Cyber Essentials. A guide to the Cyber Essentials and Cyber Essentials Plus certifications

IT Governance Publishing, Alan Calder

This book is a practical guide to achieving Cyber Essentials certification, a key step in protecting your organization from cyber threats. It starts with an overview of the Cyber Essentials scheme and explains why certification is crucial. The book covers common cyber attacks like ransomware, social engineering, and denial of service, helping you understand potential threats.It then explores essential technical controls needed for certification, such as firewalls, secure configurations, user access control, and malware protection. It also highlights best practices like managing security updates to keep systems secure. Each chapter offers actionable advice on implementing these controls, emphasizing their role in strengthening your cybersecurity framework.The book concludes with a detailed look at the Cyber Essentials certification process. It guides you through preparing for certification, completing the checklist, and undergoing the assessment. Additional resources and tips for Cyber Essentials Plus certification are included for those seeking further guidance.This comprehensive guide provides the knowledge and tools to secure your organization, achieve certification, and maintain strong cybersecurity resilience.

Cyber Resilience. A Comprehensive Guide to Understanding and Implementing Cybersecurity Principles

IT Governance Publishing, Alan Calder

In today’s rapidly evolving digital landscape, cybersecurity is essential for protecting organizations from cyber threats. This book provides a thorough guide to building cyber resilience, starting with an in-depth understanding of the ever-changing cyber threat landscape. It covers foundational principles such as risk management, security controls, and defense-in-depth strategies, giving readers the knowledge needed to secure digital systems effectively.The book then delves into actionable cybersecurity controls, offering insights on asset management, identity and access control, encryption, and incident response management. Each section includes practical tips for implementation, ensuring that readers can apply these strategies in real-world scenarios. The goal is to help organizations not only understand cybersecurity but also to establish robust security policies and protocols to prevent and mitigate potential risks.Finally, the book emphasizes the importance of continual improvement and monitoring to maintain a resilient cybersecurity framework. It highlights the need for regular audits, vulnerability scanning, and staff training to adapt to new threats. By the end, readers will be equipped to build and sustain a resilient cybersecurity strategy that ensures long-term protection and business continuity.

Information Security Risk Management for ISO 27001/ISO 27002. A Practical Guide to Risk, Assessment, and Control Selection Aligned with ISO Standards

IT Governance Publishing, Alan Calder, Steve G Watkins

This guide navigates through the essential processes of risk management within an ISO 27001/27002 framework. Beginning with foundational principles and methodologies, it systematically details every stage from assessment and analysis to treatment and review. Readers will learn how to apply both qualitative and quantitative techniques to measure impact, likelihood, and risk levels accurately.The book provides clarity on roles, policies, asset classification, and control selection, reinforced by practical tools like gap analysis and risk assessment software. Real-world scenarios and methodologies are contextualized for effective decision-making aligned with international compliance standards.By the end, readers will possess a comprehensive understanding of implementing and sustaining a risk management system that meets ISO 27001/27002 requirements, enabling them to better safeguard information assets and demonstrate regulatory accountability.

ISO 22301:2019 and business continuity management. Understand how to plan, implement and enhance a business continuity management system (BCMS)

IT Governance Publishing, Alan Calder

This book offers an in-depth exploration of ISO 22301:2019 and its role in business continuity management. It begins by explaining the standards and their importance for building resilience against disruptions. Readers will learn the core principles of ISO 22301, including the PDCA (Plan-Do-Check-Act) cycle, leadership responsibilities, and the integration with other management systems.As the book progresses, readers will delve into key aspects of creating an effective business continuity plan, such as context analysis, identifying stakeholders, conducting risk assessments, and establishing support systems. Practical strategies are provided to help readers optimize business continuity solutions and incorporate them into their operations, ensuring preparedness for unforeseen risks.The book also examines methods for evaluating and continuously improving continuity plans. In the final chapters, readers are guided through the process of ISO 22301 certification, offering a clear path to securing certification and enhancing organizational resilience.

