Call us now:
A great article. If you can’t measure it you can’t manage it.
There is, and will continue to be a gap between the board and security until there is a meaningful set of quantiative measures which can be used by;
1. The security and technology teams to present that they understand the environment they manage and control.
2. By the board to present a clear picture of the security risks faced by the company, in line with the balance sheet.
3. A working relationship between the board and security, around a common goal. Namely how to secure the balance sheet and protect cash flow.
4. Accepting that security is a complex risk to manage. With many interconnected dependencies.
Cyber is a business risk, it requires the security teams to show that they are aligned with the business and can present a business view of the risk. This requires a knowledge of the balance sheet, P&L and the impacts of security on both.
A suite of risk appetite statements aligned to both business outcomes and quantitative security oversight is key. With KRIs and importantly KPIs aligned with cyber controls, going a long way to bridging the gap between the C-Suit and security teams, addressing the question of how does security add value to the business.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6568396291724890112