PSSI management tools: Feedback from the RSSI of the Haute-Garonne Departmental Council

What are the tools for managing the PSSI? The Conseil Départemental de la Haute-Garonne (CD31) shares its experience of integrating security into digital transformation projects. Also acclaimed at a CoTer Numérique conference. The department's general management was challenged by the cybersecurity figures. Since the beginning of the health crisis, more than 400% of cyber threats have been identified! To coordinate all the actions and projects arising from this information systems security policy, the local authority chose Project Monitor software. Project portfolio management software. In particular, it enables the implementation of dashboards, a veritable cybersecurity cockpit.

Why set up an ISPP for a local authority?

Key figures highlight vulnerability. Since the start of the health crisis: +400% cyber threats, including

• 90% of vulnerabilities caused by human error
• 94% of attacks triggered by email
• 80% of cybersecurity events involve phishing attacks

"The PSSI is a defined action plan. In order to maintain a level of security in line with the community's challenges . It reflects the community's strategic vision in terms of Information System Security."

The Haute-Garonne department has opted for a specific security policy for a local authority. The Haute-Garonne department's CISO has adopted an ambitious approach to cybersecurity. This approach takes into account a number of factors challenges, not least the sheersize of the department's information system. Including 250 software and business applications, 2,653 workstations and 3,829 laptops.

The Conseil Départemental has therefore opted for a policy in line with the specific characteristics of a local authority.

How do you go about drawing up an ISPP?

To begin with, the departmental council laid down the main security principles in a very generic PSSI.

The principles were then broken down into thematic/specific policies, intended to be reassessed more frequently.

To coordinate all the projects and actions arising from this ISSP, the department has drawn up a roadmap dedicated to the Information Security Management System.

In the end, the department set up a 3-stage steering system, involving various committees:

• Strategic : the Information System Security Committee (COSSI). Participating in the strategic vision and meeting at least once a year. It provides an annual review of actions taken and validates important points.
• Tactics : the Technical Committee for Information System Security (CTSSI), which meets every month. Its aim is to monitor the progress of the ISSP, review the various indicators and take certain decisions. 
• Operational : IT project steering committees. These project reviews take place every two weeks or so, and serve to monitor the progress of the action plan.

What tools should be used to manage and monitor the PSSI?

The RSSI toolbox of the Haute-Garonne Departmental Council

To carry out its safety projects, the Conseil Départemental uses a number of tools, such as :

👉 Cyberwatch

Cyberwatch Vulnerability Manager is a vulnerability management platform. From detection to correction, the platform enables you to manage all your vulnerabilities. It's all part of the fight against cyberattacks. So you can control the compliance of your information system. And comply with your security standards and implement defense-in-depth.

👉 Egerie

The EGERIE software platform provides a global, centralized view of cyber risk mapping and the security measures to be implemented. This enables you to develop a genuine cybersecurity strategy for your company.

👉 Project Monitor

The Conseil Départemental de Haute-Garonne has chosen to use a PSSI management tool to :

• industrialize the management and monitoring of indicators as much as possible (avoid the widespread use of Excel, numerous e-mail exchanges, etc.);
• to obtain a global vision and to share it top-down or bottom-up;
• control the costs of the security project and the follow-up of the action plans.

He chose the solution offered by Virage Group : the PPM software Project Monitor.

Project Monitor is project portfolio management software. Simplify your project management with an all-in-one tool! Numerous functions are included. Like multi-project dashboards, project review animation, workload plan, schedule, tasks, budget.

The department uses this tool as a real cybersecurity cockpit, with a 360° view:

• global views, which can be integrated into a report for top management,
• operational views to help you make quick decisions on which actions to prioritize.

PSSI management tool: Focus on project portfolio management software Project Monitor

A tool to help CISOs manage their cybersecurity activities

The Conseil Départemental de la Haute-Garonne uses the Project Monitor software package to enter into the details of projects (development, planning, etc.) linked to the 11 axes of its PSSI. All the chapters of the PSSI have been included in this tool. In order to track the progress of each project linked to one or more aspects of the security policy.

The department also uses the portfolio section to animate work meetings (particularly the CTSSI). This is much more dynamic than a simple PowerPoint presentation. Stakeholders select the projects they wish to discuss. They then unroll the various associated points before making their decisions. 

• Indicator tracking
• View of CTSSI follow-up and priority projects
• Portfolio view for comitology
• View for monitoring the PSSI and the overall action plan

A 360° solution for IS project portfolio management

Simplify your project portfolio management with a single software package. Plan, manage, prioritize and visualize your project portfolio in just a few clicks. With Project Monitor, make it easy for your project teams to work with all the stakeholders in your portfolio. You can easily track and organize your projects, whatever their level of complexity.

• Reporting
• Capacity schedule
• Time tracking
• Gantt
• Kanban
• Follow-up of IT requests
• Budget monitoring