Ladies and Gentlemen, I'm thrilled to share some amazing news! Just yesterday afternoon, I wrapped up an incredible 38 slide decks and scripts for an upgraded version of my course, and I can’t wait for you to experience it!

This revamped course is meticulously designed to equip you with the essential skills needed to break into the fascinating world of Information Security. With a focus on governance, risk management, and compliance (GRC), you’ll gain the knowledge necessary to land your dream role as a GRC analyst.

But this isn’t just any ordinary video course! Get ready for exhilarating side quests, engaging reading tasks, and practical templates, including a control register, policy examples, and even a risk register and scenario template.

You’ll dive deep into vital topics like security risk assessment methodologies, human risk management, governance, policy crafting, and much more! We’re offering a robust 73 different lessons— and we might even add a few more to the mix!

This comprehensive structure is designed for YOU, helping you thrive as part of a GRC team, tackling risk assessment, risk management, and policy drafting like a pro!

Over the past three years, I’ve been honing my public speaking, presentation skills, and content creation to ensure that every course I deliver is not just informative but truly engaging and empowering.

Here’s the scoop: the current price is only £47, but once I hit “publish” on this shining new version, it jumps to £199.

Yes, the price is going up, but so is the value! You’ll be getting so much more from this course, with the potential to earn a top 10% salary within just 3-5 years because of the knowledge you’ll gain.

If you’re ready to take this exciting step towards your new career, join my security policy foundations course now and save a whopping £152!

https://www.policywizard.io/security-policy-foundations

I expect to hit the publish button in the next month or two.

I can’t wait to embark on this journey with you!

Best wishes,

Stuart Wedge

PolicyWizard

This week is a little different. I want to give you all access to the recording of a talk I gave to the interns in this year’s intake of CyBlack. They are one of the organisations that I have partnered with. They provide training to people from the Black community in the UK and Europe, with the overall goal of helping them achieve a career in Tech.

I had a disaster of a start on the webinar. I had a technical issue preventing me from sharing the slide. It took me about 4 minutes to fix. Looking back on that, I was struggling a bit and did quite well under pressure to get by. These things happen.

After figuring out the issue, I spoke with them for nearly 15 minutes. It was very enjoyable. I hope you find it as valuable as the interns did.

This webinar is my first time publishing this type of content, and will normally only be available to premium subscribers. I intend to put out more premium content going forward. This video is a free look into the benefits of being a premium member.

A big upgrade button is in the corner if you want to join the premium members and support the blog.

I will be adding this video to the foundation course.

I hope you enjoy the video. Please do leave some comments.

I hear you ask, “Stuart, What is reader fatigue?” Well, my friend, it is the apathy people feel when they have to read verbose documents for a reason they do not care about.

Let’s break that down a little:

Apathy

Behaviour that shows no interest or energy and shows that someone is unwilling to take action, especially over something important.

Cambridge Dictionary

Privacy Notice

Let’s look at this from the perspective of a Privacy Notice. Have you signed up for a new service like Disney+, Prime Video, or Netflix? Before you can watch anything, you are met with a Privacy Notice to read.

You know that privacy is important. It’s such an important issue that you started a career trying to protect other people’s privacy.

Did you read every line?

You did read it all…. didn’t you?

Be honest now…

You skipped it… didn’t you?

That, my friend, is “Reader fatigue.”

Reader Fatigue in Security

On average, one-third of people asked to read a security policy will click to indicate they have read a 10+ page Information Security Policy in less than 60 seconds. I have seen the data with my own eyes.

When people don’t care to even read the policies, you get data like this from Gartner.

Reader fatigue is potentially harmful to your organisation. If we recall the four drivers from the “How to Choose a Standard” edition:

1. Legal or regulatory obligation

2. Customer requirement

3. Consistency of Operational Security Configurations

4. Continuity of value generation

Numbers three and four directly relate to the security posture of the organisation. Suppose people ignore the rules and set operational security configurations to suit their needs. In that case, there is a significant opportunity for a malicious person to exploit the shadow configurations and impede business operations.

Preventing Reader Fatigue

So, how do we prevent reader fatigue? In a nutshell… it’s not easy. It’s going to take significant organisational change and support from executive management. Here are some options you can look at:

• Global email from the CISO explaining why staff need to read policies

• Improve your writing in the security policies and procedures

• Reduce the length and include only relevant information

• Reduce the authoritarian language (Stop SHOUTING)

• Write to the rule followers, not the rule breakers

• Communicate policies using new methods

• Explainer videos and policy cheat sheets

• Write with respect and remove emotion

• Reduce the number of documents

• Reduce the notifications

• Reduce the frequency

You can try and do these yourself. Please do! I would love to see how you get on. Could you write about it and tell everyone what you learned?

Or…. you could speak to the employee of the month at PolicyWizard 🙂. Someone who’s done this for real at an enterprise-level global software company.

If you’re seeing multiple staff leaking data or violating security policies, it might be worth looking into your security policies and trying to make improvements that reduce reader fatigue.

If you would like to work with me on reducing reader fatigue at your organisation, DM me on LinkedIn or book a Discovery call. Discovery calls are for business customers engaging in consulting with PolicyWizard. If you want to learn more about security policies, enrol in the course or book a coaching call.

Subscribe now

Why do we break the rules?

I’ve recently learned about a study carried out in the 1950s on the topic of delinquency. It talks about how people tell themselves that rule-breaking is okay, depending on the justification. It’s called Neutralization. I’ll be digging into the subject more and covering it in a future edition.

That’s it for this week; thanks for reading till the end! I hope you found this edition valuable. If you’re writing policies, it’s always good to consider how our policies and procedures affect our readers and remove objections where possible.

Until the next adventure,

Stuart Wedge,

PolicyWizard 🧙‍♂️

Share The Fellowship

Welcome to the Thirteenth edition of “The Fellowship” newsletter.

I took a break last week to rest up. I had a hectic week at work and was a little fatigued. It’s been another hectic week, but I’m feeling rested this morning and happy to spend some time writing to wonderful people.

The 12^th Edition of “The Fellowship” covered What is the objective of the Security Function. It’s a good edition that details why security policies are the root of all control. If you’ve not managed to read it yet, I would encourage you to do so.

This week, I want to help you with a simple lesson in using Automation. Let’s get into it.

How to automate bulk email so you don’t breach GDPR.

My email address has been included in at least four data breaches in the last two years. Once, it was breached by a person of high stature in the security industry. They emailed their customers about an event they were hosting and sent it to everyone using the “To” address.

I could see the email address of all their customers who had registered for the paid-for event. If I were unscrupulous, I could have loaded their emails into my subscriber list and tried to sell to them. I didn’t… That would be a breach of GDPR and does not meet the personal values and ethical standards I hold myself to.

I was sent an email from a local public speaking group on a separate occasion. Similarly to the previous example, they had included all club members in the CC address. As someone concerned about the security and privacy of my personal information, I reported the data breach to the senders.

I have not yet reported a small business or a club for breaching my personal information to the Information Commissioner’s Office (ICO), the government body responsible for enforcing UK GDPR. They get a second chance. If they persist in sending my information insecurely, I will remove myself as a customer/member/subscriber and report them.

Any organisation collecting and using the personal information of UK citizens or those who live in Europe should be aware of their obligations under GDPR and implement safety checks before using the information in a way that could constitute a breach.

Mihaela Jembei, the ICO’s Director of Regulatory Cyber, said:

The ICO is genuinely monitoring the number of UK GDPR data breaches caused by the incorrect use of the BCC field and wrote this post only one week ago on LinkedIn.

How can you prevent yourself from breaching UK GDPR when sending bulk emails?

You have a couple of solid options. The first is an external platform that allows you to collect email addresses, group them using tags, and send them to each person individually. Here are the top 5 bulk email platforms:

1. ConvertKit

2. Mailchimp

3. SubStack

4. Podia

5. HubSpot

I like these options because they have been designed for the sole purpose of sending bulk emails. You can use them for Announcements, Newsletters, Product launches, and Sales promotions. Most platforms have a free option for managing a list of only a few hundred people. If your list is a little more extensive, the cost to use the paid options is usually high.

The second option is to use automation to control the email list on your licenced services, keeping it in-house, and if you’re paying for the product anyway, it doesn’t cost anything extra. What I’m talking about is Power Automation by Microsoft. It is BRILLIANT!

Power Automate

The application has two options. You can use the Desktop Application, or you can use the Cloud Application. I will share some resources and then show you what I do using a cloud flow. You can find the documentation Here: https://learn.microsoft.com/en-us/power-automate/

What is a flow?

A flow is the name of running a series of actions using automation.

Desktop Application

You can use the free desktop application. Some of the more advanced options are restricted to paying customers. For those of you running a business, if you’re using the MS365 environment for your company, the product may be included in the licence you already pay for. If it is, it’s even better because you can do much more with it!

The instructions to install are here: https://learn.microsoft.com/en-us/power-automate/desktop-flows/install.

You can download it here: https://powerautomate.microsoft.com/en-gb/robotic-process-automation/.

Cloud Application

Sign into Microsoft Office 365. At the top left, click the nine little dots and select Power Automate from the list. When it opens, click “+ Create”.

Flows running from the cloud are capable of a lot more. Here are a few examples:

• Automated Cloud Flow that runs when something happens. You do not need to do anything for this to run. An example might be if you receive an email. You can forward the email to the account manager, add the person to a database, and send them follow-up emails.

• Manually trigger a flow. This requires you to start it. It could be anything. Say you want to announce a new product. You can input the latest product information into a flow, trigger it to start, and the flow will send it to your email list and send it to your social media channels as a new post.

• Scheduled Cloud Flow. This is for things you need to happen, and you know they occur at a set period. You might need to take the bins out every Wednesday. You can set up a flow that will send you an email every Wednesday to remind you to take them out.

Connections

Power Automate integrates with hundreds of different applications and services. All types of flow can be connected with Microsoft applications and hundreds of others. Here are some examples of applications that you can connect to:

Templates

Microsoft has provided a lot of template flows for you. Select the flow, amend the information to what you require, and you’re all set! Here are a few examples:

• Save a Teams message in OneNote.

• Forward emails to a channel in Teams

• Notify a team when a task in Planner changes.

