Risk Management

In the modern business environment, managing risk is critical for both business continuity and achievement of financial and strategic goals.

A robust risk management program helps your organization do that, because it helps you to better predict and respond to risks before those risks cause any damage – and a cybersecurity incident (such as a data breach) can be extraordinarily damaging.

Some of the many repercussions associated with cybersecurity incidents include financial losses and reputational damage, regulatory sanctions, and costly civil litigation. In most cases, the fines and penalties associated with non-compliance dwarf the other costs resulting from an incident.

In fact, the global average cost of a data breach in 2022 was $4.35 million – a painful amount, especially when you consider that the majority goes directly toward paying the fines that come with regulatory and compliance violations.

For many organizations, implementing a compliance risk management program is crucial to keeping all those potential consequences in check.

What Is Compliance Risk Management?

Compliance risk management (CRM) is the process of assuring that your company complies with applicable laws, regulations, and standards. It involves identifying, evaluating, and monitoring current and potential risks to your enterprise’s compliance efforts, followed by implementing and monitoring internal controls to assure ongoing compliance effectiveness.

One important part of compliance risk management is having a compliance risk management program to:

• Document the potential losses and liabilities your enterprise is likely to face in the event of non-compliance, including legal penalties, business and operational laws, and fines
• Outline remediation steps to reduce these risks to acceptable levels, so that your business can continue to operate compliantly without any repercussions.

Compliance Risk Management Considerations

To establish an effective compliance risk management program, you’ll need to take an enterprise-wide approach that accounts for the following:

• Training and communication with relevant employees
• Risk appetite analysis to determine your organization’s acceptable level of risk
• Policies and procedures for managing compliance risk
• A risk assessment or risk analysis to identify potential risks and prioritize them:
  • A qualitative risk assessment relies on subjective ranking, such as high-, medium-, or low-risk
  • A quantitative risk assessment relies on data and mathematical probabilities to calculate risk
• Controls testing and monitoring
• Reporting test results and risk posture status
• Tools for risk management
• Governance and oversight

Ideally, your risk management, compliance, and internal audit functions should all participate in the CRM process. The most effective compliance risk management program documents the potential losses and liabilities your organization might face for non-compliance, including legal penalties, fines, business loss, and reputational loss; and then implements necessary remediation measures to keep those risks at acceptable levels.

Common Compliance Risk Management Standards, Frameworks, and Methodologies

While CRM has no specific risk assessment methodology or framework of its own, several risk management frameworks and methodologies exist that can be tailored to address compliance risk specifically, and therefore help your CRM decision-making.

ISO 27005

ISO 27005 Information Technology – Security Techniques – Information Security Risk Management provides a framework and an approach for information security and cybersecurity risk management. This framework provides guidelines for what your risk assessment should include, but no specific steps. Nevertheless, most risk management methodologies are derived from this international standard.

Learn more about ISO compliance here.

OCTAVE (Operationally Critical Threat, Asset and Vulnerability Evaluation) Allegro Risk Method

Created by the Software Engineering Institute of Carnegie Mellon University, OCTAVE is a qualitative methodology that can be conducted in small groups without disrupting business operations. The steps are:

1. Develop risk measurement criteria consistent with the organization’s mission, goal objectives, and critical success factors.
2. Create a profile for each critical information asset that establishes clear boundaries for the asset and identifies its security requirements.
3. Identify threats to each information asset.
4. Identify and analyze risks to information assets and begin to develop mitigation approaches.

Microsoft Security Assessment Tool

Although not a methodology, the Microsoft Security Assessment and Planning Toolkit offers “Solution Accelerators” to help IT professionals using Microsoft products target enterprise needs in security and compliance, management and infrastructure, and communications and collaboration.

NIST SP 800-30 Revision 1 – Guide for Conducting Risk Assessments

This National Institute of Standards and Technology publication discusses risk assessment, analysis, and mitigation; and defines steps for the risk assessment process.

Learn more about NIST compliance here.

Information Risk Assessment Methodology 2 (IRAM2) and Risk Analysis Workbench Tool

The Information Security Forum provides a step-by-step guide for security risk assessment models. IRAM2 focuses on internal vulnerabilities and their potential impacts on those outside the organization.

What Are the Five Methods of Risk Management?

Here are five risk management techniques your business can use to identify and address risks quickly, and to prepare for unexpected threats. These techniques can work for any risks, compliance risks or otherwise.

1. Past and future risk identification

Do a historical analysis of past company projects and the risks that affected them; take note of the measures you took to address those issues. Then identify any risks that could potentially affect your new projects. Follow this up by checking each potential threat and the critical risks associated with each threat.

Once you’re done, create a risk register documenting the identified types of risks for future reference.

2. Direct and indirect risk result identification

Coordinate with relevant stakeholders to create a futures wheel diagram to identify every potential risk’s direct and indirect results, including its effect on your project’s timeline, quality, and cost.

Review all potentially positive and negative consequences for each specified risk, as well as subsequent repercussions. We also recommend discussing your findings with stakeholders and documenting possible actions to control, mitigate, or eliminate negative consequences.

3. Risk audits

We’re going to assume your enterprise has a risk response plan (if it doesn’t, prioritize making one now).

At this stage, you still need to examine and document the effectiveness of risk responses and controls as they apply to your new project. Conduct a risk audit to uncover any gaps in your risk management plan and take remedial measures to remove them.

4. Risk action planning

Every documented risk on your risk register should have a corresponding response strategy your project team members can follow.

Here are the four main risk management strategies:

• Risk avoidance: Eliminate uncertainties before they have any impact on your enterprise.
• Risk transfer: Pass risk liability forward to a third party, such as taking out an insurance policy to shoulder financial risks.
• Risk mitigation: Reduce the risk probability below a predetermined acceptable threshold.
• Risk acceptance: Control and monitor expected risks, but don’t avoid them.

By choosing the right response strategy, the project management risk owner and team members will know exactly what to do, responding to business risks quickly while actively controlling mitigation and remediation costs.

5. Contingency planning

Contingency planning is crucial for effective project risk management and mitigation.

Create a tree diagram of the project with all the determined objectives and activities. Then identify potential problems for each element, along with the preventive actions and countermeasures for each element.

Compliance Risk Management Best Practices

Whether you use an existing methodology or start from scratch, there are some best practices for creating a compliance risk management system that all organizations need to consider.

Start with a risk assessment

In any risk management program, one of the most important steps is to conduct a risk assessment. A thorough compliance risk assessment will inform all the other elements that comprise your compliance program: policies, controls, due diligence, and corporate culture.

Unfortunately, there’s no one-size-fits-all approach to conducting a risk assessment. Compliance leaders will need to work with others in the enterprise to understand what the organization’s operating processes are and how those processes might or might not violate regulatory compliance demands. When all is done, however, a risk assessment will help your organization prioritize risks, which will help you determine which risks to respond to first.

Prioritize third-party risk

Today almost every organization deals with a large number of third parties. Because some of the most prominent compliance risks are associated with third parties, it’s important that you perform at least some level of due diligence on all your vendors.

A strong due diligence process should be a central component of your compliance risk management program. And given the sheer volume of third parties most companies now have, make your organization’s due diligence process as streamlined, integrated, and automated as possible.

Stay current with regulations

It’s also important to be aware of any changes to regulations that affect your business. During the risk assessment phase, make sure you understand all the requirements imposed by all applicable laws and regulations, then stay up-to-date with the latest guidance and enforcement policies.

Risk assessments and internal audits can only do so much if you aren’t familiar with the rules your business needs to comply with or you aren’t aware that those requirements have changed.

Build a culture of ethics and compliance

Always remember that compliance programs are really about managing people. After all, security is a people problem, and humans tend to be the weakest link, especially in cybersecurity.

Start by setting the tone at the top. Your organization’s senior leadership should be able to communicate expectations clearly to middle managers and the rest of the organization about the ethical conduct you want to see from employees. It’s also important that your organization’s decision-makers don’t just set the expectations, but actually follow those standards themselves.

