This May CSP discuss new cyber security standards that have changed and been updated that businesses should be aware of, and we explain the importance of staff motivation with our newsletter advice this month.
Kev's Corner
Security is a moving target
Over the last 6 months, three standards related to Cyber Security have changed. In January of this year the NCSC Cyber Essentials standard had its biggest update since its inception. In February an update to ISO27001/2, the core international standard for information security was updated and more recently PCI/DSS was, finally, updated to V4.0 (Payment Card Industry Data Security Standard).
A number of industry spokespeople have said the updates are long overdue, while others have said the standards are irrelevant. Do we all need to jump on the new standards bandwagon and throw away all the controls we currently have and start again?
Well no. Standards don’t work like that; each gives organisations the time to adapt and update to meet the new requirement. Some, like Cyber Essentials are fully enforcing the new controls, so that all new submissions must meet the new standard. But some have also included some “optional” controls, which will be enforced next year. PCI DSS V4.0 has an 18-month transition period. Current ISO 27000 certification are still valid until a re-certification audit, which could be up to 3 years depending on when your company was certified.
So why the flurry of changes?
We all know technology doesn’t stand still. The key change in infrastructure has been the increasing use of cloud-based services, so standards based around organisations own data centres increasingly don’t fit. Or, at least controls are difficult to implement or measure when your systems are based at someone else’s location and even on your cloud provider’s physical hardware.
The introduction of hybrid working is also a factor. How do you ensure the physical controls are in place at all your users’ homes? Yes, cloud migration was well underway before lockdown, but the pandemic has accelerated the move to cloud. The sudden increase in the requirement for remote access led to a number of challenges for large organisations at the beginning of lockdown, so moving to the cloud made even more sense.
It is interesting to note that NCSC, when updating Cyber Essentials, worked with the Cloud Security Alliance (CSA) to ensure that controls where relevant and achievable in cloud environments. ISO also worked with cloud suppliers and the CSA to make the controls relevant to cloud-based services. It has also not been lost on a number of industry experts that the new control sets within ISO27002 now fall into domains, which bear a striking resemblance to NIST’s Cyber Security Framework (CSF). PCIDSS now has a requirement for multi-factor authentication (MFA) for all user access, something that Cyber Essentials requires from next year, to cloud services.
So, have the standards bodies realised that most organisation’s data is now in the cloud? Well, yes. Have they all got it right first time? Not quite. But that is another story.
CSP will be providing further blogs covering the changes in each individual standard, the benefits and issues over the next few weeks as we work with companies to implement the new standards.
Lynne's Latest
Staff Motivation – How do you keep your staff motivated?
Over the last few years, we have tried to keep our staff and colleagues motivated in their roles. We have realised that what might motivate one staff member, might not have the same effect on another. Everyone is different, we all have different personalities. I have thought about what we as a business have done and have looked for some tips and guidance that you could use as a starting point when thinking about staff motivation.
Setting Goals and Rewarding Staff
When setting goals or presenting staff with a project ensure that it is achievable. Ensure staff have a clear understanding of what is required and that they have the tools and support in place to achieve their goal. Communicate with staff and make yourself available for them to give you updates and for you to give feedback. Give rewards and kudos to your staff and colleagues, for example ‘like’ and share articles and content they have contributed to your social media pages, such as LinkedIn. During lockdown whilst working remotely we held weekly quizzes and staff were rewarded if they won. This may seem like a small thing but it boosted staff morale and kept us communicating when we were unable to do it in person.
Celebrate Achievements
Another thing we do is celebrate team achievements when we have monthly team meetings. Whilst we are all a team, often not everyone will be working on the same project, so it is good to feedback to the whole team what we have achieved over the last month. Don’t just celebrate and share work achievements, share personal achievements with each other, such as charity work.
Stay Organised
Help your team stay organised, have regular catch-up sessions in your diary when you are collaborating with a colleague on a piece of work. We are always looking at new tools and new processes that will help staff to stay connected and be able to share their work with others easily. We use project management tools and resource forecasting tools to help us with planning. This keeps us working as a team as we are able to reach out to others for assistance on ongoing projects as required. Having the ability to easily share documents for review with colleagues is the key to businesses running smoothly.
Positivity
Try to stay focused on the positives, reach out to colleagues and give them praise or offer assistance. Encourage staff to take regular breaks and to switch off from work. Encourage self-development by giving staff a training budget and time out of the working day to study online or read articles that will assist them in their role.
Most of all, listen to your staff or team and take on board new suggestions for change!