Call us now:
Gerry Kennedy there’s allot to be said about FOFO, as you would say you cannot ‘unknow’ what you find out, or are told. With the introduction of cybersecurity risk management regulation in the U.S and EU ‘I didn’t know’ may not be a strong defense. As the expectation is boards should assess risks and outcomes, before applying remedial actions.
Cyber risks are not that unique. Cyber standards (NIST/ ISO) were written to remediate documented, understood and defined cyber issues. The Risk, Control Self Assessment (RCSA) process adopted by many banks under Basel III accords has been around a while. Used to assess inherent risks, control effectiveness and residual risk, so there are few surprises. Risk assessment is a process required by US Federal Agencies under FISMA, with the application of NIST SP 800 – 37 – the Risk Management Framework (RMF).
The ‘Fear of Finding Out’ may not stand up under U.S and EU cyber regulator scrutiny. Boards are required to demonstrate they have the skills and experience to ‘Find Out’; that they have assessed the impact of risk; and the effectiveness of risk mitigation.
It’s a reason U.S and EU regulators require covered boards to recruit cyber experts to help them ‘know’.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #cyberregulation #rcsa #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7025890652882104320