A great way to assure your organization is focused on building a culture of ethics and compliance is via security awareness training. Including compliance requirements and framework standards as part of your overall security awareness program can help employees better understand not only what your internal policies and processes are, but why those policies are critical for business operations, cybersecurity, and privacy.

Choose tools to help

Any risk management program will require considerable effort from the organization implementing it. With compliance risk management, there’s the extra burden of staying current with regulatory requirements and changes. That task can be overwhelming on its own, let alone in conjunction with all the other activities associated with the risk management process.

As your business grows, your compliance efforts will need to evolve alongside it. Risk management is a continuous process, as opposed to a one-time exercise. To determine whether your policies and procedures are effective, you’ll need to evaluate them on a regular basis. The best way to do this is by choosing a software solution that can help you continuously monitor your compliance efforts and any changes to the regulatory environment.

Using automation, these tools can also help your organization cut down on the number of mundane tasks associated with the risk management process – tasks that inevitably waste your organization’s time and money if they’re not automated. In addition to eliminating these frustrations, automation can also give you greater insight into, and control over, your data.

Choosing a scalable and flexible compliance management tool can often make the difference between enhancing and impeding your company’s compliance management program. Fortunately, there are solutions designed to help.

Mitigating Risk With ROAR

The RiskOptics ROAR Platform is an integrated cybersecurity risk management solution designed to keep you ahead of threats and mitigate cybersecurity risks.

It provides greater visibility and actionable insights into your business processes, helping you identify, assess, and mitigate cyber and IT risks in real-time. These contextual insights are also useful for making informed decisions and prioritizing investments regarding enterprise security.

Schedule a demo to learn more.

The chief information security officer (CISO) is a relatively new type of C-level executive. As cyber threats have grown in recent years, to the point that poor cybersecurity can jeopardize a company’s strategic goals, boards and CEOs have come to understand the need for a senior-level executive to run security operations and manage vulnerabilities in their IT infrastructure.

A large part of the CISO role lies in compliance activities, such as helping the company to meet its obligations under the General Data Protection Regulation (GDPR) in Europe. That said, as the nature of cyber threats keeps expanding, CISOs are increasingly important to overall risk management – implementing programs to protect the company’s supply chain, assure business continuity, and prepare incident response.

Why Is Risk Management an Important CISO Duty?

The CISO is the executive responsible for maintaining a company’s information security policies, regulatory compliance, and, in the event of a security breach, implementing disaster recovery protocols. The CISO might report to the chief information officer (CIO) or chief security officer (CSO), or even to the CEO or board directly.

As standards and regulations evolve to respond to new digital threats, so too do the requirements for CISOs. For example, several regulations and industry standards mandate that CISOs engage in effective risk management:

• ISO 27001 requires an information security management system (ISMS);
• The Health Insurance Portability and Accountability Act (HIPAA) requires security measures as part of the administrative safeguards rule to reduce risk and vulnerabilities to information.

While ISO and HIPAA require a risk management approach to information security, they don’t expressly require a CISO to fulfill that obligation. Other standards do incorporate the term “CISO” in their language:

• NIST 800-53 defines the roles and responsibilities for CISOs, including the security management within NIST’s tiered risk management approach for a successful continuous diagnostics and mitigation (CDM) program

Beyond regulatory compliance, CISOs play an increasingly larger role in risk management because cyber threats now constitute a bigger risk to companies than ever before. The CISO has never had a larger role to play.

What Are the Primary Risk Management Functions of the CISO’s Job?

The CISO has many responsibilities, from monitoring security risks and managing the threat landscape to engaging with stakeholders to ensure regulatory compliance across all levels of the organization. Breaking out one part of the role as the most important is difficult.

Your CISO needs to be able to review a variety of risks inherent in the current IT landscape.

