It’s Finally Time to Perform! — RockCyber

[ad_1]

In the latest issue of videos, I discussed the creation of the Cyber Risk Management Foundation using the first two leadership principles of Coso– Management and culture and strategy & Objective setting. This week I will discuss the 3rd guidance principle – ImplementationS

Again Coso has 5 leading principles:

Management and culture
Strategy and objective determination
Implementation
Review and review
Information, communication and reporting

Implementation It concentrates on how an organization considers the risk while fulfilling the strategy and achieving business goals.

In the context of Coso, Implementation Isn’t it something you don’t know anymore. Business increases its dependence on technology; And digital transformation will increase this dependency. As such, the landscape of digital threats continues to grow. This means that the likelihood of an organization having a cyber incident also continues to grow.

From practically the first day we start learning to become a cybersecurity professional, we are taught that:

Exposure to risk = impact x probability

The key to minimizing the risk is to attract the two levers of “probability and impact” by identifying and prioritizing risk events and measuring the way of implementing plans to treat risk.

This is interested in C-Suite. They are not interested in the specific technological solution (s) used to minimize risk.

An organization will never be able to “provide all things all the time.” More importantly, it should not, because it would be inefficient use of capital.

Ultimately, leadership must evaluate the risk and determine the best course of action after factoring business goals, criticality of specific assets, risk appetite and risk tolerance.

It is crucial to raise the awareness of cyber risks to the ERM team (or the higher management in a smaller company) in a way, so that any risk can easily be brought in line with other risks of the enterprise. This will give the leadership a composure to the risks that will help them to:

· Determine conflicting risks.
Emphasize, correlate and summarize common risks in business units. and
Create a risk taxonomy followed by the whole organization.

C-Suite Leadership may neglect talking about CVSS result that measures the weight of vulnerability; However, they will surely listen to a picture of how this vulnerability, along with the likelihood of it being exploited, can lead to a significant impact on the company’s financial and reputation.

Presenting cybersecurity risks thus allows the risks to be more easily recognized and evaluated with other organizational risks that C-Suite understands more easily.

In the coming weeks I will discuss how to do this as I appreciate each of the five coso Principles of implementation: