Libby Bevin

Data governance matters in every industry because it helps to establish data accuracy, reliability, integrity, and security – but it is especially important in the insurance world, since insurance providers are privy to vast amounts of personally identifiable or otherwise sensitive data.

A data breach lets hackers misuse stolen insurance data for criminal purposes such as identity theft. Moreover, such events result in business interruptions and can damage the reputation of the victim insurance company.

Data governance is critical in the insurance sector for these and many other reasons. In this article, we’ll explore the issue in detail.

What Is Data Governance?

Data governance means setting standards, policies, and procedures to ensure that data is handled properly while it is gathered, stored, processed, accessed, and deleted. Governance includes complying with internal and external standards to maintain data integrity, accuracy, and auditability.

The key purposes of data governance are:

• Establish the infrastructure and technology to protect data assets;
• Set up and maintain processes, procedures, and policies to ensure the accuracy and proper handling of data;
• Identify the individuals who have the responsibility for handling enterprise data and ensuring data privacy.

Simply put, data governance is a systematic approach to manage data throughout its lifecycle, from acquisition and access to processing, use, storage, and disposal.

The Need for Data Governance in the Insurance Industry

The insurance industry (has developed a serious cybersecurity problem in recent years. Here are some alarming findings from the Cyber Insurance Risk in 2022 report:

• 82 percent of the largest insurance providers are vulnerable to phishing attacks;
• 18 percent of the analyzed insurance companies are susceptible to ransomware attacks
• Software supply chain attacks tripled in 2021.

And why is the insurance sector such a focus for cyber attacks? Data.

The industry generates a vast amount of data, and doesn’t have strong governance systems in place to protect it all. Malicious cyber groups take advantage of these weaknesses to perpetrate phishing scams, launch malware and ransomware attacks, and steal data.

Ransomware is a particularly lucrative crime in the industry, with an average ransom payout of $130,000. The largest ransom paid to date by an insurance company exceeds $40 million.

To protect their data, insurers must lower their vulnerability to cyberattacks and data breaches. This is where data governance plays a role. But apart from data security, insurers also need a robust, enterprise-wide data governance strategy to ensure that their data is accurate, consistent, and compliant.

Data governance is crucial in insurance because it:

• Ensures that data is reliable and trustworthy;
• Improves data quality, which drives customer experiences and more personalized insurance products;
• Provides a single source of the truth for more effective business decision-making.
• Helps with risk management for insurance companies.

Effective data governance also removes data silos in insurance ecosystems, and increases confidence in data. It ensures that accurate and updated data is always available to support the operational requirements of actuarial professionals.

Data governance helps standardize data management procedures for more consistent data generation, handling, and protection. This then helps with regulatory, legal, and industry compliance and data audits. Finally, insurers with auditable data governance and compliance procedures are more likely to gain the trust of customers and other stakeholders.

Challenges of Data Governance in Insurance

As critical as data governance might be, it also has challenges. These include (but are not limited to) the following.

Personnel Issues

People are vital to a data governance framework, but they also present the biggest challenge to safeguarding and maintaining quality data. Effective data governance requires identifying “data stewards” and making them accountable to protect the organization’s data. This can be difficult to do.

The corporate culture needs to emphasize that data must be handled properly and effectively safeguarded. Users that create, change, and use insurance data must understand their role in maintaining data integrity. It’s not easy to create this cultural change or increase a sense of accountability.

Rapid Proliferation of Data

As the amount of data grows, governing it becomes more difficult. It creates a need for new procedures and systems, which means higher costs for insurance companies. Moreover, lots of new data is unstructured, making it difficult to govern with existing systems designed for structured data.

Data Silos

In insurance, a lot of information resides in separate silos, preventing departments from sharing data effectively. Silos also result in data duplication and errors. Removing these silos can be difficult when various data systems are not integrated. Additionally, governance requires cross-functional collaboration, which also can be a challenge for insurers.

How Insurance Companies Can Implement Robust Data Governance Strategies and Frameworks

Creating a data governance plan and data management strategies can overwhelm many insurers. The below strategies and best practices can reduce the overwhelm.

Review the Current State of Data Governance

Start by understanding the state and performance of your current data governance efforts – warts and all. Determine what your weaknesses are and which parts of governance need help, whether that’s data stewardship, data quality, data management, master data management, or something else. This information will guide the overall data governance strategy.

Create a Data Governance Framework

A data governance framework sets the foundation for data management and maintains the value of data. Both systems and people are part of this framework.

Data governance policies, tools, and procedures are essential to manage data storage, handling, and security. At the same time, people must ensure that these tools, policies, and procedures are in place and working as expected to handle and safeguard data sets.

The other crucial components of a data governance framework are:

• The model describes the data flows, including its inputs, outputs, and storage parameters;
• Standards describe how the organization will manage and govern data;
• Metrics track strategy execution and assess the success of the governance program;
• Organizational structure spells out the roles and responsibilities of accountable persons.

Assign Accountability

Identify who will have responsibility for the data and the governance program. Proper roles and responsibilities should be assigned, and senior leadership should establish a system to ensure accountability and transparency in the system.

Appoint a Governance Sponsor and Champion

A senior leader should sponsor the governance project and champion the data strategy. This person will also communicate the strategy to stakeholders and enforce accountability for effective data governance.

Create Procedures, Documentation, and Metrics

Strong governance procedures and controls ensure that the data is properly governed and protected. Policies and procedures must be established, communicated, and reinforced through training. Documentation describes all processes and provides a baseline for future improvements.

Metrics provide insights into the performance of governance systems and whether the organization is meeting its governance objectives. The sponsor and their team should identify a handful of manageable metrics that are most likely to yield meaningful business intelligence.

Leverage Technology

The right tools help the organization collect, manage, and secure data as per its governance objectives. Automation is useful to strengthen the data governance program and ensure its ongoing effectiveness.

Technology and software are also useful for:

• Information stewardship: Profile data, execute governance initiatives, enforce high-quality standards, and assess the performance of data quality processes;
• Information lifecycle management: Automate information archiving, retention, and destruction to manage risk and control data volumes;
• Data management and integration: Augment data quality with artificial intelligence and machine learning and get insights from data analytics to assist with decision-making;
• Metadata management: Manage the “information of information,” such as type, tags, source, and dates to aid with effective data management, categorization, and protection.

Improve Data Governance with ZenGRC

The ZenGRC platform will help you manage your data governance program by providing enhanced visibility into the risks to your data and compliance requirements. Through an integrated system, you can collect critical risk data across the organization and see where risk is changing.

With ZenGRC, Risk Observation, Assessment, and Remediation, you get a single source of truth to build a unified and trusted foundation for your data governance program. You can also automate critical tasks, simplify audits, regulatory compliance, and act quickly to minimize loss events.

Schedule a demo to experience ZenGRC for yourself.

The world is embracing digital transformation, where software and automation mean less human support is necessary to perform repetitive tasks in a business process. Security automation is no different; we’ve seen massive automation in security in recent years, and that trend continues unabated.

Let’s explore security automation in detail and determine whether it’s time for you to automate your security operations.

Understanding Security Automation

Security automation refers to the use of technology to automate security processes. That reduces the need for human assistance and increases security systems’ efficiency, which ultimately reduces the chaos caused by human errors.

The approach here is to use artificial intelligence and machine learning to automate IT security operations, employing software-driven processes to detect, investigate, and treat security threats. Automation allows SecOps teams to focus on strategy-driven tasks by automating routine manual work.

Why do this at all? Because as digital transformation escalates, security threats are also increasing at an alarming rate! Nearly every 39 seconds, hackers are targeting websites and using new methods to breach firewalls.

Manual security monitoring can be time-consuming and depends on workforce availability. In contrast, rapid incident response is made possible with automated security tools so that you can tackle cyber threats without delay.

The Significance of Security Automation

For efficient results and better business flow, organizations should move toward less dependence on security teams and analysts and more on software solutions. Listed below are some of the reasons why security automation is essential in today’s highly challenging times, even against the most common cyberattacks:

Improves Incident Response

By automating your security operations, you will improve incident response. It allows you to prioritize threats and handle some cyber attacks automatically with pre-set courses of action. This will reduce human intervention and reaction time, and address security issues without manual effort.

Enables Faster Threat Detection

Security automation allows faster threat detection without depending on any external force. This means that threats like malware, phishing, and endpoint vulnerabilities will be detected immediately by the security system, and won’t require any audits to be identified and treated.

Automating your security system makes it intelligent and quick to recognize threats, limiting the potential for a security incident.

Eliminates Alert Fatigue

Alert fatigue – where staffers are overwhelmed by alerts of potential trouble and can’t investigate them all – is a real risk in cybersecurity. It increases response time and decreases the quality of the investigation. In addition, the massive number of security notifications makes it challenging to identify and remediate critical security threats; analysts can’t separate the signal from the noise, so to speak.

With automated security solutions, most threat-hunting tasks will be handled automatically with pre-set protocols, while the most critical will be routed to the appropriate response team.

Assures Secure Software Development

Automated security operations assure high-end security during the development phase. Automation identifies potential threats and vulnerabilities, allowing developers to fix the issues on the go.

More specifically, security automation helps security systems by using threat intelligence to analyze the attack surface and triage security threats before the program is deployed.

Streamlines Business Processes

Security automation tools help to streamline security processes. That reduces complexity, avoids human errors, improves knowledge sharing, and supports faster decision-making.

Handles Sensitive Data Carefully

If you are a business that faces tremendous cyber threats, handles sensitive data, stores user information, or believes in providing a safe and secure environment to its audience, then security automation is the right choice for you. It will allow your business to save time and money otherwise spent on manually addressing intrusion detection, and make your detection capabilities far more effective.

Security Automation or Security Orchestration?

Security orchestration refers to the integration of security tools and disparate security systems. It streamlines different security processes and boosts security automation, but orchestration and automation are not the same thing.

Security orchestration allows the coordination and flow of data and tasks. It connects the tools, systems, and processes to replace manual processes with contextual decision-making. As a result, you can turn complex processes into streamlined workflows.

How Do Security Automation and Orchestration Differ?

With security orchestration, you save time and effort otherwise spent trying to maximize the use of each security tool.

Security automation streamlines different processes in your security system. So you can automate various methods, but might still need orchestration to automate tasks among the techniques and tools.

When combined, security orchestration and security automation provide tremendous benefits for your security system, including:

• Faster response rate
• Improved investigation accuracy
• Fewer risks to the business
• Less alert fatigue
• Cost & time savings

Cybercriminals and their malware are getting smarter and stronger with time. As a result, organizations require high-end security systems and protection against cybersecurity threats. That’s where security orchestration enters the picture: it integrates security systems and processes for detection.

What is Compliance Workflow Automation?

Automating compliance operations that would otherwise be completed manually by workers is known as compliance workflow automation. This technology’s main advantage is that it enables staff to streamline compliance considerations and activities such as risk management and assessments, planning corrective actions, control evaluations, and testing. In addition, it eliminates time-consuming, laborious manual procedures, allowing the team to concentrate on more crucial duties while increasing the function’s accuracy and efficiency.

Why Automation? Automation of the compliance workflow is now a need for almost every organization across every sector. The technology assures that firm policies and processes are created in compliance with legal and regulatory standards and that all organization members follow and adhere to those policies and procedures.

What are some examples of workflow automation?

The benefits of automation include reducing the danger of procedural offenses by making it simpler to guarantee that all processes are followed. This assures that everyone participating in the process is aware of the flow.

