Call us now:
A theroetical concept, it is a score that is impossible to calculate for so many reasons. You cannot score cyber, you just have to manage it, by reducing the effects of the risk.
If we argue that over 99% of organisations do not know how many assets they have, how do they calculate a cyber score?
If organisations do not implement a cyber security standard, how do you identify ‘all’ the cyber controls you need to manage residual risk. If they do have a controls framework how do they rate control effectiveness with enough accuracy to score their controls, how do you aggregate the effectiveness of 100 controls?
If you do not assess cyber risk, how do you calculate inherant cyber risk, to enable the calculation of residual risk?
If you can do all of these things, cyber is an unstable risk. Inherant risk, control effectiveness and residual risk change continually.
If you don’t understand and manage cyber threats and vulnerabilities, how do you identify cyber risk, to manage it.
So you think you can calculate a cyber score, that your board may be called upon to discuss with a regulator?
Ted Dziekanowski
#cybersecurity #cyberriskmanagement
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7101177666149433344