Turning around a federal security program in six months
Ineffective→EffectiveFISMA rating · 6 months
The situation
The organization's information security program had been rated Ineffective in its annual FISMA assessment.
What I changed
I restructured the security team and built out core capabilities in risk management, vulnerability management, secure software delivery, identity and access, and security monitoring.
The result
Within six months the program was rated Effective.
