Assessing Substantial Change — RockCyber

Last time I introduced the 4th principle of a leading coso of Review and reviewS We will move on to the first point and audit that is Evaluates the essential change

Review and revision have 3 points:

1. Evaluates the essential change

2. Reviews Risk and Effectiveness

3. Pursues improvement in the risk management of an enterprise

The landscape of the threat of cybersecurity is constantly changing; Therefore, the risks of cybersecurity must be continuously monitored to ensure that they remain within the acceptance and tolerance of the organization’s risk.

By establishing a methodology for continuous risk monitoring, a new risk assessment or the lowest examination of individual risk can be triggered to determine whether the risk priorities have changed. Keep in mind that it is also important to monitor the risks that have been adopted earlier. Continuous risk measurement also helps to achieve a strong security culture throughout the organization.

Why would you constantly monitor the risk if there was no risk accounting in the whole organization? Of course, you wouldn’t. It would be stupid to waste time and resources if there was no accountability for actually doing something for newly discovered or reorated risks.

Making a one -time risk assessment or an annual risk assessment provides a momentary photo of your organization’s cyber risk profile. It’s easy to get in once a year to “fix things”. It is much more difficult to get in order to respond to the risk all year long. This purchase is another reason why the Governing Committee on Cybersecurity is so important to establish. Roles and risk management and response responsibilities can be appointed and reported at this level with entry into all key business units.

Here are 4 things you can start doing right now:

1. Be aware of the changing landscape of the risk of cybersecurity through sources as subscriptions for free community signals. Some examples include:

   • Automated CISA indicators (https://www.cisa.gov/automated-indicator ranging-ais)

   • Infragard (https://www.infragard.org/)

   • Sans Internet Storm Center (https://isc.sans.edu/)

   • ISACS National Council: ISACS (https://www.nationalisacs.org/Member-isacs)

2. Develop KPI and KRI that allow you to monitor the risks

3. Work with Organizational Leadership to obtain purchase of property and accountability for continuous risk management and mitigation

4. Communicate KPI and KRIS and work with risk owners to ensure that the risks remain within the acceptance and tolerance of the organization’s risk.

Next time I will talk about a risk review and efficiency.

As always, I love your comments and if you want to have a direct conversation, please shoot me a message and we will set up something.

Have a nice week!