Featured Image

Building an Advanced Cybersecurity Plan: Engagement and Reinforcement

Cybersecurity protects your – and your clients' – assets. This series dives into how you can integrate a successful cybersecurity plan. From company culture to training and maintaining your personnel, creating a safe business environment starts here.
May 02, 2022

There are multiple strategic and competitive reasons to implement an advanced cybersecurity plan.

From a defensive perspective, a cybersecurity implementation is designed to protect company assets from threats that can disrupt operations. It is also intended to protect against intruders who may try to access company information and data. While developing and maintaining an advanced cybersecurity implementation is burdensome, it also is a strategic initiative to protect a company’s bottom line.

From an offensive perspective, customers want to do business with companies that they can depend on – a secure supply chain. An advanced cybersecurity plan can reassure existing customers that that their supply chain partners will be there when they need them, reliable and consistent. This can also position a company to secure new business, as it demonstrates their commitment to being a consistent and reliable partner and provides a differentiation that will take others time and effort to match.

Industry recognizes a couple of different cybersecurity models that are being deployed by U.S. companies. The National Institute of Standards and Technology (NIST) standard SP 800-171 has been adopted by the Department of Defense (DOD) for their Cybersecurity Maturity Model Certification (CMMC) program. Other government agencies and companies in the DOD supply chain are adopting, or considering adopting, this standard. Since this standard is going to have a significant impact on the manufacturing industry, we will use it as a guideline for this “Building an Advanced Cybersecurity Plan” series of articles.

A company’s cybersecurity plan should be integrated into the very fabric of the company’s culture, which ensures the company operates in a secure manner. This means that everyone in the company, and everyone who interacts with the company, has a responsibility to protect company assets and proactively avoid the introduction of cybersecurity threats into the company’s systems and network.

Not every individual has the same interaction with business systems nor has the same responsibilities relative to cybersecurity issues. Early in the process of developing a cybersecurity plan, a company should define a set of specific roles that categorize everyone in the business based on how they interact with business systems. As various aspects of your cybersecurity plan are developed, consideration should be given to how each part of the plan interacts with each of these roles. This provides a foundation upon which a company can clearly communicate to every individual their personal responsibilities relative to protecting company assets.

Typically, a cybersecurity plan is not fully evolved before it is launched. Additionally, a cybersecurity plan is never complete – it should be continually updated to address changes in security threats. Communications and training are key to drive personnel engagement with the security plan. Periodic training is required to reinforce the importance of each person’s contribution to the security of business assets. This also provides the opportunity to communicate changes and updates to the security plan relative to each role.

Training content should be customized to the scope of information applicable to each role; not everyone should be burdened with trying to understand all aspects of the cybersecurity plan. However, the content of the training should include information about the security responsibilities of others with whom an individual may interact. For example, a manager’s training should be extended to include content applicable to those who report to the manager. Training for purchasing personnel should be extended to include content applicable to the exchange of information with vendors. Likewise, training for maintenance personnel should include content applicable to outside service providers.

Once you have defined a communications and training plan optimized by role, you have the foundation to advance your company’s cybersecurity culture and engage everyone associated with your security strategy. Periodic training furthers engagement with your strategy and reinforces each person’s responsibilities for protecting the company’s assets.

As you continue to build out the balance of your cybersecurity program, you can then utilize this structure to communicate changes/enhancements to your program and how those changes impact the responsibilities of each person associated with your business.

For more details of specific actions to take when building the training and engagement portions of your cybersecurity plan, see section 3.2, “Awareness and Training,” of NIST standard SP 800-171.

For more on this topic, we invite you to explore the Building an Advanced Cybersecurity Plan article series.

Part 1: Engagement and Reinforcement

Part 2: Interaction Mapping

Part 3: Access Control

Part 4: Electronic Media Protection

Part 5: Identification and Authentication

Part 6: Activity Logging, Auditing, and Traceability

Part 7: Network Resource Configuration Management

Part 8: Communications, Network, and Database Security 

John Turner
Director of Technology for FA Consulting & Technology (FAC&T) and member of the MTConnect Institute.
Recent technology News
Implementing a cybersecurity plan includes deploying specific security functions to provide communications, networking, and database security. Learn what key factors to consider, what new technologies are being overlooked, and more for your implementation.
Configuration management in cybersecurity provides a uniform environment to deploy security updates, and a standardized platform to monitor network activity to identify potential security breaches. Learn what it is, how to use it, and what to watch for.
Advanced cybersecurity plans should include functionality for logging every attempt to access the network or critical areas on the network to protect business assets or as required for legal or contractual requirements. Read on to learn what that involves.
The definition and management of the credentials used to access the resources within a company's network requires their own set of rules within an access control strategy. Here are some important security elements to consider with usernames and passwords.
Any advanced cybersecurity plan should address electronic media in both the IT and the OT networks. Devices like CDs, flash drives, and more are problematic since each is an interface to your company’s network, introducing possible security threats.
Similar News
By Stephen LaMarca | Dec 02, 2022

A valet that won’t burn out your clutch. Y’all need facility tours. Paper batteries. Prototyping to mass production. Cybersecurity and the FBI.

5 min
By AMT | Nov 22, 2022

Check in for the highlights, headlines, and hijinks that matter to manufacturing. These lean news items keep you updated on the latest developments.

3 min
By Benjamin Moses | Nov 12, 2022

Steve is going to a manufacturing industry adjacent tradeshow that he and Ben have been trying to get into for a long time; Ben will for sure go next year (2024), though. Stephen also talks about how it felt to cut the first part off the new testbed CNC...

46 min