• Find a meeting time with the sender of an email.

• Post a message to Teams when a Jira is created

Sending Bulk Emails using an Excel sheet (Business Only)

I use this to send emails to a list of people gathered from a tool such as an LMS. I might use it to send a reminder to complete their training if they are not doing it after receiving automated emails from the tool. Create this flow using a business MS365 Account. A single-person company costs £19 a month, including most of the Microsoft Tools. It’s worth the investment. You will need the following things:

• Microsoft Excel

• Microsoft Outlook

• Microsoft Power Automate

• Microsoft SharePoint

Excel Document

This document will need a column listing the customer email addresses to which you want to send the email. A second column with “Yes” on each row is also required. Don’t include the quotation marks. Save the file to a location that Power Automate can reach. For me, I will use SharePoint.

Power Automate

Open Power Automate and create an Instant Cloud Flow.

Give the flow a name and make sure “Manually Trigger a Flow” is selected.  Click “Create,” and it will open your new flow.

Click “Next Step” and search for “List rows present in a table”.

Select the file where the information resides. Select “Next step” and search for “Condition”.

This option is asking a question. We need to give it the question to ask. Click on the highlighted  “Choose a Value” option. Here, we need to input some Dynamic Content.

What is Dynamic Content?

Dynamic content can be selected from previously gathered data in the flow. So, for this step, we want to choose the “Send to email” option from the Excel table.

Selecting the option will change the flow to put the condition inside an “Apply to each” option. That means that for each “Send to” in the Excel table, it will run the condition. Make sure the “Send to” condition “is equal to” > Yes.

Inside the “If yes” option, click “Add an action”.

Search for “Send an email (V2).

In the “Send an email” action, click on the “To” option. We need to add the dynamic action.

Select “Customer email” from the “List rows in table” option.

Fill out the email information.

We can tidy up the flow by adding a “Terminate” option below the condition.

This flow is complete and can be used to send emails to your contact list without risking a breach of UK GDPR. You can save the flow and run a test using a personal email address.

How can I help?

I can use Power Automate for many tasks within the Security Awareness, Compliance, ISO 27001, and GDPR space. If you’d like assistance to automate your processes, please email info@policywizard.io or DM me on LinkedIn. My services page has information on other services I provide.

That’s it for this week. I hope you’ve enjoyed learning how to send bulk emails using Power Automate. Let me know what you think in the comments or on LinkedIn. If you liked it, consider sharing it with your peers.

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

Welcome to the twelfth edition of The Fellowship Newsletter.

Last week, I wrote about the Top 5 things to look for in a Course Hosting Platform. I wrote it to help those thinking about launching your own course. It took me a lot of research to determine what I needed and which platform to use. I hope it helps you save a few hours.

This week, I want to cover a subject I touched on in the How to Choose a standard edition of The Fellowship. Like last week, I’m still on holiday from work, so it won’t be narrated. I’ll get back to that next week. The subject for this week is:

What is the objective of a security function?

Before answering the question, we need to know what we mean by “Security.” It’s from the Latin word. “Securitas”. It means to have “freedom from care”. If we dissect that a little more, It’s a feeling of “Freedom from Harm”. It’s a feeling of comfort and safety where you are and in your activity.

So, we know that being secure means feeling comfortable and safe. Why, then, do people feel insecure? There are a few reasons. The first is Natural disasters. Things that happen in our surrounding area could cause us harm. Things like tornadoes, tsunamis, and earthquakes (I’m including man-made object failures in this category (e.g., Aircraft failures, Building collapse, and Electrical fires)). Things that occur where we have zero control over what happens to us.

Then we have Animals. They are not dangerous all the time. Animals are potentially dangerous. Most people who animals harm put themselves in danger in the first place. But they can still make us feel insecure! If this lion is walking towards me and you when out for a walk together, we will both feel insecure. If I start running… you’d better keep up because it’s the slow one that gets eaten.

We can control none of those things. It’s not in our remit as a security function to concern ourselves with it. What we can do is to focus on people. Other people's behaviour can cause feelings of insecurity, either in our staff or our customers. People can be unpredictable, manipulative, aggressive, and violent.

Our staff want to avoid coming to work and fear being harmed. Likewise, our customers do not want to be impacted by the unwanted behaviour of someone who has access to our networks and systems, potentially causing harm to their staff or customers.

That fear of harm does not always come from external forces. Accidental actions or incompetence can also cause damage. A system administrator wiping the backups, or someone in HR sending staff compensation rates to the wrong distribution list. Then there is also the possibility of Insider Threat. Someone internal to the organisation acting against it or working in their own self-interest to defraud the organisation of money or future revenue.

Given that we now know that being secure is all about feelings, what is the purpose of the security function? Why are we here?

The primary objective of the security function

To advise the organisation on safeguarding operating conditions to prevent behaviour impacting its ability to create protected value.

The secondary objective of the security function

To identify and respond to occurrences of unwanted behaviour that were able to avoid the safeguards and implement countermeasures to reduce the impact of possible harm.

There is a beautiful quote that I use when I talk about security risk. It’s by the author J. A. Shedd, who lived between 1859 and 1929. He stated:

This sums up quite nicely what we do in security. We advise businesses on how to build their ships to deliver their goods safely to their customers. Essentially, we advise them on how to build and manage their operating conditions so that they can do business in places where unwanted behaviour causes them (or their customers) to feel insecure. In our case, that is mostly business operating in the online environment. 

Safeguarding Operating Conditions

We must safeguard our operating conditions, but how do we do it? We need to introduce controls to prevent it. Safeguards are chosen to reduce the frequency of a behaviour or event that could cause harm. These controls act as blockers to prevent access to the environment you wish to protect. Countermeasures are chosen to reduce the impact or level of damage the behaviour could cause.

Control Sub-types

• Preventative controls stop something from happening.

  • This would include VPNs, Network and Application Firewalls, and Security Groups in the cloud.

• Detection controls provide awareness that an event of concern is happening.

  • This would include SIEM tools like Splunk and SentinelOne.

• A corrective control stops an event from progressing any further.

  • This might include an endpoint detection and response tool that stops known malicious files from executing. Think CrowdStrike and Windows Defender.

• A displacement control moves the event to where the potential for harm is reduced.

  • This could be a Honeypot or a Sandbox with no production data.

• A minimisation control reduces the impact of the event.

  • This could include methods of preventing someone from downloading the entire customer database in one request. Instead, breaking the download into very small chunks and requiring the approval of 2 other people.

• Recovery controls reduce the effect of the behaviour.

  • This would include Data Backups, Incident Response Policy, and Business Continuity Procedures.

• Awareness and Capability controls are people-based controls.

  • This usually involves training and testing.

Accidental Data Loss

Security is a people problem. Generally, people want to be good. They want to go to work, do a good job, get paid, and go home. They don’t want to do something that might jeopardise that. But work is complicated. There are lots of things to think about. Some pressures put on our staff can make them do things accidentally that cause harm.

That is where our Security Policies and Procedures come in. These are our Authority documents. These are how we influence most of our staff. We set rules that we want them to do. These are Administrative and Managerial controls. Without this guidance, we, the staff, are the vulnerability. They are the basis of how we implement our safeguards and countermeasures. They are the Root of all Control. Let me explain:

Policies are the root of all control.

We have our unwanted behaviours. These are our risks. If they happen, it will result in some form of harm to the organisation. So, we need to implement our security policies to tell our staff how we want them to behave. What is considered acceptable behaviour? What configurations to use? This is important, and we need to document it and ensure that our staff know what is expected of them and what will happen if they do not follow the rules.

There is a lot to consider. There is a lot for our staff to learn and do. We can make it easier for them by implementing controls that make the unwanted behaviour less frequent. Sometimes, the control can stop it altogether.

It’s a feedback loop. Changing the risks will require changes to the policies and the controls used to mitigate the risk. It’s all controlled by the policies.

Building for Compliance

Many companies will only focus their security policies on what is required by security frameworks like ISO 27001. That standard has a mandatory requirement for companies to have nine security policies before getting the certification. Compliance does not equal security. Building for compliance will make an organisation more secure, but all of the standards could be better. Then, we have the problem of reactive policies.

Somebody does something stupid, and the company makes a policy to try and stop it from happening again. That just doesn’t work. You end up covered in policies designed to fix problems, not prevent them from happening in the first place. If we build for security, we can avoid this problem and become mature organisations with policies designed to deal with security first. This results in having the proper defences and controls in place to stop the cuts from happening in the first place.

We want to build for security. We know that we have risks and need policies to control them. How do we do it? What risks do we need to manage? What policies do we need to write?

Risk Scenarios

Before controlling potentially harmful behaviour, we must understand what behaviour we might be exposed to. We need to carry out an assessment of the risks that could harm us. We do that by looking at our environment and seeing where we are vulnerable. I don’t mean vulnerability management. If someone walked into the building and stole the finance server, what harm would that cause? How do we stop it? That’s a risk scenario.

This is a proprietary database of 98 risk scenarios that I have created. It looks at generic threats. I select if the behaviours can be caused by someone internal or external, malicious or accidental. Then, I look at the assets it could affect, the location of the asset, and the areas of weakness for the potential vulnerability. I then need to ensure a policy that targets and mitigates the risk. We do that by carrying out a Gap Analysis against the Policy framework.

Security Policy Framework

The policy framework is the database or repository we use to track security policies and procedures.

If we have a risk scenario not covered by a policy, we need to amend an existing policy or draft a new one that does. This is my policy repository. It’s a Policy Management Solution provided by Xoralia. Their brilliant policy management solution allows companies to control policies, manage the policy lifecycle, and track the reader’s attestation. The best thing about it is that it integrates with SharePoint. So, companies don’t need to move their policies outside the network.

Control Register

You need a control register after completing the risk scenarios and your policy framework. A method of tracking all the controls that the organisation has in place to reduce unwanted behaviour. 

Summary

In summary, we learned that security is about feelings of comfort and safety. We learned that people feel insecure because of natural disasters, potentially dangerous animals, and the unwanted behaviour of others. We learned that the purpose of the security function is to advise businesses on managing operating conditions to enable them to generate revenue in places where the risk of unwanted behaviour is minimal. We learned about the two types of security control and their sub-types. I wrote about how security policies are the root of all control. It’s how we control the mitigation of all security risks. We learned about Risk scenarios and how they can be used to target risks. Then we looked at a Policy framework, and I wrote about a control register.

How can I help?

This methodology is how I create a strategy for implementing a security policy framework and help clients meet the requirements of laws and security standards like Cyber Essentials, GDPR, and ISO 27001. If you’d like to talk to me about working with you to implement a security standard at your small or medium-sized business, you can send me a DM on LinkedIn or book a Strategy Call on my services page, where you will find more information.

That’s it for this week. I hope you’ve enjoyed learning about the objective of a security function and how I help my clients achieve it. Let me know what you think in the comments or on LinkedIn. If you liked it, consider sharing it with your peers.

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

Welcome to the eleventh edition of The Fellowship Newsletter.

Last week I wrote about Security Policies for Small Businesses. It focussed on the first security policies I would write and how I would go about it. I even included a breakdown of the mandatory policies for ISO 27001. Providing a simple framework for small businesses to begin to implement.

Well, that edition of the Newsletter led to a meeting with a small business owner with whom I had a previous relationship. This PolicyWizard has agreed to consult/contract with the client on a retained deal to help them implement security policies and help to implement compliance efforts for Cyber Essentials (Plus), GDPR, and ISO 27001.

That is the power of networking, building solid relationships, producing excellent work at every opportunity, and helping others. That new contract would only have happened with sharing the knowledge in The Fellowship.

This week, it will be a much shorter edition and will not have a voiceover. It’s Friday night. I’ve just finished a wonderful but tiring week at work, and I’m heading out on holiday (vacation for my friends from the US). I’m staying local in Scotland and resting up. I’ll be eating good food, enjoying the late summer sun, and probably spending some time writing the book too. So, let’s look at:

Top 5 things to look for in a Course Hosting Platform

I set out over a year ago, looking at the different options for a Learning Management System (LMS) that I could use to host my course and, even better, if it provided additional functions that I could use to run my business. I wanted it to look professional, be customisable, and be owned by me. I did not want any other companies influencing the price of my course or changing something I didn’t want to change. I had to go independent. At that stage, it seemed like my only option.

It couldn’t just be an LMS. It needed to take people from being interested to getting them signed up for a course or courses. That process is called a sales funnel. It helps businesses turn people from social media into customers spending money with you. So, I began looking for a platform that was an all-encompassing solution. It needed to give me total control over the customer journey and provide me with the tools to do that.

I have nearly 9000 people following me on LinkedIn. Lots of them engage with me regularly. I put out great content and have helped many people. For businesses, one of the biggest problems with social media is that the audience (your followers) is rented. If the platform were to die overnight (like Myspace) or my account was revoked for any number of reasons, my business would fail if my only source of customers was that platform.

We need multiple customer sources to have a business resilient to changes like losing a social media account. We also want to own the contact details of the people that follow us. If we hold those, they can still be customers. It does not matter what happens to the platform they found us on.

Subscribe now

That leads me to the first point:

1. Email List

The platform must allow you to collect potential customers' emails and send mass emails to the list. You'll need this to let them know what you're doing and what new products and services are available. If you want to remain GDPR compliant, make sure you have the ability for a double opt-in.

2. Digital Downloads

It’s all good if the platform can collect email addresses, but how will you encourage people to sign up for your list? You need to give them something of value. Otherwise, you’re going to be begging them. “Please sign up for my list; we need customers.” It’s not attractive.

Step forward the “Lead Magnet”.

A lead magnet is something valuable that you offer potential customers to get them to join your email list. You can promote the lead magnet in other places, like your social media channels and link back to the lead magnet. People interested in value must sign up to get it. In my case, I have a few lead magnets. The first one that I created was the Security Policy Cheat Sheet. It’s a PDF document detailing what should be included in a security policy. It’s written at quite a high level but also full of value.

When I published it, people began to sign up and read it. Over 300 people downloaded the document in about four months. I don’t link to it from my LinkedIn profile anymore, but lots of people still visit the website and download it.

3. Website

If I were to go with a provider such as Udemy or Teachable, I could only host the course. It wouldn’t let me have an actual website. I wanted PolicyWizard to be a business, not just a course. I wanted to build a website showcasing everything I do, including coaching people, writing policies for businesses as a contractor, and anything else I want to offer in the future.

4. Learning Management System

I needed to host and present my course in an acceptable manner. I wanted the ability to customise lessons and include videos, transcripts, captions, and quizzes. This was the meat of the requirement. I wanted a platform that made it enjoyable to use, was accessible to all, and looked great too. It also needed to give the people who completed the course a certificate.

5. Coaching and Webinars

I wanted to be able to take the learning further than the courses. I wanted to engage with my customers at a deeper level. Help them achieve their career goals faster and produce better work. To do that, I needed a platform to sell coaching and integrate with external solutions for webinars.

Podia

After looking at all the options available, Podia appeared to be the most favourable. The price was a factor, as I was setting this up independently. Podia offered all the features I needed at a price point that would not make me wince every month when I saw the invoice.

Continual Improvement

As with learning anything new, building the website and products to a level I was happy with took me a while. It’s currently looking professional and performs as I need it to. The copy is good, and I’m converting enough customers to cover the costs. I’m building for the long term; in five years, PolicyWizard will be bigger, with more in-depth courses, and hopefully be a household name.

Covering my costs allows me to partner with organisations that support people from underrepresented communities. Over 200 people have accessed my course through Partnerships since March 2023. I encourage anyone considering building a similar business to do the same.

How can I help you?

My products & services:

1. Wizard School

   1. Security Policy Foundations

2. Services

   1. Business Policy Review

   2. Policy Management

   3. Policy Creation

3. Book a Call

   1. 1-hour coaching session

   2. 90-minute consultation

4. Resources

   1. Security Policy Cheat Sheet

   2. 5 Practical Skills to Power Your GRC Career

That’s it for this week. I hope you’ve enjoyed learning the Top 5 things to look for in a Course Hosting Platform. Let me know what you think in the comments or on LinkedIn. If you liked it, consider sharing it with your peers.

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

Welcome to the tenth edition of The Fellowship Newsletter.

Last week I wrote about Choosing a Standard and the four key drivers for security policies. In the section > Legal or Regulatory Obligations, I made a mistake. I wrote:

“GDPR obligated countries within the EU to enact a law specific to their jurisdiction that enforces the regulation. In the UK, that law is the Data Protection Act (2018), revised in 2022.”

That is a misunderstanding of the regulation on my part. The correct statement should have read:

“GDPR is enforceable within all areas of the European Union as a stand-alone regulation. It allows member countries of the EU to add requirements. In the UK, the Data Protection Act adds to GDPR and is not the UK’s implementation of GDPR.”

Thank you to Dr Mike Brass for pointing out the mistake.

This week I respond to a question from Ben Brown of Ronin PenTest, who asked:

As a small but growing business, what are the most important policy areas to pay attention to, and where are the biggest/quickest wins to be found?

Thank you for this question, Ben. As I work in an Enterprise level company, it’s easy to overlook how security policies and procedures can be used effectively in smaller organisations. I’m happy to dig into this area to help people like you who may have a few staff and want to know where to focus.

The first question you need to ask is, “Why?”. This ties into last week's newsletter. What is your reasoning for wanting security policies and procedures? What is driving you to need them? Are you doing it because there’s a regulation or law you need to comply with? Has a customer asked you for a certification like ISO 27001? Do you want to give your staff clear instructions? It might help reduce the number of questions you need to answer. Or are you trying to improve security because you know that good security is good business practice? Protecting your ability to create value will help keep the money coming in. You’re making it harder for somebody to come and take the value you have created with your product or service.

Once you know your drivers, you can start to build a plan. I covered it in a fair amount of depth last week in section 4: Continuity of value generation. As a recap, you will need to:

• Assess the environment:

  • What do we have?

  • What can we not afford to lose?

  • What do we not want to be harmed?

  • What, if harmed, can we repair quickly?

• Assess the types of behaviour that could cause harm.

• Assess what controls you have in place to stop harmful behaviour.

• Assess what controls are deficient and should be implemented to stop harmful behaviour.

Once you know what controls you need, you will need to implement them in Security Policies and Procedures. This is how you communicate the “management requirements” for security practices.

Subscribe now

What are Authority Documents?

In business, we have three different levels for document status. First, we have our foundational documents. This can include the board’s vision for the company, mission statements, and principles that the business uses to manage its business effectively.

Second, we have our authority documents. These are the policy instruments. Fact-based statements instruct staff on the management requirements for different business areas.

Lastly, we have our guidance. This is our standard operating procedures, work instructions, and any educational or background information that we use to communicate the policy requirements.

In my course, I describe five different types of policy documentation. Those five types all fall within the top two layers of the Authority Document pyramid. This graphic shows how using the business vision, mission, and principles set out the foundations for our documentation, then building on the sturdy base with the policies, and then the guidance is how we finish it. The three-tier process set our stall on how to manage the security framework of our business.

Without knowing your business, drivers, vision, mission, principles, environment, or controls, I’m not going to sit here and pontificate over what you should do. Instead, I will tell you how I would do it if I grew a small business.

How would I implement a Security Policy Framework in my small business?

The big things to think about are privacy and security. Working in the UK, I am subject to the UK GDPR. As such, I must tell my customers (and those who use my free resources like this newsletter) what I do with their data. If you are collecting the data of your customers, you need to do the same.

There are a whole bunch of things that you need to do around personal information. This is not a lesson for that. One of the things that you’ll need to do is write a Privacy notice.

Draft a Privacy Notice

A privacy notice is a publicly available document where you describe your business's different touch points with the personal information of your customers and potential customers. You’ll need to be open with them, providing the reasoning for collecting the information.  

Give them contact details for someone in the business who can answer questions on the use of their data. They should also know their rights and who to contact to make a complaint.

The next thing I would do is write an Information Security Policy.

Draft an Information Security Policy (ISP)

This document can be written for any one of the four policy drivers. It can show due diligence regarding a legal requirement, it can be requested as part of a security framework like ISO 27001, and it can be used to communicate the requirements of operational security configurations to ensure consistency across the business.

