Determine what “secure” means to the organization by reviewing the topic of cybersecurity vulnerability, evaluating existing business practices, and interviewing senior personnel.

Step 1: Classify Aspects to Be Addressed

Before beginning the vulnerability assessment, you must first create a preliminary classification of mission-critical aspects to be addressed in the assessment. Determine what “secure” means to the organization by reviewing the topic of cybersecurity vulnerability, evaluating existing business practices, and interviewing senior personnel.

Prepare an overview of the mission-critical aspects of the organization’s current processes. Include personnel, physical security, network security, and cybersecurity in the overview. You will use this overview to prepare a scope of work in the following step.

Step 2: Create a Scope of Work (SoW)

In this step, you will perform a vulnerability assessment once again as the CISO. Since the previous contractor was an external consultant, you will be able to offer insights and consider the big picture of the organization when conducting the assessment. You will prepare for the assessment by creating a comprehensive list of security needs based on findings from the previous step. This list should identify threats, risks, and vulnerabilities to achieve a holistic view of the risk across the entity.

The scope of work is the key element to any project and important to learn. It should be filed as supplementary documentation for purposes of evaluating execution and directional purposes of meeting milestones of a multiphase comprehensive project plan within the vulnerability assessment. The scope of work will be the first section of the final vulnerability assessment report.