Automated Workflow for Health

One easy example in the healthcare field is the rise of electronic health records. With electronic files stored in the cloud, you can assure that medical staff don’t need to transport physical records by car or plane. Instead, data can be sent from one medical institution, office, or lab to another, eliminating the danger of loss, natural disasters, or other accidents (which may be paid for by insurance).

Automated Compliance Workflow

When your compliance workflow is automated, it is simple to follow each step in approving transactions, payments, or other activities. For example, approvals might happen in a more timely manner because all necessary documentation is compiled in one electronic location for quick review.

Workflow for Automated Auditing

Auditors need to follow a transaction’s audit trail to learn what was done, by whom, and when. Automation lines up all that evidence for quick, easy visibility, accelerating the audit and saving money on audit fees (which often accrue by the hour).

Is Security Automation Right for My Business?

Security automation brings tremendous benefits to businesses. With automation, you don’t have to rely on security analysts to handle cyber threats. Instead, the system will automatically react to cyber threats with pre-set responses.

Security Automation Challenges

All that said, security automation does bring its own challenges. For example, it can detect pre-determined and pre-set cyber threats manually fed into the system, but it cannot independently handle new cyber threats and challenges.

Automation also requires security teams to determine the solutions the system might use, and then add them to the automation software so it can determine what responses to implement when something happens. That is, the system still needs a “toolkit” of possible answers.

It’s wrong to assume that security automation will eliminate the need for human support in staving off security breaches. Human oversight will always be necessary. Instead, automation will make life easier for security teams by prioritizing cyberattacks, reducing alert fatigue, and handling common threats automatically.

If you are a business considering security automation, be prepared to encounter resistance from your cybersecurity team. Employees are often reluctant to adapt to technology when they believe their jobs are in danger with technology taking over- but that misunderstands what automation actually does for security teams. So it’s essential to make your employees and stakeholders understand the true benefits and value that automation delivers.

Ready to Automate Your Security Processes?

At Reciprocity, our automation platform helps companies improve their information security by evaluating their cybersecurity risks and implementing the appropriate workflows to meet all your security requirements.

Our ZenGRC can also map your security automation tasks across multiple frameworks such as System and Organization Controls (SOC), Payment Card Industry Data Security Standard (PCI DSS), Health Insurance Portability and Accountability Act (HIPAA), and more. In addition, our dashboard provides a real-time view of your cybersecurity stance, showing you where your gaps are and what security tasks are needed for remediation.

This enables a stronger, more efficient cybersecurity risk management stance and helps compliance officers feel more effective at their jobs while keeping stakeholders informed.

Schedule a free demo today to see how ZenGRC can improve your cybersecurity strategies.

Every organization, whether a startup or global enterprise, works with multiple vendors, using their software and relying on their systems – and yet, while these external vendors provide invaluable services, they also introduce significant risk to your company’s information security.

The issue is this: How do you know if your third-party business partners are meeting required contractual, security, and privacy obligations?

If you don’t have processes to assess these third parties’ risks, then your answer is most likely that you don’t know. That lack of visibility is a significant threat; you need to know the risks of these business relationships and how much you can trust them – because if they fail, your business may, too.

This post explains third-party risk and how to manage it adequately in your company.

What Is Third-Party Risk?

Third-party risk refers to the likelihood that your business might experience an adverse event (such as a data breach, a disruption in operations, or reputational damage) when you outsource particular services or use software made by third parties to carry out specified duties.

A third party is any independent business or individual that provides software, physical goods, supplies, or services. These third parties could be software providers, raw material and component suppliers, employment agencies, consultants, contractors, and many more. Depending on other parties to run your business can be risky, but in most cases, it’s also necessary.

What Are Common Types of Vendor Risks?

We can group third-party risks into six broad categories.

Cybersecurity Risk

This is the possibility of loss because of a cyberattack, data breach, or another security event that arises from your third-party relationship. For example, the third party might be attacked while hosting your data, or attackers target your third party first and then use it to reach your IT systems. Due diligence and ongoing monitoring of vulnerabilities throughout the vendor lifecycle helps reduce this risk.

Operational Risk

Operational risk is the chance that your third party might not deliver promised goods or services, and that failure disrupts your operations – say, a cloud-service provider goes off-line at a critical moment, and brings your customer fulfillment operations to a halt. Typically, service level agreements (SLAs) that are legally binding are used to handle this vendor risk. Depending on the vendor’s importance, you may want a backup vendor to maintain business continuity.

Legal, Regulatory, and Compliance Risk

This is the possibility that a third party’s conduct will affect your company’s adherence to regional laws, rules, or regulatory requirements, such as the EU General Data Protection Regulation. This is especially crucial for enterprises in the financial services, healthcare, and government sectors and their commercial partners.

Reputational Risk

This is the danger associated with unfavorable public perceptions of your business brought on by a third party. Customer complaints, improper encounters, and subpar referrals are only the beginning. The most harmful occurrences are third-party vendor data breaches brought on by lax security measures, such as the well-publicized Target data breach in 2013 (which actually started when attackers targeted one of Target’s vendors that had access to the company’s payment systems).

Financial Risk

Financial risk is the chance that a third party will harm your organization’s ability to make money. For instance, a supplier might suddenly charge much more money for promised materials, driving up your company’s costs.

Strategic Risk

The possibility that a third-party provider may prevent your company from achieving its goals results in strategic risk. For example, a reseller in overseas markets might be acquired by one of your competitors, closing off your ability to sell goods in those markets until you find a new distribution channel.

It’s essential to keep in mind that these topics frequently overlap. For instance, if a company suffers a cybersecurity breach and customer data is stolen, this could also present operational, compliance, reputational, financial risks, and ultimately, strategic risk.

Why Is it Important to Mitigate Third-Party Risk?

In today’s digital business world, a company can outsource any number of its processes – but it cannot outsource the dangers involved in doing so. Organizations need to take an active, risk-based approach to managing third parties so the risks that arise from these relationships don’t derail your plans.

You can anticipate risk with a robust third-party risk management program, and improve business efficiency along the way. That said, every level of the organization must participate in implementing a risk-based third-party management program, even though this might make managing the process more challenging. By managing costs, bolstering operations, and reducing the risks of outsourcing, effective third-party risk management maximizes the value of your third-party agreements.

Chipotle is an example that is well recognized for its shortcomings in third-party risk assessment. In 2015 public health officials found E. coli outbreaks connected to Chipotle restaurants in Massachusetts, Washington, Oregon, and other states, affecting hundreds of patrons and staff nationwide. Chipotle assured the public this would “never happen again.”

To rebuild its reputation as a reliable restaurant, Chipotle hired a new CEO. When many patrons of a Chipotle restaurant in Sterling, Virginia, complained in 2017 of symptoms resembling the extremely dangerous norovirus, the company again changed CEOs.

Alas, this had little effect on the illness spread; a Los Angeles Chipotle restaurant reported sick staff and patrons later that year. According to a UBS Evidence Lab poll from 2018, 32 percent of people who had stopped dining at Chipotle said “nothing” would entice them to go there again.

The outbreaks started soon after the company introduced an innovation to use locally sourced ingredients in its recipes. Chipotle had revolutionized the sector with decentralized, locally sourced food, but failed to match its innovative business model with risk management best practices.

By using that decentralized procurement strategy, Chipotle had exposed itself to more than 1,000 possible sites of food contamination; a more typical centralized procurement system would have only a fraction of that. Chipotle failed to address the underlying cause of the problem, which led to repeated food safety disasters.

How to Conduct a Vendor Risk Assessment

To assess the risks of your third parties, you should have a disciplined vendor risk management process. That process typically includes the following steps.

