How to Build Continuous Cyber Risk Management

TL;DR

Build continuous cyber risk management by extending compliance work with ongoing monitoring, useful metrics, and risk analysis that supports business decisions. Secure management buy-in through champions, alignment with enterprise objectives, relevant industry examples, and a proof of concept focused on a critical risk. Include affected business units early so the resulting framework works across the organization.

Transcript

Great. Thank you all for being here today. Thank you for that introduction. Uh, is this anyone's first ever RSA Conference? Raise your hand. All right. Anyone second? Uh, five or more? All right, a few of you. So one of the things I've realized over the past few RSA Conferences is the ever-increasing number of sessions and presentations on risk man... Read More

Key Insights

• Cybersecurity risk measurement is difficult because many organizations cannot express risk in business terms, while organizations that attempt such measurement may lack confidence in their results. Low confidence makes it harder to justify investments, communicate program effectiveness, prioritize risks, and select suitable treatments.
• Risk exists because of uncertainty, so measurement should help an organization identify where uncertainty remains and make better-informed decisions. Measurements will not always be correct, but beginning the process allows security teams and executives to understand risk more clearly and take informed action.
• Continuous risk management builds on compliance by combining ongoing monitoring, available internal or external data, useful metrics, and risk analysis. The resulting analysis may be quantitative, qualitative, or a hybrid, depending on how the organization can use its data and evaluate uncertainty.
• A mature risk program can reduce waste and overhead by automating some control testing. Spending less time manually checking compliance requirements gives teams more time to provide feedback, improve security processes, evaluate control effectiveness, and increase maturity throughout the enterprise.
• Management buy-in is a critical starting condition for creating or maturing a risk management framework. Champions can come from multiple organizational levels, including security-minded IT partners and executives who understand that establishing an effective, organization-wide process takes time.
• Risk management goals should be explicitly connected to the objectives of the enterprise. For example, leaders in a financial services organization need to understand how the proposed program supports objectives that matter specifically to financial services and provides relevant organizational value.
• A proof of concept can demonstrate the value of risk management by focusing on a critical organizational risk, collecting relevant data, measuring effectiveness, and conducting quantitative analysis. This evidence can strengthen the case for investing in a broader and more mature risk process.
• Inclusive planning is essential when a risk framework will be used across the enterprise. Business units such as finance, IT, and project management should participate in planning so they understand the intended outcome and help ensure the new process works for all expected users.

Questions & Answers

Q: How can an organization move from compliance to continuous cyber risk management?

An organization can begin with its existing compliance and regulatory requirements, then add continuous monitoring of relevant internal and external data. That data should support metrics that reveal process performance and control effectiveness. The organization can then feed those measurements into quantitative, qualitative, or hybrid risk analysis, shifting attention from merely doing what is required toward making informed decisions about what should be done.

Q: Why should cybersecurity risk be measured in business terms?

Measuring cybersecurity risk in business terms helps security teams explain value and effectiveness to executives and boards. It also supports decisions about expensive tools, risk priorities, mitigation options, and treatment plans. When organizations cannot measure risk, or do not trust their measurements, they struggle to justify funding and give leadership confidence that proposed security actions address the most important concerns.

Q: What role does uncertainty play in cybersecurity risk management?

Risk exists because of uncertainty, so measurement is a way to locate and understand that uncertainty. An organization does not need perfect predictions before it begins. Measurements can sometimes be wrong, but the process still helps security teams and executives make more informed choices. By measuring risk, developing understanding, and acting on that understanding, the organization becomes better able to manage its exposure.

Q: How can a mature risk management program reduce operational waste?

A mature risk management program can reduce waste and overhead by automating some control testing. Automation decreases the time teams spend repeatedly checking compliance boxes. That time can instead be used to provide feedback, improve security processes, examine whether controls are effective, and raise maturity across the enterprise. The program therefore creates value beyond satisfying regulatory or compliance requirements.

Q: How can security teams gain management buy-in for a risk program?

Security teams can gain buy-in by identifying champions at several organizational levels, including security-minded IT partners and supportive executives. They should connect program goals directly to enterprise objectives, present relevant examples from organizations in the same sector, and conduct a proof of concept. These steps give leaders practical evidence that the proposed risk process can provide value and support organizational priorities.

Q: What should a cyber risk management proof of concept include?

A proof of concept should focus on a critical risk within the organization. The team should collect data related to that risk, determine how effectively the organization is addressing it, and perform a risk analysis using quantitative numbers. Presenting the resulting value to leadership can show that a more mature risk management process is practical and can support better decisions across the organization.

Q: Why must risk management goals align with enterprise objectives?

Risk management goals must align with enterprise objectives so leaders can understand how the program supports the organization rather than viewing it as a separate security exercise. The connection should be specific to the enterprise and its sector. In financial services, for example, the discussion should clearly show how the proposed framework provides value around the objectives and needs of a financial services organization.

Q: Who should participate in planning an organization-wide risk framework?

Planning should include the stakeholders and business units expected to use or depend on the risk framework. If finance, IT, project management, and other groups will leverage the process, they should participate from the planning stage. Inclusive participation helps everyone understand the intended end goal and increases the likelihood that the framework will function effectively across the organization rather than serving only the security team.

Summary & Key Takeaways

• Cybersecurity programs often begin by meeting regulatory requirements, but compliance alone does not show which risks deserve priority or which controls provide value. Organizations can progress by continuously monitoring available data, creating metrics, assessing control effectiveness, and feeding the results into quantitative, qualitative, or hybrid risk analysis for better decisions.

• A mature risk program can increase stakeholder confidence, reduce waste, and support data-driven decisions. Automating some control testing reduces the time spent checking compliance boxes, allowing teams to improve processes and organizational maturity. Better measurement also helps leaders evaluate security tools, compare treatments, and understand cybersecurity in relevant business terms.

• Successful implementation begins with broad organizational support. Security teams should recruit champions at operational and executive levels, connect risk goals to enterprise objectives, present relevant examples from their sector, and demonstrate value through a focused proof of concept. Planning should include every business unit expected to use the framework or its results.