There are a lot of conflicting views about what should be included in an Information Security Policy. Some companies treat this document as a catch-all for everything related to security. My first contract job was for a financial services company in the United States of America. They sent over their ISP, which was over 40 pages long and full of utter incomprehensible waffle and legal rubbish. You’ll remember that one, Ben. We worked on that contract together.

They had used it as a dumping ground. There was procedural stuff for unrelated business processes, names of different people, and detailing tasks they had to do. It was bad. We fixed it for them, and working on that contract helped me learn what a bad Information Security Policy looked like.

ISO 27001 Policy Requirements

If you’re implementing ISO 27001, you need to meet the requirements of section > 5.2 Policy. In my words, the requirements are that the policy:

• Should be suitable for the business type and purpose.

• Should include the objectives for Information Security or provide a framework.

• Should include a management commitment to meet the objectives.

• Should include the management's commitment to continually improving the Information Security Management System (ISMS).

• Should be documented (published, not verbal).

• Should be communicated to everyone in the business.

• Should be available to other interested people who may need to know how the business manages information security. Those people might be law enforcement, regulatory bodies, or customers. Some businesses publish their ISP on their websites.

Consider keeping the ISP short. Include only what you need for the standard, and then include some clear and concise policy statements for the specific ISMS functions detailed within the ISO standard. Just because the standard requires nine mandatory policies doesn’t mean that you need to have nine documents.

What Policies are mandatory for ISO 27001?

Here are the nine mandatory policies within ISO 27001:

• (5.2) Information Security Policy

• (A6.2.1) Mobile Device Policy

  • Include BYOD

• (A6.2.2) Teleworking Policy

• (A9.1.1) Access Control Policy

• (A10.1.1) Cryptographic Control Policy

• (A10.1.2) Key Management Policy

  • Join this policy statement with the Cryptographic Control Policy.

• (A11.2.9) Clear Desk & Screen Policy

• (A12.3.1) Backup Policy

• (A15.1.1) Supplier Relationships Policy

Quick Wins

To answer the last part of the question, if I wanted to have the quickest wins with security policy without worrying about ISO 27001, I’d implement only these:

• Privacy Notice

• Information Security Policy

  • Acceptable Use Policy Statement

  • Access Control Policy Statement

  • BYOD & Mobile Policy Statement

  • Encryption and Key Management Policy Statement

  • Network Security Policy Statement

  • Password Policy Statement

  • Privileged Account Policy Statement

  • Remote Working Policy Statement

  • Safe Handling of Information Policy Statement

  • Policy Enforcement Statement

Getting deeper into the weeds

Policy statements are very high level. Sometimes a high-level statement is not sufficient. Take the Password Policy Statement as an example. This is an area that can go quite deep. You may have many different environments with similar but slightly differing configuration requirements.

If you want to keep the ISP concise, we need to use other methods to introduce specific configuration requirements. We can do that by introducing a standard. A fact-based collection of controls or settings that we want our staff to use. Standards can be separate documents or included as an appendix to the ISP. Here are examples of both:

Statement

[Company] requires that all systems are configured to require a password and that the password be configured to meet the complexity and length requirements of the [Company] Password Standard.

[Company] Password Standard

The Password length is 24 characters or more.

The password contains at least one uppercase letter (e.g., A, B, C), at least one lowercase letter (e.g., a, b, c), at least one numerical character (e.g., 1, 2, 3), and at least one special character (e.g., “, £, $, %).

Policy Templates

Many businesses find implementing new security policies daunting, especially those trying to implement the ISO standards. If you look online, you’ll find many companies offering template policy packs with upwards of forty policies. You do not need all those documents. You only need the policies applicable to your business. If you buy a policy pack or download a policy from another organisation, customise them to communicate how you have implemented security controls for your business. If you don’t, you’re opening a can of worms that will lead to future problems and potentially legal or compliance issues. PolicyWizard only offers bespoke policies. We work with businesses to implement the right policies and procedures for them.

Conclusion

Implementing security policies is vital to building good security practices into the foundations of a growing business. Implementing them early shows your staff and customers that you care about protecting personal information. It takes far more time and money to implement security policies once the business matures to a level where you have hundreds or even thousands of staff. Additionally, customers are more likely to spend their money with a business that takes care of their information.

Share

How can I help?

For small businesses, there are three options:

1.       Book a free 15-minute policy strategy session.

2.       Book a 90-minute consultation to talk your requirements over in depth.

3.       Take the Security Policy Foundations course if you want to do it yourself.

For more information on my services, please visit my Services page.

That’s it for this week. I hope you’ve enjoyed learning about security policy implementation in a small but growing business. Let me know what you think in the comments or on LinkedIn. If you liked it, consider sharing it with your peers.

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

Welcome to the ninth edition of The Fellowship Newsletter.

Last week I wrote about finding inspiration for new content ideas. It was the first newsletter I narrated, and the first time I answered a reader's question. This week I respond to a question asked by Rowan Troy.

How do you know what standards to choose when writing policy?

This is a superb question. It allows me to delve into the world of security policy drivers—the reasons for implementing security policies. Before I dig into the drivers, let’s focus on the primary and secondary security objectives. This is what we are trying to achieve.

The primary objective of the security function

To advise the organisation on safeguarding operating conditions to prevent behaviour impacting its ability to create protected value.

The secondary objective of the security function

To identify and respond to occurrences of unwanted behaviour that were able to avoid the safeguards and implement countermeasures to reduce the impact of possible harm.

Neither aliens nor robots are attacking us, not for now, at least. Security is a problem of the behaviour of people. It’s not solely a problem of people external to the organisation. It can be internal people too. Generally, people want to be good. They want to go to work, do a good job, get paid, and go home. They don’t want to do something that might jeopardise that.

However, work is complicated. There are lots of things to think about. Pressures are put on our staff that can make them do things accidentally that cause harm to the organisation. Internal people cause between 70 & 90% of all data loss. We have several drivers (reasons) to stop this from happening.

What are the main drivers for security policies and procedures?

1.  Legal or regulatory obligation

Organisations are not permitted to do anything they like without consequences. Like all of us as individual citizens, they are required to follow all laws that apply to them. Those laws can apply to organisations in specific industries or regions. They can be based on their work or the organisation's size (either by the number of employees, customers, or the size of the organisation's revenue).

In 2018 the EU implemented the General Data Protection Regulation (GDPR). For the first time, the people of Europe have rights over how their personal data is used. The eight rights are:

• The right to be informed

• The right to access

• The right to rectification

• The right to erasure

• The right to restrict processing

• The right to data portability

• The right to object

• Rights concerning automated decision-making and profiling

GDPR obligated countries within the EU to enact a law specific to their jurisdiction that enforces the regulation. In the UK, that law is the Data Protection Act (2018), revised in 2022.

In addition to the rights of the data subject (individual citizens), Chapter 2 of the act requires that Data Controllers (organisations collecting data) handle that data by following seven fundamental principles:

Lawfulness, fairness and transparency

• Purpose limitation

• Data minimisation

• Accuracy

• Storage limitation

• Integrity and confidentiality (security)

• Accountability

“The sixth data protection principle is that personal data processed for any of the lawful purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “appropriate security” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).”

Heavy fines for non-compliance with the law have encouraged (forced) organisations to take data security seriously. Governing bodies (the Information Commissioner’s Office in the UK) hold organisations accountable to the laws. As such, every organisation needs to implement controls to reduce the risk of a data breach. Showing due diligence and taking steps to prevent data breaches can lessen the impact of any fines issued for those breaches.  

To do this, many organisations implement Information Security Management Systems (ISMS) to reduce the risk of a breach. Having an ISMS shows due diligence. One method of implementing an ISMS is to use an industry standard such as ISO 27001 or the National Institute of Science and Technology (NIST) Cybersecurity Framework. Many security frameworks require organisations to implement security policies before being assessed as compliant.

Other laws in other areas of the world are also helping to enhance the protection of citizens' personal information. In the USA, the Health Information Portability and Accountability Act (HIPAA), the California Consumer Privacy Act (CCPA), and the California Privacy Rights Act (CPRA) implement requirements for organisations to protect personal data from unauthorised disclosure. Slowly but surely, other countries are enforcing laws to protect their citizens.

2.  Customer requirement

A big driver for organisations to implement security policies and procedures is to satisfy the due diligence of customers. Any organisation that is required to secure personal data because of their responsibilities under the laws in paragraph 1 will also require that other businesses in their supply chain are also taking steps to prevent data breaches. Most security frameworks list Third-party Risk Management as a requirement.

Often these requirements are set by governments. In the UK, the government requires all organisations tendering for government contracts to have a Cyber Essentials (Plus) certification before being considered.

The method used by most organisations for the Third-party Risk Management process often requires the completion of security questionnaires. These are typically an excel worksheet that has a couple of hundred questions. For each question, the service supplier is required to provide an answer. The customer often requests evidence to support the provided responses.

That evidence can include screenshots of configurations, copies of certifications (e.g., ISO 27001), attestations (e.g., SOC 2 Type 2), external audit reports, and copies of security policies and procedures.

3. Consistency of Operational Security Configurations

The consistency of security messaging and configuration information is at the heart of the reasoning for security policies. They are the definitive source of truth. When staff are configuring systems, we want them to do that securely and to the requirements set by security management.  

When security policies, procedures, and standards give clear, fact-based instructions, the staff have a consistent set of instructions that they can use to guide their decision-making and work product.

According to SOCRadar, misconfiguration has caused 35% of all Cyber Incidents. Providing staff with clear instructions and rules will inevitably reduce the instances of misconfigured systems.

Take launching a new virtual server as an example. An organisation might launch multiple thousands of new instances each month. Creating a virtual server, configured (hardened) to reduce vulnerabilities that all staff can use as an image to launch new servers will significantly reduce the effort required by the vulnerability management team.

This simple change will reduce the time to launch a machine, the number of devices with vulnerabilities, and the number of vulnerabilities and accidental misconfigurations. The cost savings are exponential as well. The operational requirements can be enforced through an administrative disciplinary procedure for staff who violate security policies and procedures.

4. Continuity of value generation

Our objective as a security function is to prevent behaviour that might affect our ability to complete our primary and secondary objectives. That’s the meat and veg of security. [1]Our job is to reduce the opportunity for people (internal or external) to destroy our opportunity to create value, denying us the opportunity to use our tools, devaluing our products or services, and degrading the value we have created.  

