[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-202706-105":59,"doc-detail-202706-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","information-security-program-update-08-13-25","Information Security Program Update - 08-13-25","","Information Security Program update for the Sound Transit Information Security business unit, presented by the Chief Information Security Officer. The session covers the function overview and background, including how the program was formalized under IT sponsorship and supported by an ISO 27001-based Information Security Management System. It analyzes situational risks and recent attacks, outlines ongoing efforts and current focus, and summarizes measurable maturity progress while addressing funding, technical debt, capacity limits, and evolving threats.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":30,"@type":76,"position":81},"https://docshare.wps.com/document/technology/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/information-security-program-update-08-13-25/202706/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/information-security-program-update-08-13-25/202706.png","ImageObject",300,407,{"name":92,"@type":93},"Grenda","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-09","2026-09-04",true,{"@type":102,"interactionType":103,"userInteractionCount":24},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What is the purpose of the information security function at Sound Transit?","Question",{"text":112,"@type":113},"The function is designed to preserve the confidentiality, integrity, and availability of agency information assets using the ISO 27001 framework and the agency’s Information Security Management System established by policy.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"What key factors shaped Sound Transit’s information security program before and after 2016?",{"text":117,"@type":113},"Before 2016, cybersecurity was not explicitly addressed, creating broad gaps. The program was later formally established under IT with CIO sponsorship and supported by a cybersecurity activation plan to drive a “best in class” posture.",{"name":119,"@type":110,"acceptedAnswer":120},"How is program maturity assessed, and what are the main challenges mentioned?",{"text":121,"@type":113},"Program maturity is measured with a standard scale, showing externally-audited maturity reaching 3.9 on a 5-point Gartner scale. Challenges include funding constraints, large technical debt, limited resource capacity, and evolving threats.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},202706,1790485332,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":29,"category_name":30,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":24,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145},7971474921005,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","Information Security Business Unit  \nCommunity Oversight Panel  \nAlex Di Giacomo, C|CISO, CISA,CISM, CRISC, CISSP, CDPSE, HISP  \n8/13/25  \nData Classification: Unrestricted  \nAgenda  \n1 Information Security at ST: Function Overview and Background  \n2 Situational Awareness: Risks, Current Posture and Recent Attacks  \n3 Ongoing Efforts and Current Focus  \n4 Panel Q&A  \n2  \nData Classification: Unrestricted  \nAbout your Presenter  \n• Sound Transit’s Chief Information Security Officer  \n• BS in Electronic Engineering, specialization in Control Systems  \n• Master of Engineering and Technology Management, Summa Cum Laude  \n• Over 26 years of experience across industries such as Energy, Consulting, Managed Services, IT and Transit  \n• Member of the Washington State Technology Services Board Security Subcommittee  \n• Relevant security designations: C|CISO, CISA, CISM, CRISC, CISSP, CDPSE, HISP  \n3  \nData Classification: Unrestricted  \nInformation Security: Broader than IT Security  \n4  \nData Classification: Unrestricted  \nFunction Overview  \nDesigned for…  \nPreserve the Confidentiality, Integrity and Availability of information assets  \nAgency-wide  \npurview and scope  \nTo… With…  \nBased on…  \nThe framework provided by the ISO 27001 international standard for Information Security  \nThe Information Security function is enabled by Agency Policy 1100 which establishes its core component  \n– the agency’s Information Security Management System (ISMS)  \n5  \nData Classification: Unrestricted  \nBackground  \nCybersecurity not explicitly addressed prior to 2016, leading to significant gaps across the board  \nInformation Security function formally established under IT, per CIO sponsorship  \nCEO Sparrman sponsors Cybersecurity Activation Plan to address issues and target “best in class”posture  \nST ISO 27001/2 Information Security Capability Maturity Score  \n5  4.5   \n| 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- |\n\n\n|  CMMI Maturity | 1 | 2.2 | 3 | 3.2 | 3.5 | 3.6 | 3.8 | 3.9 | 3.9 |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n\n4  \n3.5  \n3  \n2.5  \n2  \n1.5  \n1  \n0.5  \n0  \nMaturity Score ( CMMI 5.0 Scale)  \nAchievements  Externally-audited maturity level of the business function of 3.9 (5-point Gartner scale)   Challenges  Funding, large technical debt, limited resource capacity, evolving threats  \n6  \nData Classification: Unrestricted  \nProgram maturity is typically measured with a standard scale  \n7  \nDatDaalaasilfastioicna: tUionre: sUtiesricted  \nInfoSec Program – Main Objectives  \nRisk Control  \nBest in class (Transit)  \n Comparable to Top Performers  Enterprise Approach  \n9  \nData Classification: Unrestricted  \nInfoSec BU Functional Organization  \n• Strategic and Agency Alignment  \n• Security Consulting Services  \n• Program Management  \n• Budget Management  \n• People Management  \n• Resource Management  \nSecurity  \nEngineering and Infrastructure Security  \nSecurity Operations  \nGovernance, Risk Management, Compliance  \nTechnology Resilience  \n• Security Consulting, Engineering, Design and Review Services  \n• Risk Assessment and  \nRemediation Services  \n• Security Technical testing  \n• Identity and Access Management Services (Under Development)  \n• Event and Incident Response Services  \n• Alert Triaging and event resolution  \n• Security Tool Operations and Monitoring  \n• Policy and Governance Services  \n• Information Security Risk Management  \n• Compliance Services  \n• Risk Audit Support Services  \n• Vendor Risk Management  \n• Technology Resilience Support Services  \n10  \nData Classification: Unrestricted","cbCaitdYAjXITde9","https://ap.wps.com/l/cbCaitdYAjXITde9","pdf",1353043,17,"English","# Information Security at ST: Function Overview and Background\n## Situational Awareness: Risks, Current Posture and Recent Attacks\n## Ongoing Efforts and Current Focus\n## Panel Q&A","[{\"question\":\"What is the purpose of the information security function at Sound Transit?\",\"answer\":\"The function is designed to preserve the confidentiality, integrity, and availability of agency information assets using the ISO 27001 framework and the agency’s Information Security Management System established by policy.\"},{\"question\":\"What key factors shaped Sound Transit’s information security program before and after 2016?\",\"answer\":\"Before 2016, cybersecurity was not explicitly addressed, creating broad gaps. The program was later formally established under IT with CIO sponsorship and supported by a cybersecurity activation plan to drive a “best in class” posture.\"},{\"question\":\"How is program maturity assessed, and what are the main challenges mentioned?\",\"answer\":\"Program maturity is measured with a standard scale, showing externally-audited maturity reaching 3.9 on a 5-point Gartner scale. Challenges include funding constraints, large technical debt, limited resource capacity, and evolving threats.\"}]","Information Security Program Update - 08-13-25 | PDF",1788550222,43]