Free guidee-book

Comprehensive Guide to Developing and Implementing a Cybersecurity Plan

A free LabLynx e-book on developing and implementing a cybersecurity plan, from regulations and standards frameworks to a 10-step method and NIST SP 800-53 controls.

By Brandon Holland, Marketing & Operations Digital Solutions ArchitectPublished July 2020Updated March 2023

Comprehensive Guide to Developing and Implementing a Cybersecurity Plan, a free guide from LabLynx

Get your free copy

e-book
Instant download

"*" indicates required fields

We also email you the link.

A cybersecurity plan is a developed, distributed, reviewed, updated and protected collection of assessments, requirements, controls, goals, policies and metrics that shapes how an organization protects against and responds to cybersecurity threats. This LabLynx guide walks through writing one in 10 steps, built on NIST SP 800-53, with a slight lean toward laboratories implementing information systems.

What you will learn

A 10-step method for writing the plan. From strategic goals and scope to performance indicators, response plans and review.
Which rules and standards apply to you. Why the answer is specific to each organization, and how to identify your own obligations.
How to choose and fit a framework. Control, program and risk frameworks, and how to map their controls to your objectives.
NIST SP 800-53 controls in plain words. A simplified appendix of controls across 20 families, from access control to supply chain risk.
How to plan for incidents. Communication, incident response and business continuity plans that work together.

What is inside the guide

From why a plan matters to a 10-step method and a plain-language appendix of NIST controls: here is what the guide covers.

What a cybersecurity plan is and why you need it
Cybercrime reaches organizations of every size, from law firms to automotive manufacturers, and the guide finds many of them without an up-to-date strategy or any plan at all. The guide defines a cybersecurity plan and explains why developing one takes expertise, resources and diligence, often several months of work.
Go deeper: Lab cybersecurity
The regulations and standards that drive cybersecurity
Which rules apply depends on industry, geography and even local requirements: one data retention requirement alone ties to more than 100 regulations, standards and guidance documents. The guide names laws that mandate cybersecurity action, such as HIPAA and GDPR, and explains why well-designed standards make regulations easier to meet.
Go deeper: HIPAA compliance in the laboratory
Standards frameworks and how they fit a plan
A framework adds policy, procedure and process to a set of standards, and the guide sorts frameworks into control, program and risk types, with a table of more than 30 examples. It then shows how a framework guides a plan: map your requirements and objectives to its controls, compare the result with how you operate today, and customize where needed.
NIST SP 800-53 and the NIST Cybersecurity Framework
The guide leans on NIST SP 800-53, Revision 5 for its thoroughness: a catalog of security and privacy controls in 20 families, with baseline controls, optional enhancements and low, moderate and high impact classifications. For readers without a technical background, it presents the NIST Cybersecurity Framework as a more high-level, voluntary option.
Steps 1 and 2: goals, scope and responsibilities
The 10-step plan starts by tying business goals to the technology and data behind them, stating a cybersecurity mission and winning visible support from executive management. It then sets the plan's scope and boundaries, operational technology included, and makes roles and chain of command clear to everyone, contractors and cloud providers too.
Step 3: requirements and objectives
The longest step: inventory and classify assets and data, identify the regulations that apply, find entry points and gaps, and prioritize risks by threat, vulnerability, likelihood and impact. The objectives that come out of it decide which policies to write and which security controls to select.
Steps 4 to 6: indicators, stakeholders and resources
Choose performance indicators that are specific, measurable, actionable, relevant and timely, such as mean time to detect. Identify internal and external stakeholders, from leadership to regulators, vendors and investors, and check that expertise, time and budget match the risks you prioritized.
Steps 7 and 8: communication, response and continuity
A communications plan covers transparency, everyday reporting, sensitive information, incident reporting and training. The guide then recommends linking the cybersecurity incident response plan with the business continuity plan, which covers any major disruption across the organization.
Go deeper: Contingency planning for clinical and medical labs
Steps 9 and 10: implementation and review
A project manager leads implementation, sets milestones and keeps everyone informed of progress. Because the mission of cybersecurity is never-ending, the last step checks whether controls work, feeds corrective actions and lessons learned back in, and sets how often the plan is reviewed.
Appendix: NIST SP 800-53 controls in plain words
A simplified description of mostly low-baseline NIST SP 800-53 controls, with select moderate and high ones, across 20 families from access control to supply chain risk management. Where applicable, each control adds further resources and a mapping to LIMSpec, an evolving set of specifications for laboratory informatics.
Go deeper: Role-based access control and least privilege

Get the free guide

Key takeaways

A plan is a living collection, not one document. It gathers assessments, requirements, controls, goals, policies and metrics, and can point to separate policies, such as a communications or incident response plan, instead of repeating them.
Your regulations are specific to you. Industry, geography and even local rules shape them; one data retention requirement alone ties to more than 100 regulations, standards and guidance documents.
A framework gives the plan its structure. Map your requirements and objectives to its controls, compare the result with how you operate today, and customize controls with your regulations in mind.
Risk comes before controls. Inventory assets, classify data, find entry points and gaps, then prioritize risks by threat, vulnerability, likelihood and impact.
Cybersecurity is more than IT. Leadership support, strong project management and effective communication, training, response and monitoring decide whether a plan works over the long term.

