By Alan Daniel Cochran (Al)
Global360 Information Security (G360)
Information security managers need a way to understand how their programs actually work. A policy, a technology investment, or a favorable audit result may tell part of the story. The harder question is how the organization’s security activities work together—and where weaknesses need attention.
I developed the Discipline Diamond Methodology to help examine those activities and present the resulting strengths and weaknesses visually. It gives security and risk managers a structure for discussing their programs, clarifying responsibilities, and deciding where improvement is needed. This article introduces the idea; the accompanying overview and facets infographics provide a separate visual reference.
Why a diamond
A diamond’s visible appearance depends on more than one surface. Its facets, structure, and proportions contribute to the whole. I use that relationship as a way to describe an information security program: individual disciplines matter, but so do their connections and the balance between them.
The visual model provides a common reference for a conversation that can otherwise become fragmented. Leaders can discuss the overall program while examining the specific activities that support it. A visible weakness becomes a starting point for questions about responsibility, evidence, and improvement.
Focus on what the organization does
A central idea in my original material is to focus on the verb rather than the noun. Naming a security function does not establish that it operates effectively. The assessment needs to examine what people do, how consistently they do it, and what evidence demonstrates the result.
For example, an organization may have a risk assessment procedure. Useful questions include whether assessments take place when needed, whether findings reach the people who must act, and whether agreed actions are followed through. The same distinction applies to policies, awareness activities, monitoring, and other parts of the program.
This approach helps move the discussion from the existence of a document or tool to the performance of a security discipline.
Read the Diamond as an interconnected program
The original graphics organize the program using the physical parts of a diamond. The crown groups disciplines that guide and support the program, including policies and standards, request management, reporting and communication, awareness and education, entity management, and privacy.
The girdle represents governance, compliance, and audit. These activities help establish direction and accountability and provide a basis for examining whether the program is meeting its obligations.
The pavilion represents the disciplines that carry out the program’s security work. The facets reference describes these functions in more detail. The table provides the view of the corporate security posture supported by the underlying disciplines.
The point of the illustration is to examine the relationships as well as the individual functions. Strong performance in one area should not cause an important weakness elsewhere to disappear from the discussion.
Make responsibility explicit
Information security involves leaders, employees, contractors, and service providers. Each needs to understand the security functions associated with their role. The Discipline Diamond provides a structure for identifying those responsibilities and examining whether they are carried out.
This matters especially when a program spans business units or corporate entities. Enterprise direction needs to connect to the people who perform the work locally. Responsibilities, reporting expectations, and unresolved gaps should be visible enough to discuss and act on.
The assessment should therefore consider both the discipline itself and the organizational arrangements that support it. Unclear ownership can be as consequential as an incomplete procedure.
Use assessment to guide continuing improvement
The Diamond is intended to work with continuing assessment and improvement. An assessment establishes a view of the program at a particular time. Its findings should lead to decisions about what needs attention, who owns the response, and what evidence will show progress.
A useful discussion starts with the program’s scope and the evidence available. It then examines the disciplines, identifies strengths and weaknesses, and translates the findings into priorities. Subsequent reviews can revisit those priorities and examine what has changed.
The visual representation supports this conversation. Detailed findings and supporting evidence remain necessary: the picture helps readers understand the assessment, while the underlying work explains its conclusions.
Relate the disciplines to external requirements
Organizations often need to address several security frameworks, contractual commitments, and regulatory requirements. The Discipline Diamond organizes the program’s activities so that these obligations can be considered alongside the work of maintaining security.
The original material refers to several external frameworks and standards. Those references should be understood in their historical context. Any current engagement needs to establish which requirements and versions apply and assess them explicitly. Using the Diamond does not, by itself, establish compliance or certification.
Explore the reference and join the discussion
The separate overview infographic introduces the model and its improvement concept. The facets infographic provides a closer look at the disciplines. Together, they support this introduction without requiring readers to work through a long graphic inside the article.
This public introduction explains the approach. Detailed assessment tools, scoring arrangements, and engagement materials remain part of client work.
Which parts of your security program are easiest to describe, and which are hardest to assess? Where do responsibilities become unclear? I welcome discussion of those questions. Please keep comments focused on the ideas and avoid confidential organizational or client information.
