Call us now:
U.S Federal government has had risk management in place for 20 years with FISMA, a risk based framework for the management of cybersecurity (information). FISMA unfortunately has had a patchy implementation with a poor record of compliance across Federal government. But it may have served a purpose as it has been driven by some agencies into the fabric of their organisations, used to create the frameworks for a risk based approach for cybersecurity risk management. That appears to be coming down the road with cyber legislation and regulation. See the SEC 2021 FISMA audit findings.
Risk based cybersecurity is on the horizon with the SEC proposal, EU NIS 2.0 and DORA being examples that specify the need to implement cybersecurity risk management frameworks. Cybersecurity risk management legislation will require the assessment and management of cyber risk in the context of organizational enterprise wide risk. This is going to create, challenges for many organisations and their CISOs least of all the implementation of the risk management framework and associated cybersecurity programs that regulators expect boards to oversight and attest.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #cyberregulation #riskmanagementframework #governance #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6975355073459585024