Vendor List: Who Are Your Suppliers?

First, identify all of your suppliers. A third-party vendor is any person or organization that provides an item or service to your company, but does not work there. These may include contractor employees, service providers, manufacturers and suppliers, and service firms. (In some situations, you may also include fourth party suppliers in your vendor inventory.)

Vendor Evaluation Procedure

Second, develop a process to evaluate the risks that each third party might pose. Typically you can do this with a questionnaire sent to each prospective vendor before you decide to bring that party into your enterprise. Consider what goods or services the vendor will provide, how important those services will be to your operations, and the potential risks that the party might bring to your organization.

Prioritizing High-Risk Suppliers above Lower-Risk Vendors

Not all vendors pose the same risks. Some vendors deliver commodity items, while others supply specialized components. You may share sensitive customer data with some third parties, and nothing of consequence with others.

Prioritize vendors based on the risks they present to your organization as identified in the due diligence and risk assessment processes discussed in the previous step. It’s essential to assess all vendors regularly, using the same standards for all, to ensure that no potential issues go overlooked. For example, vendor surveys should be completed both at the time of onboarding and then annually thereafter.

How to Minimize Third-Party Risk

Even though most businesses agree that screening third parties is essential before engaging in a commercial relationship, 60 percent also aren’t properly prioritizing third-party risk. Several steps can help an organization do better.

Request References

Seek references while evaluating the security commitment of your vendors. Contact other firms that have used their services and ask how well the vendors perform on security. Ask questions specific to the type of engagement you’re planning for each vendor.

Apply Internal Standards to Third Parties

After you’ve chosen a vendor, develop a service level agreement (SLA) that defines the vendor’s commitments for security policies, performance expectations, and service or product deliverables.

Don’t rely only on the vendor’s default procedures. Consider the needs of your organization, your industry, and your customers. Your best bet for guaranteeing that data is safeguarded is holding the vendor to the same regulatory and compliance standards that you need to meet.

Regularly Check Third Parties’ Cybersecurity Protocols

Circumstances change all the time, especially in the fast-moving world of cybersecurity. Hence it’s critical to review the cybersecurity policies of your third parties regularly. Continuous monitoring and periodic audits assure accountability and keep vendors on their toes.

Automate Third-Party Risk Management with Reciprocity ZenRisk

Enter Reciprocity ZenRisk. With ZenRisk, your organization can streamline processes, automate workflows, and protect your information environment. Insightful reporting and dashboards provide real-time visibility to your current risk landscape, enabling data-backed decisions.

Managing third-party risk is critical, no matter the industry you operate in or the size of your company. With vendor management software that scales as your business grows, you can automatically assess risks, identify potential threats, and take action before it’s too late.

Schedule a demo for more information!

5 EXAMPLES OF HOW TO GAIN BETTER INSIGHT INTO THE RISKS OF YOUR STRATEGIC BUSINESS PRIORITIES

77% of global companies report an increase in threats to their business. ¹ Yet, executives say it’s organizational complexity that poses “concerning” cyber and privacy risks. To solve, they need to better prioritize IT and cyber risk across their organizations. ²

How can you reduce complexity and gain better insight into the risk of your strategic business priorities without burdening already taxed infosec teams?

The Reciprocity ROAR Platform enables the creation of cyber security programs around business priorities – so you can mitigate risk across operating units, product lines, etc. With step-by-step guidance, curated content and automation built-in, you can deliver better outcomes with less effort.

This webinar presents several examples to help you:

• Understand Cyber Assurance Programs and how they reduce complexity
• Discover new ways to free up time and deliver quick wins
• Better justify the investments needed to protect and accelerate your business

¹ Cybersecurity: How do you rise above the waves of a perfect storm? | EY Global, 2021

² PwC 2022 Global Digital Trust Insights Survey

Duration: 58 minutes