To do that effectively, we need to understand what behaviour we are trying to prevent and where to stop it from happening. We need to understand the operating conditions.

• What do we have in our environment?

• What do the things do for our business?

• What is the nature of the system or process?

• What is the value that the system or process creates?

• If Ransomware hit it for 24 hours, what would we lose?

Then we need to create risk scenarios that help us to recognise where our security defences are fragile and where we need to implement safeguards and countermeasures. We are not interested in environmental events like tornados and earthquakes; those are not in our remit as security practitioners. We need to focus on the interaction of people with information systems.

I have created a generic database of 98 human behaviours that could potentially cause harm to business operations. It is not specific to any business. It allows me to assess if the behaviour is internal or external, malicious or accidental, which assets it could harm, and the security exposures (general vulnerabilities) that could be exploited.

Security exists on a sliding scale. The more functionality an environment has, the less secure it is. Conversely, the more secure an environment, the less functionality it has. This is where we need to ensure that the safeguards and countermeasures we implement do not reduce the environment's functionality to a level that impacts the organisation's ability to create value. It needs to be delicately controlled by security management.

Using the risk scenarios, we can conduct a gap analysis on the security policy framework to check which risks are not covered by a safeguard. If we identify any gaps, policy statements that address the areas of concern can be drafted and implemented within existing policies, or where required, a new policy can be added.

Security policies are the root of all control. It’s how we implement and communicate the security requirements to everyone in the business and ensure that the required functionality is not impacted by the rules we implement. Our security policies address our security risks and help us to implement our security controls. Our security controls allow us to mitigate security risks. It’s a feedback loop. Changing the risks will require changing the policies and controls.

In conclusion

Rowan asked:

How do you know what standards to choose when writing policy?

Answer:

Security policies are created for several reasons. If you build for compliance (choosing a standard), you will leave potential areas of concern undiscovered. If we build for security, we get compliance for free. You should focus your security policies on the behaviours you try to prevent. Don’t write policies because a security framework requires it or an auditor says it’s needed. Address the security concerns applicable to the organisation, don’t implement a generic set of policies to meet compliance.

Learn with me

If you’re ready, there are three ways that I can help you:

1. Take the security policy foundations course.

2. Book a 60-minute 1:1 coaching session.

3. Upgrade to a premium subscription.

Subscribe now

That’s it for this week. I hope you’ve enjoyed learning about the drivers for security policies and procedures. Let me know what you think in the comments or on LinkedIn. If you liked it, consider sharing it with your peers.

Client testimonials

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

[1] Dr Richard Diston – Why the CIA Triad must die

Welcome to the eighth edition of The Fellowship Newsletter.

Last week I wrote about changing the hosting platform for the Newsletter to . The transition is now complete. It has been a seamless move and super easy. If you received this as an email, you are now a free subscriber to The Fellowship on SubStack. If you don’t want to be here, please unsubscribe. No hard feelings. I do hope that you stay though as I have big plans, and I think you’ll find value in being a subscriber📈.

This week, I answer a reader’s question. If you’d like to submit a question or topic for a future edition of the newsletter, please email info@policywizard.io or contact me on LinkedIn. The question this week was asked by Lupe Peterman.

How to conjure up new content ideas?

I love this question! It’s a subject that has real depth to it. Conjuring up new ideas sounds a little bit magical. Sometimes it does feel that way, especially when I write something that goes on to get over 40,000 views in a couple of days.

In truth, sometimes I have a spur-of-the-moment idea that I put out on LinkedIn a couple of minutes later; other times, I need more thought. Here are a few important things to consider before you put out new content:

Why?

Why are you wanting to put out new content? It’s the most important thing to consider. What is your reasoning?

• Are you just posting for fun?

• Are you trying to get a new job?

• Are you trying to get promoted?

• Are you trying to get new followers?

• Are you trying to get new business leads?

• Or are you trying to become a Subject Matter Expert (SME)?

The reason you choose will dictate the subject area that you need to focus on. There is no point in posting about building your personal brand if you are trying to get a new job as a GRC Analyst.

If you’re trying to get a new job, you need to be posting content about the skills and knowledge that make you a suitable candidate for the job you’re applying for. If you want to be a GRC Analyst, post content related to the job you want and the skills and knowledge that make you perfect for the role.

You need to focus the content to address people that need those skills. You need to be showing your work. Talk about your experiences, the training you have done, and the transferrable skills that make you amazing. You can teach the skills to others. It’s a great way to cement knowledge and show that you know it.

Who?

This section is relevant for all new content, but I will use business leads as an example. If you’re trying to get leads, you need to be talking to the people who are going to be your potential clients.

If you’re a security consultant trying to get new clients for your ISO 27001 Implementation service, why would you post content about “Breaking into Cyber”? Yes, helping people get into the industry will get you more followers. It will get more eyes on your posts, but it’s not speaking to your perfect client. Most of the people reading your posts will not be buying from you. One new customer is better than 100 followers who react with a thumbs-up emoji 👍.

Platform

The platform will also dictate the content you post. Certain types of posts work better in different places. Twitter is great for short snippets. Instagram is the place for Images. You might post some light-hearted things on Facebook, but other posts on LinkedIn as it is the place for occupation-related content.

You should try to build an audience on multiple platforms, but make sure you know why you’re posting on that specific platform. Remember, your audience on those platforms is rented. If you want to build something you own, you need a method of speaking to your followers that does not depend on social media. You need a website, a blog, and a mailing list.

Subscribe now

Inspiration

inspiration - noun

someone or something that gives you ideas for doing something

a sudden good idea

Cambridge Dictionary

The definition of inspiration tells us that ideas can come from anywhere. Someone, something, or a sudden good idea. When you want to create content, for whatever reason, you’ll need good ideas.

You’ll need topics you are either proficient in or can quickly gain proficiency by researching and discussing what you’ve discovered. Here are some places where I find inspiration for content:

Comments

Inspiration can come at any time. You could be procrastinating on LinkedIn, reading about what other people find interesting, and something you’ve commented on sparks an idea.

I have often turned my comments on other people’s posts into full posts on my profile by digging into the subject more or explaining why I think the way I do.

Reading

I thought about reading books here as the second place for inspiration, but it’s much more than that for me. It’s not just in books that I find inspiration; it’s reading anything.

If I’m enjoying a read, it can be on any subject or medium, but often it will spark an idea. Something that I can relate to my experience and can see how my thoughts on that idea could help someone else.

Listening

Let’s put anything we listen to in this category. Radio, music, podcasts, and audiobooks. It could be anything… You’ll find that listening to people talk will spark ideas in subjects where you have experience.

Take, for example, edition four of The Fellowship. It was the one where I wrote about my chosen values. I was inspired to do that after listening to a podcast about values in security. Reading that edition inspired a couple of readers to actually buy my course. I wasn’t talking about my course, but it inspired them to take action.

Watching

I watch a fair amount of video content online. I am relentless. When I want to do something, I will learn how to do it, iterate on my first attempts, and make things better.

I watch YouTube videos every day. I take courses as often as possible. I invest in my personal development on top of any investment made by my company. I want to be a world-class security risk practitioner, business owner, and creator.

When I learn new things, I am filled with new ideas for content. I can take what I’ve learned and help others learn the key things from that new knowledge.

Questions

Ask questions. LinkedIn polls are great for this. Find out what other people think and why, and then you can use that as research for your own content. An absolute master at this is Dr Richard Diston.

He asks a question every Monday and then provides the answer to the question in his free email on a Friday. He’s a person who is not particularly well-liked because of the persona he plays online, but his content and courses are excellent.

Ask your readers what they want to read?

I’m a lover of community and interactions. I want to help others. I don’t want to write in a vacuum. Why would someone want to read my thoughts on subjects that don’t interest them?

They wouldn’t… To keep people interested; I need to speak to them directly. I need to give them content that they want to read. What better way to find that out than to ask them what that is?

That is why in every newsletter in the future, I plan on asking people what they would like to read. My premium subscribers will have priority, and the ones suggested by them will only be available to those who have upgraded.

Content Strategy

If writing content is something that you plan on doing, you should build a content strategy. It’s how you take an idea, stoke the fire, stir the cauldron, and execute your content idea.

A content strategy does not have to be set in stone. It can be fluid like water. It can be moulded like putty. There are no hard and fast rules. Just make it your own. Show people who you are, what you do, and how engaging with you can help them achieve their goals.

Always remember that you are creating content to help others. You’re adding value to society. Don’t just write what you want; think of your audience.

Plagiarism

While we can be inspired by other people's content, following our chosen personal values is imperative. We want people to trust us. We want to be seen as honest. Take what you need and create something new from it. Do not plagiarise other people.

If you’re using someone else’s ideas, give credit to them. If you’re using their words, quote them. One of the fastest ways to ruin your credibility and professional relationships is to take someone else’s work and pretend that it’s your own. This also goes against my values:

• To be creative

• To be ethical

• To self-actualise

Plagiarism is rife within the security industry, among others. We even have certification bodies plagiarising industry practitioners’ work. If you see it, call it out. I implore you, don’t do it yourself. It’s easier to give credit to the original creator than to fight an unwinnable battle with cancel culture.

Share The Fellowship

Updates

CyberGirls

This week has been amazing! On Wednesday, I onboarded 60 young ladies from the “CyberGirls”, an initiative created by Cybersafe Foundation, an organisation helping to train hundreds of young ladies in Africa. All 60 will now learn the foundational knowledge required to develop security policies.

Confidence Staveley, the organisation's founder, set it up to help women achieve their dreams of a career in Tech, particularly in Cyber Security. I’m very proud I can help them achieve that dream, even if it is just a tiny amount.

To be benevolent: The quality of being kind and helpful.

Earth is a tough place to live. We are all trying to do our best to survive and live in comfort. I don’t know your struggles. I don’t want to make your day harder because I have had a tough one. If I can help you, I often will if doing so does not risk my life or values. This value drives my decision to partner with @CyBlack, @Cybersafe Foundation, and @TechVets. “A rising tide lifts all ships”.

