Fast-growing companies in regulated industries tend to have plenty of security activity. Somebody runs the endpoint tool, somebody else handles access reviews, and there’s a policy document from a few years ago. What they usually don’t have is a system: one framework, named owners, and a plan everyone has rehearsed before the bad day arrives.
That was the starting point here, with regulators and customers expecting all three.
Don’t invent a framework
The first decision was to adopt a recognized national cyber security framework rather than write our own. Frameworks have flaws, but they give you three things you can’t easily build yourself:
- A shared vocabulary that auditors, insurers and the board already understand.
- Maturity levels, so you can say exactly where you are and where you’re aiming, instead of “we’re pretty secure.”
- A built-in priority order. The controls that stop the most common attacks come first.
From there it was a gap analysis: map every existing control to the framework, mark each one as implemented, partial or missing, and give every gap an owner and a date. The output was a living control register, not a slide deck.
Making ownership real
A control without an owner is a hope. Every control got:
- A named owner, a person rather than a team.
- A review cadence, with automated evidence wherever possible.
- An evidence source that proves it’s working: a dashboard, a report or an API.
This is where tooling earned its keep. A compliance automation platform pulled evidence straight from cloud accounts, the identity provider and endpoint protection. “Are all laptops encrypted?” stopped being a once-a-year spreadsheet and became a live check that alerts when it drifts. The same evidence base supported the move toward ISO 27001:2022 and SOC requirements, so one effort served several audits.
Incident response you can run at 2am
The heart of the work was incident response. The goal was a process a tired person could follow at 2am without having to think about process:
- SEV-1: customer or regulated data at risk, or a full outage. The incident lead is paged immediately, and executives and legal are notified.
- SEV-2: a contained security event with partial impact. The incident lead engages within 30 minutes, with stakeholder updates every hour.
- SEV-3: suspicious activity with no confirmed impact. Triaged during business hours and tracked to closure.
Every severity level has a defined incident lead, a communications owner and pre-written templates for internal, customer and regulator messages. Each common scenario got its own runbook: compromised credentials, malware on an endpoint, an exposed secret, a suspicious cloud API call. Each runbook covers detection, containment, eradication, recovery and evidence preservation.
Practice before it’s real
Plans that have never been exercised fail in predictable ways: nobody knows who has authority to take a system offline, the contact list is out of date, and the comms template refers to a tool you migrated away from.
So we ran tabletop exercises regularly. We walked a realistic scenario through the room, injected complications (“the incident lead is on a plane”) and wrote down every place the plan broke. Each exercise produced a short list of fixes.
Then real incidents happened, as they always do. The difference was that the team had done it before. People knew their roles, decisions were made quickly, and the post-incident review (blameless, focused on the system and not the individual) fed straight back into the runbooks.
Growing security skills across the team
A security function that lives in one person’s head doesn’t scale. Alongside the framework, we deliberately built security capability across the wider engineering and IT team. Engineers joined exercises, owned controls in their own areas and took on security work as part of normal development goals.
What I’d tell another team
- Adopt a framework. It’s not perfect, but your auditors, insurers and board already speak it.
- One owner per control, with automated evidence. Anything manual will drift.
- Write runbooks for a tired person, then test them with tabletop exercises.
- Run blameless reviews, and actually change the runbooks afterwards.