 1: Introduction

Lessons 2: Understanding Cybersecurity Policy and Governance

• Information Security vs. Cybersecurity Policies
• Looking at Policy Through the Ages
• Cybersecurity Policy
• Cybersecurity Policy Life Cycle

Lessons 3: Cybersecurity Policy Organization, Format and Styles

• Policy Hierarchy
• Writing Style and Technique
• Policy Format

Lessons 4: Cybersecurity Framework

• Confidentiality, Integrity and Availability
• NIST's Cybersecurity Framework

Lessons 5: Governance and Risk Management

• Understanding Cybersecurity Policies
• Cybersecurity Risk

Lessons 6: Asset Management and Data Loss Prevention

• Information Assets and Systems
• Information Classification
• Labelling and Handling Standards
• Information Systems Inventory
• Understanding Data Loss Prevention Technologies

Lessons 7: Human Resources Security

• The Employee Life Cycle
• The Importance of Employee Agreements
• The Importance of Security Education and Training

Lessons 8: Physical and Environmental Security

• Understanding the Secure Facility Layered Defense Model
• Protecting Equipment

Lessons 9: Communications and Operations Security

• Standard Operating Procedures
• Operational Change Control
• Malware Protection
• Data Replication
• Secure Messaging
• Activity Monitoring and Log Analysis
• Service Provider Oversight
• Threat Intelligence and Information Sharing

Lessons 10: Access Control Management

• Access Control Fundamentals
• Infrastructure Access Controls
• User Access Controls

Lessons 11: Information Systems Acquisition, Development and Maintenance

• System Security Requirements
• Secure Code
• Cryptography

Lessons 12: Cybersecurity Incident Response

• Incident Response
• What Happened? Investigation and Evidence Handling
• Data Breach Notification Requirements

Lessons 13: Business Continuity Management

• Emergency Preparedness
• Business Continuity Risk Management
• The Business Continuity Plan
• Plan Testing and Maintenance

Lessons 14: Regulatory Compliance for Financial Institutions

• The Gramm-Leach-Bliley Act
• New York's Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500)
• What Is a Regulatory Examination?
• Personal and Corporate Identity Theft

Lessons 15: Regulatory Compliance for the Health-Care Sector

• The HIPAA Security Rule
• The HITECH Act and the Omnibus Rule
• Understanding the HIPAA Compliance Enforcement Process

Lessons 16: PCI Compliance for Merchants

• Protecting Cardholder Data
• PCI Compliance

Lessons 17: NIST Cybersecurity Framework

• Introducing the NIST Cybersecurity Framework Components
• The Framework Core
• Framework Implementation Tiers ("Tiers")
• NIST's Recommended Steps to Establish or Improve a Cybersecurity Program
• NIST's Cybersecurity Framework Reference Tool
• Adopting the NIST Cybersecurity Framework in Real Life

Appendix A: Cybersecurity Program Resources