Call us now:
It’s an observation only but when you read the enclosed 2 thoughts come to mind. The first is that NIST are aligning their risk management thinking along with other sectors such as financial services for federal agencies. Formalising risk governance, reporting and management processes, identifying and setting risk appetite, risk identification, quantification and control. In short calculating inherent risk, the management of controls and the calculation and management of residual risk.
The second buried in the text is NISTIR 8170,‚Â ‘Approaches for Federal Agencies to Use the Cybersecurity Framework’. An approach which aligns with other industry sectors and with other NIST standards such as NIST 800-73 and NIST 800-171. Importantly it also addresses COSO the international standard for alignment of risk and controls, adopted for Sarbanes Oxley, AICPA Trusted Services Criteria and SoC 2 reporting.
This approach addresses the implementation of risk management adding governance, strategy, and risk management. It feels as thought there is alignment of thinking between the ownership of risk in the board room, risk appetite, residual risk, organisational strategy, governance and reporting. Which has implications for cybersecurity controls and risk management.
Jason Spezzano Ted Dziekanowski Brian McCarthy
#cybersecurity‚Â #SupplyChainRiskManagement‚Â #CyberRiskManagement‚Â #riskmanagement‚Â #compliance‚Â #cyberinsurance‚Â #insurance‚Â #regulatorycompliance‚Â #regulatoryoversight‚Â #esgrisk‚Â #cyberregulation‚Â #esgreporting‚Â #soc2‚Â #defenceindustry‚Â #esg
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6819161814752862208