If you’d like to learn more about my chosen values and how they influence me, you can do that in the 4th Edition of “The Fellowship.”

Premium

The first person has committed to a Premium subscription this week. I spoke with them after they signed up, and they said…

If you’d like to support my efforts with The Fellowship, please consider upgrading to a premium membership.

Welcome to the seventh edition of The Fellowship Newsletter.

Last week I wrote about my journey as a writer. This week is a little different...

I am super excited to tell you that I am moving the Newsletter to SubStack. It's a platform dedicated to Writers, Blogs, Newsletters, and Podcasts. The Fellowship is already hosted there and is fully up and running.

The SubStack platform is far superior to Podia for blogging and newsletters, and it was easy to see the value it would add to the user experience and the professional look and feel of the blog site.

I have posted the first six editions of The Fellowship on the blog, and they are available for you to use as a knowledge base.

Moving to SubStack allows me to offer subscriptions to the newsletter. This is an enormous change. Do not worry; I will not be moving to a subscription-only model. If you do not want to pay, you'll still receive great content in your inbox; it might not be so often.

The ability to offer exclusive premium content incentivises me to produce content that is full of value for you. It allows me to invest in more training. It allows me to focus on the important work. It will result in some superb knowledge transfer.

Alongside the weekly blogs, there will be exclusive live webinars, pre-recorded videos, and audio recordings of some of the blogs.

Benefits & Features

Benefits

The following benefits are available based on the subscription type:

• Free Tier

  • Access to public posts

  • Preview of Premium posts

  • Access to the public archive

  • 10% discount on the Security Policy Masterclass

• Monthly Tier - £9/month

  • 7-day free trial

  • Premium subscriber-only posts

    • Blogs

    • Free access to paid webinars

    • Exclusive webinars

    • Exclusive Video content

  • Access to the full archive of all posts

  • Post comments and join the community

  • 10% Discount on all courses

• Annual Tier - £90/year

  • 17% Discount on the Monthly cost of a Premium subscription

  • Premium subscriber-only posts

    • Blogs

    • Free access to paid webinars

    • Exclusive webinars

    • Exclusive Video content

  • Access to the full archive of all posts

  • Post comments and join the community

  • 10% Discount on all courses

• The "I can expense it" Tier - £240 (suggested)

  This tier is for founding members who would like to support The Fellowship in the early stages. It's called the "I can expense it" Tier to encourage those who might have a budget from their company for Personal Development to signup. For this tier, you'll receive:

  • 30-minute coaching session with Stuart

  • Premium subscriber-only posts

    • Blogs

    • Free access to paid webinars

    • Exclusive webinars

    • Exclusive Video content

  • Access to the full archive of all posts

  • Post comments and join the community

  • 10% Discount on all courses

Features

• Better editing

• Better user experience

• Blog site to be used as a Knowledge Base

• Cleaner, more professional look to the blog

• Easier administration

• New posts are sent to Email and the Blog simultaneously

• Podcast feature

• Video feature

Change Management

Why am I making this change?

The platform I currently use for the Learning Management System initially offered email services included in the hosting price. They have changed the pricing model, and I felt that moving The Fellowship to a platform designed specifically for newsletters would be a quality upgrade.

What does this change mean for you?

On Saturday, the 29th of Jul, 2023, I will move the subscriber database to SubStack. Everyone who is a subscriber on the moving date will be loaded into the new platform as a free subscriber, and you will receive the 8th Edition of the Newsletter the next day. You may receive a welcome email on Saturday.

Please take a few minutes to read the SubStack Privacy Policy and the updated PolicyWizard Privacy Notice.

If you do not wish for your personal information to be transferred to the new platform, please take this opportunity to unsubscribe. You will find the link to do that at the bottom of the page. There will be no hard feelings. I do hope you stick around.

Next Email

The title of the following email is How to conjure up new content ideas. As requested by @Lupe Peterman.

If you'd like to suggest a future blog subject, please email info@policywizard.io or contact me on LinkedIn.

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

Hello friend,

Welcome to the sixth edition of The Fellowship Newsletter.

Last week we conducted a skills audit. This week, I was going to write about the application process and how to write a good CV. I feel like this has been flogged to death. I would only be adding noise.

If you’d like information on that stuff, I recommend the CV Template by Stephen Semmelroth. He’s an awesome guy who owned a Cyber recruitment company before selling it. You can read some of my tips and find the link to his template on my TechSecScot website.

This week I made a huge decision. I am going to write a book.

Becoming a writer

When I was in school, I was terrible at writing. One summer, when I was ten, my father made it his mission to teach me how to write. My dad would go to his desk daily and remove an A4 writing pad. At the top of the page, he would write a title and the first sentence. It was my task to conjure up a story from my imagination.

I would spend two hours in the morning writing. It did not matter what it was that I was writing. All that mattered was that I was putting pencil to paper, forming sentences, building characters, and telling tales of catching colossal fish, winning at rugby, and climbing enormous mountains. You know, the weird stuff that a 10-year-old boy might write about.

I wouldn’t say I liked the task. I would often sit at the kitchen table, being battered by the sun through the large sliding glass door into the garden. My friends were on their bikes, playing football or catching minnows down the local stream. I was missing out on my time to play. This torture would persist for seven weeks.

The improvement in my writing was incredible. My teacher called my parents to the school to talk to them about my magical improvement over the summer holidays. I had hated every minute of my time at the kitchen table that summer, even though it had proved fruitful.  

British Army

When I was in the army, one of my jobs was to do the administration for the unit. One of the requirements was to write the daily and weekly orders for the unit commander. Essentially, I would write a daily policy that the team of over one hundred and fifty soldiers would read. It was one of the methods that the army used to document what orders had been given.

This is where I would cut my teeth on writing policies to influence behaviour. I worked out recently that in the seven years, I held that position, I would have written nearly one thousand policies for the army. 

A year under the Golden Arches

Most of you know I was a Door Supervisor. I worked for a company contracted to provide bouncers at various venues throughout Edinburgh City Centre. I worked at Market Stalls guarding them from the drunks in the small hours. I worked at public houses and nightclubs. I also worked at fast-food “restaurants”.

As you might be able to imagine, the wee small hours provide much violence, debauchery, impropriety, and entertainment. At 0300 hours, six nightclubs would vacate within a quarter mile of the venue. At that time of the morning, and with a stomach full of alcohol, the patrons of the nightclubs would make their way en-mass to “get some nuggets”. This would lead to over four hundred drunks turning up at our venue, all trying to get some food.

This type of work was stressful. Writing short stories about my shifts on the door, “under the golden arches,” was a method I used to relieve the stress of the work. I posted them to my friends on Facebook, and they became popular.

One of my friends (Sam) was a lecturer at a famous Scottish university. Without me knowing, he scraped these stories from my profile and turned them into a manuscript and had it published. He gifted the book to me on my birthday.

This gift was one of the most thoughtful things another human has done for me. I’m not ashamed to admit it made me tear up a little. I still have the book on my bookshelf. I will treasure it until the day that I return to the earth. 

Security Policy & Awareness

For the last two years, I have been on a journey, learning to influence behaviour by writing principle-based policies. I control over fifty documents and improve the writing and effectiveness each time something changes. Each iteration improves the documents and gives clear, positive, respectful messages. I’m still learning the craft. I think I will be until I retire. I enjoy writing a good policy and have much knowledge and experience to share. That led me to start PolicyWizard. 

Masterclass

After completing the Security Policy Foundations course, I began working on the content for the Security Policy Masterclass. I sat at the computer late at night, just like I’m doing now, and compiled sixty-eight pages of content. I was trying to formulate a book to go along with the course. I was going about it wrong. It never quite felt right. I wasn’t passionate about it. I love the content and teaching, but it didn’t feel right. I paused that effort. I will return to it soon, but it will be in a different format. 

My new book

I will keep the book a secret as the International Standard Book Number (ISBN) has yet to be confirmed. This book will not be theoretical. It will be story-based, bringing the policy writing discipline to life through words and magic.

As inspiration, I created the front cover of the book. It was super easy using Canva. I was not expecting to make something good. I hoped for something I could look at when I didn’t feel like sitting at the desk for a few hours. Something to make me want to do the hard work.

Little did I know I would produce something that could sit proudly on any CISO or Security Consultants desk or bookshelf. I’m not sharing that cover until everything is confirmed and registered. That day will not be too far in the distance.

Coaching Flash Sale

Here is a coupon code for 30% off the £97 fee for a 1:1 sixty-minute session with me. A few spaces are available next Saturday, but you can book anytime in the next year if you buy. Click the link, and it will auto-apply the discount for you.

Here is what Alana had to say about our session:

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

Welcome to the fifth edition of The Fellowship Newsletter.

Conducting a skills audit

Before we can conduct a skills audit, we need to know more about what a skills audit is. For the fun of it, I’m going to use an analogy.

I drove an old Honda Civic; it was a great car. Honda Civic have an excellent reputation for being reliable. I found one with a full-service history and very few findings during its annual testing. I commuted in that car for a couple of years. The journey took an hour each way.

Well, that car reached the grand old age of 22. I took it for testing as required by law. It failed the test. Several things were wrong, and it would cost a lot to fix. More than the car was worth. I decided to scrap the vehicle. As a result, I do not have wheels to get me where I want to go. I could take this story into how I chose a new car here, but that’s too obvious… Let’s go for a walk.

I changed jobs a couple of years ago and now work from home. That meant I didn’t need to rush the purchase of a new car. I could take my time. I live about a 40-minute walk from the local shop. It’s a small Tesco at the other end of the town. I live about a ¼ mile from the nearest bus stop.

Tesco delivers, and I would make use of that for the bigger things. But we wanted to ensure we got the correct meal ingredients. The pickers on home delivery orders often make substitutions when the item on the list is unavailable. Those substitutions were often things that we did not want. I would have to walk to the shop and get the right ingredients.

My partner would tell me what to get, and I would take a walk and bring the groceries home. Frequently I would make mistakes. I’d forget the mince, or I’d get the wrong sauce. To prevent further errors, I was given a list of things to go and get. A shopping list of the required items. This ensured that we would have the right ingredients before we started cooking.

Can you see where I’m going with this?

