1. Mission Statement

• Purposeful connection of strategy and tactics

2. Framework – Part A

• Strategic context (“Who are you and what are you trying to achieve?”)
• Without this, there is no reason for ERM or GRC

3. Framework – Part B

• Foundational underpinning (Culture and Governance)
• Connective tissue existing between strategy and tactics
• Underlying essence; these foundations are in place at all times

4. Framework – Part C

• Tactical Execution (4-Step iterative process: identify, assess, mitigate and monitor)

5. Governance Structure

• Clear-cut roles and responsibilities
• Best portrayal: Three lines of defense

6. Universe

• 4 categories – 3 common (“Finance”, “Operational” and “Strategic”) and 1 unique (“Core Business”)
• Dynamic; encompasses emerging risks
• Aligns with always-changing nature of risks themselves

7. Rating Scales

• Understandable
• Severity, likelihood, direction and velocity
• Inherent and residual

8. Policies

• