Call us now:
A good article, are we using the wrong baselines to assess cyber risks, maybe so? The big challenge with cyber risk management is how do you know what good looks like. What to measure and how to measure it to place a level of assurance that the risk is being managed? Leaders want things ‘simple’ and need communications in bite sized chunks to be able to understand and make decisions.
The enemy of cyber is complexity and the problem with complexity is that its difficult to manage unless you know what to control. It is very difficult to provide ‘simple’ for cyber risk management, it is possible to provide a consolidated messages, but not simply control.
In many industries you cannot be ‘vague’, or ‘reasonable’ in oversight. In medical, aerospace or FMCG, vague does not work. Products and services have to be tested and retested, every component, nut, bolt and washer on an aeroplane has been assessed and their manufacturing processes certified, before full scale production. This comes at a financial cost, one which is weighed against safety, brand and reputation. The only way to manufacture product economically, repeatably and safely is to have effective controls and this requires measurement in depth in the first instance; to measure by exception in the second.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6559695091110338560