As with all project of this nature, CSP carried out a gap analysis of the company’s existing security controls and management system. CSP began the project by carrying out a gap analysis against the 27002 controls and holding interviews with senior stakeholders across the organisation. It became apparent that, like a large number of companies, they were doing a lot of things in a secure manner, but it was not documented and measured in any meaningful way. This dependency on ensuring the company was secure was heavily weighted towards the IT department, which at the time consisted of just three people.

It was also apparent that the company, like many manufacturing organisations, relied heavily on legacy shop floor machinery which whilst fully functional, was controlled by out of support software systems. CSP therefore put together a two-prong approach, one to deal with implementing technical controls to reduce the risk from the use of these legacy systems and one to deal with implementing a security management system to ensure ongoing control and measurement of the overall cyber security of the business.

So, what was the solution?

While the simple solution may have been to get them to replace or update the control systems on the shop floor, like many manufacturing companies find, this is just not financially viable. So, a security wrapper, including a plan to segregate the shop floor network, implementing security controls to an access point on the network effectively isolating and protecting the vulnerable computers from the Internet. Furthermore, other controls were designed and implemented in liaison with both internal and external IT expertise, to greatly reduce the potential attack surface of the organisation.

CSP and the client took a stepped approach to implementing a security management system, firstly forming a security working group with stakeholders across the business from finance, HR, design office, and shop floor operations. This group with CSP’s assistance began creating documentation to cover the security elements of their specific functions, and defining the measurements that worked for them to allow reporting to senior management the state of cyber security within the organisation.

As a measurement step prior to going for ISO27001 accreditation, we arranged and assisted the client through the UK governments Cyber Essentials certification. This provided a useful independent measure of the implementation so far, as the CE standard is not as definitive as the international standard. The client was successfully accredited at the first attempt and has since maintained it on an annual basis.

Multiple CSP staff provided different skill sets to assist the client in building the security management system. Our data protection specialist worked with their inhouse DPO to help ensure compliance while enabling the data protection procedures, to integrate with the security management and incident management processes. We provided a business continuity and disaster recovery workshop with stakeholders across the business, followed by a desktop simulation exercise, to help them better define their business continuity plan. and understand the threats

After over 18 months’ worth of work, two of our CSP lead auditors carried out mock audits to prepare the organisation for accreditation and then supported them through the accreditation process.