Security Program Documentation

Documentation helps us create consistency and make sure that we're carrying out the functions of the security program the way we need to carry it out.

The Value of Documentation

Let's give a little scenario here. Let's say there is some sort of task that I need to carry out. I've been assigned a task, some sort of job that I need to do, and I've never done it before. So I'm going to do some research, figure out the best way to do it, and go through this process of actually implementing whatever it is that I need to implement. As I go through this process I make some mistakes, I learn a few things, learn how to do it differently next time and improve upon it.

However, let's say it's a whole year that goes by. If it's a whole year that goes by, I'm going to forget a lot of the information of how I did it, and so I'm going to have to re-research everything and figure out this process all over again, and try to remember exactly what I messed up on last time and how to improve upon things. You see, that process is only as good as my memory, and so we have imperfect memory.

But if I were to document something, and document the whole process, and then at the end of it try to figure out how I could improve upon it, then when a year goes by I pick things up where I left off. Now I already have the framework of what I started with, or what I ended with the year before. So that's the power of documentation. It can really help us improve things like our efficiency and the quality of what we're actually turning out.

And you may say, well, yeah, of course, if a whole year goes by you're going to forget something. But let's say it's every month, or maybe it's multiple times a month. Well, that documentation becomes even more important, because I'm doing this on a regular basis, and so if I document things out I can get really efficient with how I go about doing this process.

Benefits to the Security Program

There are a lot of benefits to documenting out your processes and procedures. In fact, so much so that it's a huge part of your security program and making your security program successful. So much so that there's a lot of laws and regulations that actually require it, depending on what industry you're in or who your customers are. And so it's a huge part of your cyber security program.

And what benefits does it have? By documenting things out, you create consistency with being able to carry out the functions of whatever job it is. You can make improvements off of that. You can identify weak areas and start improving on it. You create efficiencies with how you roll things out. And there's also an improvement in quality when you do the documentation and you actually follow that documentation.

Communication and Transparency

One of the benefits that I found from improving your processes is by working in communication to stakeholders, and also creating some transparency with that process. What this does is it allows others to really be able to see what it is that you're doing, and make sure you're communicating with them before you bring systems down or do any kind of maintenance or whatever it is that could affect other people.

Automation and Maturity

If we have our processes all documented out, not only can I help streamline things and make things more efficient, because it's written down I can see where there are problems at and improve upon it, but I also can start automating things. I can start identifying parts of this that would be really easy to automate and have some sort of script or code carry out that part of the function, therefore reducing the amount of work that I have to even do overall.

Having the correct level of documentation, I find, really has to do with the maturity level of the department. Initially there's a lot of ad hoc, just off the cuff, just improvising things as you go along with the process, which is fine when you're working for a startup or some business that needs to be agile. But we need to be working more towards structure when it comes to bigger businesses, and also work towards automation, so that we're spending less time with the mundane tasks and that we are automating those instead.

So the core of a good security program relies heavily on these policies, standards, procedures, guidelines and controls, and using these to leverage to push security forward for your organization.