Think of that shopping list as the required ingredients for any job. The Hiring Manager has provided the Recruiter with a list of skills and experience that they use to cook up their next hire. That list is what all applicants are assessed against. If we want to be invited for an interview, we need to show in our CV/Resume that we have the skills and experience on the list. That is where a skills audit comes in.

Q: What is a Skills Audit?

A: It is a self-assessment an applicant carries out against multiple job descriptions of the same type to prepare themselves for the application process.

How to conduct a skills audit?

A skills audit is easy, but it does take some time. What you need to do is to open Excel. Create a table with 20 Columns and 11 Rows. The columns are where you list the skills, and the first row is where you list the job title (you can also put in a link to the job). Then open LinkedIn Jobs and run a search on your desired future role. I would suggest using the most common title for the job.

Then you need to list the top 10 skills in each of the first job descriptions that match the job title. Here is an example:

Job Requirements (Things you will be doing)

Experience Requirements (Things you can show that you have done)

The Skills Audit

This is the crucial bit. This is how you conduct the audit and assess where your skillset meets the requirements. You need to go through your worksheet and either change the colour of the text or fill in the cell where you have the skills.

After you have done this, you can easily see the jobs where you meet 70% of the requirements. I would encourage you to apply for those jobs.

You will also see where you do not meet 70% of the requirements. Aiming for these jobs but working on your skillset to meet the conditions would be best. Hit the magic 70% mark before you apply.

That’s it! That’s how you conduct a skills audit. I hope you have found this helpful. It should help you out if you’re applying for jobs, no matter where you are in your career.

Do you know the top requested GRC skill? 

Whenever I conduct a skills audit for GRC Analyst or Information Security Analyst, it’s “creating security policies and procedures” that comes out on top. In my most recent search, 18/20 GRC Analyst advertisements required applicants to develop security policies proficiently.

If you want to learn that skill, you should consider some training in that area. Turn that box green and then focus on the others.

The Security Policy Foundations course is available to work on at your own pace. The course is priced @ £47.

On this learning opportunity, you will be able to achieve a certificate of completion, and you’ll be able to use two policies that you produce in the practical labs to evidence your skills. Only on the Live Webinar can you ask me questions directly.

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

Stuart W / PolicyWizard.io Office 101096, PO Box 26965, Glasgow, G1 9BW

Unsubscribe

Hello friend,

Welcome to the fourth edition of The Fellowship Newsletter.

Today we talk about Values.

There has been much talk in the industry lately about ethics, missions, principles, values, and visions. In “security”, we are the ones people trust to prevent unwanted behaviour harming our customers, staff, and value-generating processes.

I’m a military veteran and a Security Risk Practitioner who worked in the physical side of the industry before moving into Information Security. While I have only been in InfoSec for a few years, I have been around the block a bit. I served nine years in the British Army and five years in physical security.

I do my job, and I do it well. People trust me because I am trustworthy. I have never given any of my employers or colleagues a reason to question my motives. My service has always been exemplary. Specific personal values are ingrained into my psyche that I live by. These values guide me through life and assist me when making choices.

These values come from many different places. Some were drilled into me in the army. Others were instilled into my life by loving parents. The important ones are the values that I have chosen for myself. It doesn’t matter where they entered my life. What matters is how they influence my behaviour and my actions. I have never written about them, so I am doing that today.

My Chosen Values

Let’s make this alphabetical because I can’t stand lists that aren’t.

To be accessible and inclusive: Able to be reached or easily obtained by all people.

I have always been aware of people who struggle to access buildings and services due to circumstances outside their control. It was only recently that I was encouraged to investigate this more. We need good people in the fight against Cybercrime. Your skin colour or lack of sight should not stop you from using your knowledge and abilities as a force for good. I will provide and encourage others to provide accessible and inclusive products and services.

To be accountable: The fact of being responsible for what you do and being able to give a satisfactory reason for it or the degree to which this happens.

I have made mistakes in life and my work; people always do. I am not perfect. The important thing for me is to hold myself accountable for my choices and actions. If I make a terrible choice, I will own it, learn from it, rectify any issues if they arise, and try not to repeat the same mistake.

To be benevolent: The quality of being kind and helpful.

Earth is a tough place to live. We are all trying to do our best to survive and live in comfort. I don’t know your struggles. I don’t want to make your day harder because I have had a tough one. If I can help you, I often will if doing so does not risk my life or values. This value drives my decision to partner with @CyBlack, @Cybersafe Foundation, and @TechVets. “A rising tide lifts all ships”.

To be courageous: Having or showing courage (the ability to control your fear in a dangerous or difficult situation).

Courage is not bravery. People mix this up all the time. Facing down a terrorist. Storming a beach in a war. That’s bravery. I’m talking about having the guts to do something your head is saying not to. Things like public speaking. Standing in front of a room of your peers and talking passionately about your work. That’s courageous. It could be doing something that might make you look stupid or foolish. It’s knowing the stakes are high but doing the thing anyway.

To be creative: Producing or using original and unusual ideas.

I like to build things. To create something that brings happiness to others, value to society, and satisfaction or value to my life. Creativity is enormous when we consider the common good. I have put smiles on the faces of thousands of people up and down the UK as a fire performer 🔥.

Being creative is also a massive driver for PolicyWizard. I have knowledge that can help others gain employment, improve security policies at their new employer, mitigate security risks, and prevent harm. I can only write a finite number of policies. If I teach 10,000 people to do it in the next 15 years, that impact is exponentially enormous.

To be ethical: Relating to beliefs about what is morally right and wrong (Morally: Based on principles that you or people generally consider right, honest, or acceptable).

This value does not require much explanation. When confronted with a decision, I will always act morally. I will use my values as a guide to make an ethical decision.

To be non-violent: Not involving fighting or the use of physical force.

As a military veteran and an ex-bouncer, this value surprises people. I don’t enjoy violence. I don’t like watching it, and I certainly don’t like taking part. I have been violent, and I have received violence. It’s part and parcel of growing up in a rough area and a huge part of military life.

I decided to refrain from using violence when I left the military. I became a father and wanted to show my kids that they didn’t need to live a life of violence. In my five years as a bouncer, I used non-violent communication and conflict resolution techniques to prevent violence. I became renowned for my cool head, proactive intervention, calm manner, and patience. I continue to use non-violent communication in my life.

This value does not prevent me from defending myself or others. Violence is an option; it’s one that I hope never to have to use again.

To be respectful: Showing politeness or honour to someone or something. (Honour: A quality that combines respect, being proud, and honesty.)

I respect myself and give respect to all others without question. When someone disrespects me, I will act with honour. We cannot control other people’s behaviour; we can only control how we react.

To self-actualise: A person’s desire to use all their abilities to achieve and be everything that they possibly can.

This value drives me forward. It makes me relentless. I have a vision for my future and am working incredibly hard to ensure it happens. That drive sees me writing a newsletter and dissecting my chosen values on a Saturday night. If doing this helps me to achieve my goals, the juice is worth the squeeze.

Final thoughts

Having solid values is how you build the foundations of a trusted relationship. As security practitioners, we should all look inside and determine our values. Hopefully, you have a bunch of good ones. We need people with good values. What values have you chosen? Consider writing a LinkedIn post about this newsletter and your values, and tag me if you do. I’d love to know 🙂.

New Services

Things have changed a bit on the PolicyWizard website. There are now two clear routes for everyone who reaches the home page. One for those that would like to learn at Wizard School, and one for those that would like Consultant. Take a look and let me know what you think.

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

Hello friend,

Welcome to the third edition of The Fellowship Newsletter. 

This week, we cover Public Speaking.

Ever since I was a boy, I have struggled to stand up in front of groups of people and speak confidently. I had a stutter. The doctor said I had so much on my brain that my tongue struggled to keep up. “He’ll grow out of it”. 

Well, that was utter rubbish. I didn’t grow out of it. I still have a stutter. It’s not a confidence thing. I can stutter even when I’m perfectly comfortable and happy. In everyday life, I have learned to mask it. It’s so hidden that you’d probably never have known if you hadn’t read this. 

Over the last two years working remotely and listening to other people talking in meetings, I realised that most people struggle with filler words. I um and ahhhh, just like everyone else. I’m not unique in that. I differ because I use pauses to prevent me from tripping over my words or stumbling like a scratched CD. 

I have been trying to build confidence in this area for years. So, I set myself the goal of actively improving my public speaking by the end of 2023. Nobody would want a meek instructor who stutters, mumbles, and mutters. Building my public speaking knowledge was the first thing I had to do. I set about watching hours of YouTube videos about the subject. 

I attended a few sessions at a local public speaking group and gave what the chair said was “The best first speech I have watched”. I can stand up and give a great talk. I’ve been doing it for years. I was a team leader in the military. I’ve been a survival instructor, a circus instructor, and a group leader for a performing arts group. Each time I stand before a group to speak, I die a little inside. 

How does public speaking make you feel?

If I wanted to be a good instructor, security practitioner, and leader, I needed to figure this out. I needed to be able to feel confident when delivering a talk. I am confident in 99% of the things I do in life. 

I’ve stood my ground when face to face with big wild animals; I’ve been to war, and I’ve performed solo in front of 10,000 people as a fire performer. I’ve also been a bouncer. I can stand my ground and even resolve conflict verbally when faced with aggression from people. I don’t lack confidence unless I’m speaking to groups.

Finding my confidence

During one of the sessions watching TEDx talks, I found one called “How to avoid death By PowerPoint”. It was a Swedish man named David JP Phillips who gave one of the best speeches I had ever heard. It was all about making your PowerPoint slides in a way that added to your presentation, not being the focus of them. I was captivated. I went down the rabbit hole, watching lots of his content.

In March this year, I had the opportunity to attend a free 5 Day public speaking challenge hosted by David. It was an online webinar format where he spoke for an hour each day about how different chemicals in the brain affect how we feel when public speaking. Here is the gist of the five days…

Endorphins

Endorphins are triggered by laughing. Think of a funny story or something that has happened to you that makes you laugh. Watch a short playlist of videos that make your belly laugh. If you feel happier, you’ll deliver your message much better.

Dopamine

The brain works better when it’s full of dopamine. If you give it dopamine, it feeds additional dopamine. You’ll feel less nervous and more relaxed if you can fill your brain with it before a presentation. Motivation gives you dopamine. What is your reason for giving the speech?