• Critical systems and data. Increased use of information technology and data requires that you determine what information assets, networks, and systems are critical to business operations. The CISO must ensure the company has the correct data security architecture in place so the business can run smoothly.
• External threat management. The increased sophistication of malicious actors requires a robust security strategy, security program, and protocols that regularly update systems and software.
• Internal threat management. Role-based authorizations and multi-factor authentication establish internal controls over system and network access.
• Vendor risk management. Increased reliance on vendors to manage data collection, transfer, and storage requires companies to monitor and manage their security controls to protect your information.
• Continuous monitoring. Automating the monitoring of internal and external controls enables better identification of network vulnerabilities.
• Business continuity and incident response. The increased sophistication and frequency of cyberattacks requires CISOs to establish and enact appropriate strategies to manage the impact these risks pose.

Successful CISOs take an active approach, constantly scanning the horizon for evolving security threats. This allows them to prevent cybersecurity problems and to have the right security initiatives in place to respond when incidents occur.

To Whom Should the CISO Report?

As awareness of cyber risk has grown in recent years, so too has the seniority of CISO, with more and more business leaders recognizing the need to build their information security awareness. Current best practices suggest the CISO should now report directly to the chief executive officer (CEO), to solidify the role’s importance within the organization.

It may also be wise to keep the CISO and CIO roles. As CIOs often purchase and manage IT assets, a conflict of interest could arise when one person is trying to balance security and replacement costs. When you separate purchasing, deployment, and security duties, that can drive better risk management within your organization.

When Should the CISO Report to the Board of Directors?

It’s a testament to the evolution of the CISO role in recent years that the Institute of Internal Auditors (IIA), Information Systems Audit and Control Association (ISACA), National Association of Corporate Directors (NACD), and Internet Security Alliance (ISA) all focus on the importance of cybersecurity corporate governance in their regulations and standards.

Having the IT security team meet with the board of directors helps both parties to engage in the appropriate risk assessment and risk management strategies. Your CISO needs to communicate the internal, external, and vendor risks clearly, so the board can participate in the required corporate governance.

The Sarbanes-Oxley Act requires your board of directors to exercise oversight. If directors can’t do that, they are not meeting their obligations and may incur monetary penalties or jail time.

How ZenGRC Enables CISO Risk Management

Wherever you are in your risk management journey, our easy-to-use content gives you guidelines for assessing and managing corporate risk.

ZenGRC allows you to incorporate vendor management into your business processes more rapidly. Our Payment Card Industry Data Security Standard (PCI DSS)-aligned questionnaires and task reminders enable faster risk documentation tracking.

ZenGRC’s reporting tools provide easy-to-digest reports with graphics that clearly explain your risk profile, giving your board the information they need while saving you time. It also streamlines reporting to your internal auditor.

ZenGRC provides a single source of truth by aggregating all records, reports, policies, procedures, and control listing in one place. Streamlining the audit process not only saves time and money, but also leads to stronger audit outcomes.

Schedule a demo to learn how ZenGRC can help your company manage enterprise risk.

If your IT stakeholders want a stronger grip on cybersecurity and compliance risk, performing an information security risk assessment is where you begin. This post explores the methodology one should use for that risk assessment, including the different approaches to building a strong information security management program.

How Do You Conduct an Information Security Risk Assessment?

When conducting an information security risk assessment, you first need to identify and understand all the risk-prone IT assets in your enterprise. This step allows you to analyze the weaknesses of each asset in detail, which then lets you understand how to remediate them. These are separate activities in an assessment, and are respectively known as risk assessment and risk analysis.

• A risk assessment identifies and catalogs all the potential risks to your organization’s ability to do business.
• Risk analysis then examines each identified risk and assigns a score to it, using one of two scoring formulas: quantitative or qualitative.

Let’s take a closer look at both methods, and how risk managers use each one to understand information risk and then develop strong compliance programs and internal controls.

Qualitative Risk Analysis

A qualitative risk analysis evaluates the danger of a risk based on its possible outcomes and consequences, and categorizes risks by whether they are source-based or effect-based.

A source-based risk is one that arises from internal vulnerabilities within an organization’s IT infrastructure. Examples include flawed access controls, ineffective firewall configurations, or inactive password restrictions. Effect-based risks, in contrast, occur as a result of an external factor that is introduced to the organization and creates vulnerabilities, such as a new privacy regulation.

