The appropriate risk management framework, that includes identification, qualification, mitigation and reporting is important to convey the state of

← Back to Blog

The appropriate risk management framework, that includes identification, qualification, mitigation and reporting is important to convey the state of cyber-risk management to the board. The US first published the Federal Information Security Modernization Act (FISMA) in 2002, updated in 2014 with proposed updates in 2021. It forms a foundational pillar for cyber risk management by Federal Government and requires the adoption of NIST SP 800-37R2. Being adopted by the US DoD through DoDi 8510.

NIST SP 800-37R2 is a good starting point for risk quantification and cyber-risk management. Converging external threats and known vulnerabilities into a risk taxonymy and CSF profiles as a controls taxonymy creates a robust cyber risk management program.

Ted Dziekanowski Brian McCarthy Jason Spezzano

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6867016387412418560