ISO 27001/ISO 27002. A guide to information security management systems

IT Governance Publishing, Alan Calder

This comprehensive guide demystifies the ISO 27001 and ISO 27002 standards, offering a clear roadmap to understanding, implementing, and managing an Information Security Management System (ISMS). It begins with foundational concepts, a history of ISO 27001, and introduces the ISO 27000 family. The book proceeds to cover the PDCA cycle, Annex SL structure, and the significance of shall vs. should in compliance language.Core chapters walk through ISO 27001’s clauses and requirements, from organizational context and leadership to performance evaluation and continual improvement. Annex A's security controls are explored in detail, linking theory with practical application. ISO 27002 is also thoroughly reviewed to offer guidance on selecting and implementing appropriate controls.By the end of the book, readers gain a strong understanding of ISMS design, certification processes, and control mapping. This resource supports IT managers, compliance officers, and auditors seeking to align with international security standards.

IT Governance. An international guide to data security and ISO 27001/ISO 27002

IT Governance Publishing, Alan Calder, Steve G Watkins

In the modern digital landscape, information security has never been more critical. This book introduces readers to the essential components of IT governance, focusing on frameworks like ISO 27001 and strategies for managing risks in today's complex information economy. The content explores key topics like cybersecurity, risk management, information security policies, and compliance with international standards. As you progress, you’ll learn to navigate the challenges of organizing and maintaining a secure IT environment, with insights into compliance regulations, security frameworks, and governance codes. The book provides hands-on guidance on applying security controls, setting up robust information security policies, and evaluating risks. Real-world scenarios and practical applications ensure the knowledge gained is immediately applicable to professional environments.The journey culminates in an understanding of how to integrate IT governance within an organization. You’ll learn to assess vulnerabilities, implement risk management strategies, and ensure that security measures align with both business goals and regulatory requirements. The book equips readers with the tools needed to strengthen IT systems against evolving threats and to stay ahead in the information security landscape.

The Cyber Security Handbook. Prepare, respond, and recover from cyber attacks using the IT Governance Cyber Resilience Framework

IT Governance Publishing, Alan Calder

This book offers a deep dive into cybersecurity, equipping professionals with tools and frameworks to protect organizations from diverse cyber threats. It covers critical areas such as information security, cyber resilience, and the regulatory and contractual requirements organizations must meet. The book delves into threat anatomy, analyzing technical, human, physical, and third-party vulnerabilities, and includes real-world case studies like the TalkTalk breach and WannaCry ransomware attack.It also emphasizes third-party risk management to ensure robust security practices across all areas. The book introduces the IT Governance Cyber Resilience Framework (CRF), a structured method for managing critical systems, guiding readers through the processes of identification, detection, response, recovery, and continual improvement. Practical strategies in areas like asset management, network security, and staff training are included.The final section offers actionable steps for implementing cybersecurity practices and introduces reference frameworks like NIST and ISO 27001 for compliance and ongoing improvement. With real-world examples and actionable frameworks, this guide is essential for professionals aiming to enhance their organization's cyber resilience.

The Ransomware Threat Landscape. Prepare for, recognise and survive ransomware attacks

IT Governance Publishing, Alan Calder

The Ransomware Threat Landscape offers an in-depth examination of ransomware, explaining how it works, its modes of access, and the consequences of attacks. The book begins by detailing the mechanisms of ransomware, how cybercriminals exploit vulnerabilities, and the damage it causes to organizations. It further explores the types of ransomware, their infection methods, and how attackers use ransomware for financial gain.The guide provides practical, actionable advice on basic and advanced cybersecurity measures to protect against ransomware. Topics like cybersecurity hygiene, staff awareness, and the importance of creating an anti-ransomware program are covered. The book emphasizes the role of a well-structured risk management framework and its application in preventing attacks and mitigating fallout from infections.For organizations of all sizes, the book offers tailored controls to strengthen defenses. It also explains the steps needed for a comprehensive recovery plan. Advanced prevention strategies for larger enterprises are discussed, making this guide suitable for IT professionals, security experts, and organizational leaders aiming to protect their systems from ransomware threats.