Description

This curriculum spans the equivalent of a multi-workshop advisory engagement, guiding organizations through the structural, operational, and governance shifts required to embed ISO 22361 across corporate security functions, from initial scoping to sustained maturity.

Module 1: Establishing the Foundation for ISO 22361 in Security Governance

Define the scope of security services to be governed under ISO 22361, including physical, cyber, and personnel security functions.
Select leadership roles accountable for service governance, ensuring clear separation from operational delivery teams.
Map existing security service agreements against ISO 22361’s service leadership principles to identify gaps in accountability.
Determine whether internal security departments or third-party providers will be governed under the framework.
Establish criteria for classifying critical security services based on organizational impact and regulatory exposure.
Develop a governance charter that outlines authority, escalation paths, and decision rights for service leadership.
Align ISO 22361 implementation with existing enterprise governance frameworks such as COBIT or ISO/IEC 38500.
Secure board-level endorsement for governance changes that may affect budgeting or reporting lines.

Module 2: Defining Security Service Leadership Structures

Design a service leadership committee with representation from legal, risk, operations, and security functions.
Assign ownership of specific security services (e.g., access control, incident response) to designated leaders.
Implement a RACI matrix to clarify Responsible, Accountable, Consulted, and Informed roles across service domains.
Decide whether centralized or decentralized service leadership better supports organizational agility and control.
Integrate external stakeholder expectations (e.g., regulators, insurers) into leadership decision-making protocols.
Document service leadership responsibilities in job descriptions and performance evaluation criteria.
Establish meeting rhythms and reporting templates for service leadership reviews.
Define thresholds for leadership intervention in service performance deviations.

Module 3: Strategic Alignment of Security Services

Conduct a gap analysis between current security service delivery and business continuity requirements.
Translate organizational risk appetite into service-level objectives for detection, response, and recovery.
Prioritize security service investments based on alignment with strategic initiatives (e.g., digital transformation).
Develop a multi-year roadmap for service capability maturity aligned with ISO 22361’s continuous improvement cycle.
Negotiate service-level agreements (SLAs) that reflect business-critical uptime and response time requirements.
Integrate security service planning into enterprise IT and facilities capital planning cycles.
Assess the impact of geopolitical risks on service delivery models and adjust strategy accordingly.
Validate that service objectives support compliance with sector-specific regulations (e.g., NIS2, HIPAA).

Module 4: Designing Security Service Portfolios

Inventory all active security services, including shadow services operated outside formal governance.
Categorize services into core, supporting, and discretionary based on business impact and cost.
Decide which services to retire, consolidate, or outsource based on performance and strategic relevance.
Define service naming conventions and metadata standards for consistent cataloging.
Establish criteria for adding new services to the portfolio, including cost-benefit and risk assessments.
Implement a service request intake process with governance oversight for ad hoc demands.
Link service portfolio data to financial systems for accurate cost attribution and chargeback modeling.
Conduct annual portfolio reviews to ensure alignment with evolving business models.

Module 5: Implementing Service Performance Measurement

Select KPIs that reflect both operational effectiveness (e.g., alarm resolution time) and governance outcomes (e.g., audit compliance rate).
Define baseline performance metrics before initiating governance improvements.
Deploy monitoring tools capable of collecting real-time data from physical and digital security systems.
Set performance thresholds that trigger formal review or remediation processes.
Balance leading and lagging indicators to anticipate issues versus measuring historical outcomes.
Ensure performance data is segmented by location, service type, and provider for comparative analysis.
Integrate performance dashboards into executive reporting cycles with standardized governance views.
Validate data accuracy through periodic audits of monitoring systems and reporting logic.

Module 6: Managing Security Service Risks and Compliance

Conduct service-specific risk assessments that evaluate threats to availability, integrity, and confidentiality.
Map controls in ISO 22361 to existing compliance obligations (e.g., GDPR, SOX) to avoid duplication.
Implement a risk register that tracks service-level vulnerabilities and mitigation timelines.
Define escalation procedures for service disruptions that exceed predefined risk tolerances.
Require third-party security providers to submit audit reports and evidence of control effectiveness.
Conduct tabletop exercises to test governance response to service failures or breaches.
Document risk treatment decisions, including acceptance, transfer, or mitigation, with leadership sign-off.
Align service risk reporting with enterprise risk management (ERM) frameworks and board reporting cycles.

Module 7: Ensuring Stakeholder Engagement and Communication

Identify key stakeholders for each security service, including business unit managers and legal counsel.
Develop communication plans for service changes, outages, or policy updates with defined channels and timing.
Establish feedback mechanisms (e.g., service advisory boards) to capture stakeholder input on service quality.
Train service leaders to communicate technical issues in business-relevant terms during executive briefings.
Document service expectations and limitations in user-facing service guides and intranet portals.
Manage conflicting stakeholder demands by applying governance criteria for prioritization and trade-offs.
Conduct periodic satisfaction surveys with structured analysis of results and action planning.
Ensure communication protocols comply with disclosure restrictions in regulated environments.

Module 8: Driving Continuous Service Improvement

Implement a structured process for capturing service improvement ideas from operators and users.
Use root cause analysis (e.g., 5 Whys, fishbone diagrams) to address recurring service failures.
Assign improvement initiatives to service owners with defined timelines and success criteria.
Conduct post-implementation reviews after major service changes to assess governance effectiveness.
Benchmark service performance against industry peers or ISO 22361 best practice examples.
Integrate lessons learned from audits, incidents, and compliance findings into improvement planning.
Allocate dedicated budget and resources for continuous improvement activities.
Report improvement outcomes to governance committees with recommendations for scaling or adjustment.

Module 9: Integrating Technology and Automation in Governance

Evaluate governance, risk, and compliance (GRC) platforms for compatibility with existing security systems.
Automate data collection from access control, CCTV, and SIEM systems for performance reporting.
Implement workflow tools to manage service requests, change approvals, and audit trails.
Define API requirements for integrating third-party security service providers into governance platforms.
Ensure automated systems maintain data integrity and are protected against unauthorized modification.
Use dashboards to provide real-time visibility into service health and governance compliance.
Establish access controls for governance systems based on role-based permissions and least privilege.
Plan for system redundancy and backup of governance-critical data to prevent decision paralysis.

Module 10: Auditing and Sustaining Governance Maturity

Develop an internal audit schedule focused on ISO 22361 compliance across all security services.
Train auditors to assess both documentation and operational adherence to governance processes.
Conduct maturity assessments using ISO 22361’s capability levels to track progress over time.
Address audit findings with corrective action plans that include root cause and timeline for resolution.
Prepare for external certification audits by validating evidence trails and control implementation.
Rotate audit responsibilities to prevent familiarity bias and ensure objective evaluations.
Use audit results to refine governance policies, training, and performance metrics.
Institutionalize governance practices through policies, system configurations, and organizational routines.