Qualitative risk assessment is subjective and based on employees’ judgments and experience. Each risk might be ranked with adjectives such as “low,” “medium,” or “severe,” for example.

Quantitative Risk Analysis

Quantitative risk analysis assigns a numerical value to each risk using algorithms and actuarial information.

A quantitative approach helps risk managers to determine the level of risk via a risk assessment matrix on a scale from low to high risk. These risks might be ranked along the lines of “10 percent probability” or “85 percent likely,” for example.
Using the risk matrix, senior management can make informed decisions about the IT security controls that might be necessary.

IT Risk Assessment Tools

Both qualitative and quantitative analysis support the risk management process because they illuminate your business’s risk profile from different perspectives.
Assessments like those described above help the security team to build a risk profile comparing an IT asset’s value against the potential losses a risk might bring about. That insight also helps risk managers understand which mitigation steps and security policies are effective, and which ones aren’t.
Now that you have a good understanding of the types of risk analysis, let’s move on to the tools that can help you perform a risk assessment.

ISO 27005

ISO 27005 is a standard from the International Organization for Standardization that provides a framework for risk management, but not a specific approach. In other words, it outlines what the risk assessment needs to include, but provides no specific steps to take.
ISO 27005 provides guidelines for defining how risk management relates to your business processes. That, in turn, provides the basis for creating the actual criteria and deliverables for information security risk management. Criteria might include:

• Identifying the impact of specific risks
• Estimating an acceptable level of risk
• Determining what the organization’s risk management objectives should be

ISO 27005 isn’t an approach to determine risk tolerance per se; senior executives or the board of directors should do that. Rather, ISO 27005 is important for risk management because it outlines all areas and risks to be reviewed.

NIST SP 800-30

The National Institute of Standards and Technology published NIST SP 800-30, which defines nine steps in the risk assessment process and explores related subjects such as risk evaluation and mitigation.
The nine steps are:

1. System characterization
2. Threat identification
3. Vulnerability assessments
4. Control analysis
5. Likelihood determination
6. Impact analysis
7. Risk determination
8. Control recommendations
9. Results documentation

Unlike other risk assessment guidelines, NIST SP 800-30 lays out a risk management framework for carrying out the three parts of risk assessment: preparing for the assessment, conducting it, and maintaining the risk assessment report after completion.

NIST SP 800-30 also explores how other organizational risk management processes complement and inform each other. It could also be a complementary approach to other industry data security standards and data privacy regulations, such as PCI DSS (for credit card data) or HIPAA (for personal health information).

What Is a Security Risk Assessment Checklist?

Regardless of the framework you use for security risk assessment, you still need an approach to identify security risks and put an action plan in place to mitigate these risks.

By using a comprehensive risk assessment checklist, you would be able to assure that all IT teams follow a standardized process. Such a checklist needs to be tailored to the unique needs of your organization and the type of assets managed within your information systems. To start with, it needs to follow this baseline checklist structure:

1. Compile a catalog of all IT assets.
2. Identify the risks from a security, cyber security, and privacy perspective.
3. Analyze existing internal controls to identify vulnerabilities and potential threats.
4. Assess and prioritize the impact of these threats to implement control recommendations and safeguards.
5. Repeat the checklist actions at regular intervals.

For a detailed walkthrough of these steps in your checklist, we compiled a comprehensive compliance risk assessment checklist for your reference.

Managing Risk with ZenGRC

When it comes to IT risk assessment (and cybersecurity risk assessment in particular) to prepare adequately against cyber attacks, security incidents, and sensitive data breaches, you can’t leave anything to chance. Errors and omissions from manual processes and inexperienced hands can be costly and detrimental to your business reputation.

That’s why we recommend the ZenGRC risk management software. ZenGRC’s user-friendly dashboards show you what your security posture looks like and which risks need mitigating from security threats, all while tracking workflows and storing the documents needed at audit time.

Schedule a demo to witness ZenGRC in action.