Oxytocin

This chemical is the body’s natural method of bonding and controlling stress. You can produce additional oxytocin by looking at family photos, watching sad videos, tearing up, making slow eye movements and feeling empathy, humanity, and care.

Testosterone

Testosterone is raised by winning at sports, anything where you feel powerful, strong, or in danger. Increasing your base volume by 10-20% can give you a 10% boost in testosterone. This additional boost gives you extra confidence in yourself. Stand in a power pose. Roar at the sky. These will all give you a boost.

Serotonin

This is the chemical you feel when you are proud. Look at video testimonials and reviews of your work. Videos of you being badass, videos of you as a presenter and feeling genuinely proud of a friend’s success.

These five chemicals will all enhance your ability as a public speaker. If you struggle with it, set yourself up 5-10 minutes before your meeting to inject the positive chemicals. Watch funny videos, roar at the sky, and speak from the chest.

Now let’s look at the bad one…

Cortisol

You’ll feel pain, fear, and suffering if your system has high cortisol levels. If you don’t control the other 5, the brain resorts to injecting this, and you’ll struggle to perform your best. 

5 Tips to beat cortisol.

1. Convert it to dopamine!

2. Oxytocin will beat cortisol.

3. Change how you speak to yourself. You’re not nervous; you’re excited!

4. Re-appraise your pain. Choose your feelings. Don’t let cortisol tell you how you feel.

5. Nail your beginning.

Putting it into practice

There is much more to my public speaking journey over the last six months. I intend to tell it in future Newsletters. Before I close out this one, I want to say that I put all the learning together for a presentation my manager asked me to do. I presented my policy strategy to the 20+ people in our security team. 

I’ve been working on my strategy for the last month or two. I am targeting risk scenarios with security policies to close our gaps, changing the language in our messaging to be more positive/respectful while evolving from a rule-based policy culture to a principle-based one.   

The presentation was last Wednesday, and I gave the presentation of my life!

I seriously rocked it. I was confident, clear, and eloquent. There were no filler words…

It blew my mind!!!

The CISO said that it was “An excellent presentation”. He thought it was so good that he would present my strategy for principle-based policies to a CISO council in the next few weeks. 

My manager said he felt “Energised”, and the Project Manager said she was “Captivated” by my presentation. 

I had a little help. Julie Hardesty is a Public Speaking Coach working for Infor. She agreed to be my mentor as part of an internal mentoring program run by the company. Julie helped me find the points of emphasis and found the bits where I could show the real impact of my work. Without her, it would not have been anywhere near as good as it was.

Julie is on LinkedIn and is just starting as a freelance Public Speaking coach. If you’re looking to progress in your career and you have a big presentation coming up, give Julie a DM. She can help you add the magic 🎤🔥. If there is one thing you take from this, let it be that if I can give a superb presentation, you can too. 

Until the next adventure!

Stuart Wedge

PolicyWizard

This week has been excellent. On Monday, I was informed that a new version of the NIS Directive was coming into play. The original NIS Directive was published in 2016. It concerns the Security of Network Information Systems. NIS 2 Directive was published in 2022 and expanded the controls further.

NIS 2 Directive – A Breakdown 

I had planned on including some content on the NIS Directive. So having a new one to work with is great! Fresh new content that most people don’t know about. It will be a great addition to the Practical GRC course. 

It’s always best to work methodically when learning a new Regulation, Directive, Law, Standard, or Framework. You need to get your eyes on the document. This is the bible regarding what you are trying to learn. Occasionally, a paywall is a blocker. 

I am using the ISO 27001 standard as an example. To read that document, you need to purchase it from ISO. It’s not cheap either. For my recent ISO 27005 class, I was required to have three different ISO standards as pre-requisite reading. Luckily, my company funded the course and the reading material as part of my CPD. Most of these types of documents are freely available online.

Once you have the document, to understand it fully, you’ll need to read it. There are, however, some quick ways to get to the bottom of the requirements.

First things first:

Search on YouTube for an explainer video. Many different Information Security companies will be using the new regulation (etc.) to gain new customers by selling their solutions to any new requirements that have been introduced.

Make notes on all the key points from the videos and then confirm that each point is visible in the document and that the words in the video reflect the document's requirements. The last thing you want to do is learn from a video and then find out after doing some work that the information needs to be corrected. Verify everything!

If a suitable quality video is unavailable, use “Ctrl + F”. It’s the Microsoft Shortcut that brings up a “Find” box. It allows you to search for words or phrases. It is beneficial and can reduce this process by more than 50%.

Here are the key things that you need to find out in your initial familiarisation session:

Issuer

Who introduced the new Regulation, Directive, Law, Standard, or Framework?

Scope

The geographical region where the new Regulation, Directive, Law, Standard, or Framework applies.

The intended target audience. These are the people, businesses, organisations, or groups affected by the new Regulation, Directive, Law, Standard, or Framework.

If it applies to a region (e.g., The EU), does it apply to organisations outside the region that interact or do business with the Citizens of the region?

Previous Version

Does the new Regulation, Directive, Law, Standard, or Framework replace an older version?

Effective date

This is when the new Regulation, Directive, Law, Standard, or Framework comes into force.

Abbreviations

Understand the abbreviations used. Usually, these documents have a definitions section dedicated to clarifying the meanings of abbreviations or uncommon words.

Purpose

What is the purpose of the new Regulation, Directive, Law, Standard, or Framework? Why is it being introduced?

What are the requirements?

Does the new Regulation, Directive, Law, Standard, or Framework set out something to be done or restrict something from being done?

What are the implications for you or the organisation that you work for?

This might be the time to start looking at doing a gap analysis.

Compliance Checking/Enforcement

Who is liable to be checked for their compliance status?

Who is responsible for checking the compliance status?

Is Certification (if available) optional or compulsory?

If Certification is available, who is the Certification Body?

Consequences of non-compliance

What is the potential impact of any fines or criminal charges?

Who is Liable?

Is executive management personally liable? Or is the Organisation fully accountable for any actions against it?

That’s it for this week’s edition of “The Fellowship”. I hope you take this new knowledge and set yourself the task of understanding a Regulation, Directive, Law, Standard, or Framework you do not have experience with.

Some of you might have seen it; others may not have. I created a 51-page carousel and posted it to LinkedIn on Wednesday. You could also pick it up from my website as a digital download if you missed it. Click the link: NIS 2 Directive – A Breakdown. Share the link with people at your business who might need to know about the changes to the NIS Directive.

Until the next adventure!

Stuart Wedge 🧙‍♂️

PolicyWizard

Newsletter

As the number of people on this mailing list is nearing 1000, I want to add more value to the people on it. I put up a poll on LinkedIn asking if people would like a Newsletter from me. The response was overwhelmingly positive, so I launched “The Fellowship” Newsletter. The first edition of it is below. I hope you will be happy to receive more regular emails from me. It will not be sales-focused but will share knowledge and stories of what I am doing. Stories about fighting the GRC Monsters. This first edition of the Newsletter details my story and why I work in Security.

The Fellowship Newsletter

What is a Fellowship?

Fellowship
fĕl′ō-shĭp″
Noun
👉 The companionship of individuals in a congenial atmosphere and on equal terms. 
👉  Friendship; comradeship. 
👉  A close association of friends or equals sharing similar interests. 
(Wordnik)

I have called the newsletter “The Fellowship”. Yes, it shows a little love for the Lord of the Rings, but more than that, it gives this Newsletter a purpose. 
The Newsletter communicates knowledge, stories, and anecdotes with my friends, companions, and associates. Topics I will cover include (but are not limited to):
Current activities, Security Policy, Security Risk, GRC Skills, building a security consultancy, a training platform, an online course, Writing a book, My journey, Etc... 
This email introduces who I am, what I do, and how you can work with me if you want to.

Who am I? 

Stuart Wedge

What do I do?

Security Policy Writer
Security Risk Practitioner

What have I done?

Military Veteran 
Animal Tracker
Bushcraft & Survival Instructor
Fire Performer

Why do I work in Information Security?

I was challenged on this recently. I said, “I joined the Army at 16 because I watched what was happening on the news in Bosnia, and I wanted to stand between the people doing harm and those being harmed.”The person said, “That’s a condition. It’s called a Hero Complex.”
I was fully aware of that. In the Army, we called it “Superman Syndrome”. It’s not that I wanted to be a hero. For me, it was that I detest violence, especially against those who cannot defend themselves. If I were able to help, I would do it.
After leaving the Army, I worked as a Satellite Dish Fitter. But when the digital switchover happened, my work stopped overnight. Most people have the means to watch Digital TV. I needed to find another source of income.
I fell into Physical Security. I got my Door Supervisor licence and found work as a bouncer in Edinburgh. I have many stories from that time of my life. A friend even turned a year of my Facebook posts into a book!
Jumping back to the reason I do what I do…
The person challenged me: “Do you really think, as a security function, we can keep people safe?”

My answer

“As a security function; I don’t think we can keep people safe. What we can do is to help them make better decisions.” 

That is what I am doing in my work. I am helping to reduce the impact and frequency of accidental data loss caused by people not doing what they are meant to with data. Implementing policies that change how security controls are administered and managed. Improving the quality of the authority documents to enable people to understand what is meant to be done.

Here is the key message I use in everything I do:

✅ If we get the policies right, we get the message right. 
✅ If we get the message right, we get engagement.
✅ If we get engagement, we get action. 
✅ If we get action, we get progress. 
  
It doesn’t matter if it’s your first month as a GRC Analyst or if you are fifteen years into your career and starting your first CISO position. Using Security Policies is how we implement our security controls, build our strong security posture, and put that new Security Strategy into effect.

If you’d like to work with me

👉 Book a Call
👉 Check out my courses
👉 Hire me to Consult for your business

Thank you for joining this Newsletter. I very much hope that you enjoy the content.
If you don’t, please unsubscribe. I know that I will not please everyone.

Privacy

Don’t worry; I will not send loads of spam, and your details are never sold to other companies. I’m a big fan of GDPR, and if you read the Privacy Notice, you’ll understand that a little bit more than you do now.   

Stuart Wedge
PolicyWizard 🧙‍♂️