Call us now:
An interesting article by McKinsey on Model Risk Management(MRM) for Cybersecurity in Banks that is worth a read. In many ways MRM is analogous to the cyber insurance underwriting process in its complexity. But used amongst other things to demonstrate a repeatable evaluation of cyber risks management and costs for capital requirement and adequacy.
The banking industry is far ahead of other industries in its management and oversight of cybersecurity, but in my experience MRM is a significant challenge. The complexity of cybersecurity risk management, that can be evaluated simply by considering the NIST CSF of ISO 27001 controls environment, makes cyber difficult to control and difficult to evaluate to any level of accuracy. We have not yet gone far enough down the road of automated control (OSCAL) to make control oversight and assurance accurate. Or addressed the correlations between control effectiveness and cyber threats.
However aggregated inherent risk exposure can be evaluated, providing a top line number for cyber exposure. Creating a model that does not require a detailed risk management approach and provides an indicative view of financial exposure. As the article outlines there are some fundamental steps to consider ahead of time.
Ted Dziekanowski
#theausustagroup #cybersecurity #cyberriskmanagement #modelriskmanagement
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6968161736075919360