Cyber is an enterprise wide risk. As all organisations create, transmit, store and consume data, enterprise wide, then cyber can have an impact

← Back to Blog

Cyber is an enterprise wide risk. As all organisations create, transmit, store and consume data, enterprise wide, then cyber can have an impact enterprise wide. So it is important that cyber risk management is integrated into the broader risk management practices in the company. Cyber risks are considered in line with business strategy, operations, financial planning and people processes.

So NIST has released a draft proposal for the integration of Cyber Risk into the broader enterprise wide risk management process. A good start.

A question? Does anyone have a view on how to assess the impact of controls on inherent risks. Where more than 1 control impacts the risk. For example asset management, access management, and patch management on web security? How do you assess the impact of these controls on say the risk of ‘failing to secure the companies website can result in the theft of client data’

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6650702518215065600