Abdoulaye Maiga IT Operations · Systems Administration · Infrastructure
CYBERSECURITY / GOVERNANCE

Cybersecurity, Compliance & Disaster Recovery Program

Cybersecurity and resilience program connecting executive risk governance with hands-on identity, firewall, infrastructure hardening, recovery, and operational controls.

Security & Resilience ProgramIT Operations / Security & Resilience LeadPublic case study

Executive Risk Lens

Security had to be managed as an operational and business risk discipline, not as a disconnected collection of security products.

Governance & Control Strategy

  • Strengthened MFA, role-based access, infrastructure hardening, accountability, documentation, and recovery planning.
  • Applied NIST/ISO-aligned governance practices and HIPAA-aware controls where appropriate without overstating formal certification.
  • Connected cybersecurity decisions to business continuity, operational resilience, and sustainable day-to-day practices.

Hands-On Validation

  • Participated directly in firewall hardening, identity/access controls, infrastructure configuration, recovery planning, technical troubleshooting, and validation.
  • Used SOPs, change discipline, testing, and periodic review to make controls operational rather than theoretical.

Outcome

The program improved the relationship between governance, technical controls, recoverability, and operational accountability while reducing unnecessary exposure and improving security posture.

Detailed Project Scope

Explain how operational security controls reduce business risk, from account governance and network boundaries to incident response and restoration. This is an evidence-led expansion of prior security and resilience work, not a claim that a new enterprise security program has already been deployed.

Technical approach and validation

The documentation will connect each control to a threat scenario, control owner, operating procedure, verification method and recovery path. NIST and ISO concepts will be used as references for thoughtful control design, not as claims of organizational certification. Sanitized diagrams will separate logical architecture from exploitable configuration detail.

Planned Project Roadmap

These are Planned case-study documentation and demonstration tasks; they do not supersede the professional security and disaster-recovery work already summarized above.

SEC-01 — Risk and asset context (Planned)

  1. Define critical service categories and realistic threat scenarios
  2. Map representative assets, owners and risk tolerances
  3. Prepare a control-to-risk traceability matrix

Expected deliverable: Public-safe risk scenario register.

SEC-02 — Identity security controls (Planned)

  1. Describe privileged role separation and emergency access safeguards
  2. Document MFA policy decisions and account-lifecycle checkpoints
  3. Define access-review and evidence collection tests

Expected deliverable: Identity control narrative and review checklist.

SEC-03 — Network and system hardening (Planned)

  1. Explain management-plane segmentation and firewall policy intent
  2. Document patching and secure configuration review workflow
  3. Capture sanitized evidence of lab validation where available

Expected deliverable: Hardening checklist and safe architecture diagram.

SEC-04 — Logging and response (Planned)

  1. Define audit sources, retention boundaries and alert ownership
  2. Document response escalation and ticket correlation practices
  3. Create a tabletop exercise with observable expected outcomes

Expected deliverable: Detection and response exercise plan.

SEC-05 — Backup and recovery (Planned)

  1. Separate redundancy, snapshot, backup and off-site recovery roles
  2. Describe recovery time/recovery point targets as targets, not verified results
  3. Build a restore-test template with evidence and rollback fields

Expected deliverable: Recovery control matrix and restore-test template.

SEC-06 — Published assurance (Planned)

  1. Map documented activities to selected NIST/ISO concepts
  2. Review materials for customer and infrastructure confidentiality
  3. Publish only controls and outcomes that can be supported by evidence

Expected deliverable: Governance-to-engineering retrospective.

Project Updates

Update status: The new milestones listed above are planned. No completed milestone update is claimed by this section; dated progress notes will be added only when work has been verified.

Next planned update: Publish the risk-to-control mapping and one sanitized, verifiable control example.

Future entries will include a date, the milestone identifier, what was implemented or documented, sanitized validation evidence, lessons learned, and the next step.

← Back to Projects