Blockchain Security Consulting

Information Security Management System (ISMS) Strategy/Framework Selection – Determining the optimal approach to ISMS development in light of industry, regulatory compliance, and attestation requirements. For example, should a Blockchain service provider to Financial Service companies leverage NIST, SOC 2, ISO 27001 or some combination of those three standards? We will analyze where you are, where you want to be and decide on the standards we should align with.

ISMS Scope Determination & Optimization – Scope determination is critical to proving any environment is secure. The scope needs to be broad enough to ensure that it will satisfy key stakeholders (e.g., clients, shareholders) but narrow enough to ensure the initial effort remains manageable.

Risk Assessment – Risk Assessment/Management is fundamental to an ISMS. While we are advocates of ISO-27005, we also use other standards including OCTAVE, OCTAVE-S, NIST SP 800-30 and NZ-AST 4360 to run contextualized risk assessments.

Risk Treatment Plan Development – The risk treatment plan defines the controls required, including the necessary extent and rigor, to treat (mitigate) risk to a level that is deemed acceptable. It is a fundamental ISMS artifact in many standards and forms the basis for the gap assessment.

ISMS Gap Assessment – Understanding the gap between the current and desired state of the Information Security Management System (e.g., ISO 27001) is a key input into a “Prioritized Roadmap” (Gap Remediation Plan).

Security Controls Gap Assessment – Understanding the gap between the current and desired state of the control practices is a key input into a “Prioritized Roadmap” (Gap Remediation Plan). ISO-27002 Gap Assessments (and derivatives like Shared Assessments and HITRUST) are widely used outside of ISO 27001 certification efforts as a “best security practices” gap assessment and can also be used to serve as a form of design/operational attestation.

Prioritized Roadmap Definition – Roadmaps define the activities, approach and responsibilities necessary to address identified gaps in the time-frame required to achieve project objectives, including any certifications/attestations you may want to achieve.

Gap Remediation Facilitation/Support – Ideally, gap remediation will be largely accomplished by the internal team, rather than a third party (like Pivot Point Security). An internally focused approach leveraging a third party for subject matter expert on demand, templates and artifact validation, maximizes the development of organizational knowledge/expertise, ensures that key personnel are “stakeholders” in the resultant control environment and prevents an organization from being overly reliant on a third party to operate the ISMS post certification… we should not be your crutch but rather your jet pack.

Security Metrics – Security metrics are critical to the optimal operation of an ISMS, as they are integral to demonstrating the continuous improvement principles that are inherent in most ISMSs. This service is focused on simplifying the process of measuring, reporting and hence systematically improving ISMS effectiveness. Independent of the security framework being leveraged, ISO-27004 provides excellent guidance on security metrics.

Policy, Standards, & Procedure (PSP) Support – PSPs form the backbone of any ISMS. Remarkably, although PSPs are the most basic elements of an ISMS, they are also one of the most complex to implement effectively. This is largely due to the comprehensive and inter-dependent nature of PSPs.