The 10-step plan

Develop strategic goals and define success. Tie business goals to the technology and data behind them, state a cybersecurity mission and win visible support from executive management.
Define scope and responsibilities. Set the plan's boundaries, operational technology included, and make roles and chain of command clear to everyone, contractors and cloud providers too.
Identify requirements and objectives. Inventory and classify assets and data, identify regulations, entry points and gaps, analyze risk, then choose policies and security controls.
Establish performance indicators and time frames. Pick indicators that are specific, measurable, actionable, relevant and timely, such as mean time to detect.
Identify key stakeholders. Internal leadership and staff, plus regulators, vendors, customers and investors, and how each one shapes the plan.
Determine resource needs. Check in-house expertise, estimate time for training and recovery work, and align the budget with your prioritized risks.
Develop a communications plan. Transparency, everyday reporting, handling of sensitive information, incident reporting and response, and training.
Develop a response and continuity plan. Link cybersecurity incident response with business continuity, with recovery processes, dependency maps and named responsibilities.
Establish how the plan will be implemented. Put a project manager in charge, set milestones and keep everyone informed of progress.
Review progress. Check that controls work, feed corrective actions and lessons learned back in, and decide how often to review the plan.

This page is the summary. The full guide has the detail.

e-book. Free.

Get the free guide

Who it is for

Lab directors and managers

who need leadership support, clear roles and a realistic budget for protecting their lab's data.

IT and information security staff

who want a structured way to select NIST SP 800-53 controls and fit them into a plan the whole organization can follow.

Labs implementing or updating information systems

who want each security control tied to the requirements their laboratory informatics should meet.

Written for Clinical, forensic and environmental labs, and any lab implementing or updating information systems.

About the author

Brandon Holland

Marketing & Operations Digital Solutions Architect

Brandon Holland is the Marketing & Operations Digital Solutions Architect at LabLynx, where he writes guides and articles for lab professionals. This guide is published by LabLynx Press under a CC BY-SA 4.0 license, from LIMSwiki articles by Shawn E. Douglas.

LabLynx has built laboratory information management software for more than 25 years.

Put it into practiceGet started with LabLynxWhen your plan reaches step 3, selecting security controls for the information systems your lab relies on, talk to LabLynx about how your lab handles access, audit trails and data retention today. Ask for personalized information, a demo or pricing.Talk to a LabLynx specialist

About the guide

Answers from the guide, in brief.

Get the free guide

What are the 10 steps the guide uses to build a cybersecurity plan?

Develop strategic goals and define success; define scope and responsibilities; identify requirements and objectives; establish performance indicators and time frames; identify key stakeholders; determine resource needs; develop a communications plan; develop a response and continuity plan; establish how the plan will be implemented; and review progress. The order is deliberate, but the guide expects you to jump between steps and revise earlier ones as you learn.

Which regulations does the guide say a cybersecurity plan must answer to?

That depends on the organization. Industry, geography and even local rules all play a part, and one data retention requirement alone ties to more than 100 regulations, standards and guidance documents. The guide names laws that mandate cybersecurity action, such as HIPAA, GDPR, PIPEDA and the Gramm-Leach-Bliley Act, and advises identifying every obligation, then integrating those requirements with a baseline framework of controls.

Why does the guide build its plan on NIST SP 800-53?

For its thoroughness. The guide describes SP 800-53, Revision 5 as a catalog of security and privacy controls organized into 20 families, each with baseline controls and optional enhancements, classified by low, moderate and high impact. It was developed with feedback from thousands of stakeholders. For readers who find it too technical, the guide suggests the NIST Cybersecurity Framework, a more high-level and voluntary framework.

How does the guide recommend assessing cybersecurity risk?

Build up to it. Inventory your assets and classify them by type, risk and criticality; classify your data with consistent terms such as high-risk, sensitive, internal and public; identify entry points; and run a gap analysis against a framework. Then analyze risk through threat modeling and prioritize it by threat, vulnerability, likelihood and impact, including the human element: background checks, least privilege and vetted vendors.

How does the guide connect incident response with business continuity?

It recommends linking them. An incident response plan manages the consequences of a particular cyber attack and has traditionally belonged to IT; a business continuity plan manages any major disruption across the organization, with disaster recovery as the part that restores IT. The guide suggests a similar process for creating and reviewing both, shared incident classifications and response thresholds, joint drills, and common communication between operations and IT.

How often does the guide say to review the plan?

It leaves the interval to the organization: some argue an annual review is enough, others insist on a biannual one, and the interval can change with what indicators and monitoring show. What matters is deciding how often, who is in charge, how stakeholder input is used and how changes reach documentation and training. After-action reports and lessons from others in your industry should feed back into the plan.

Free guide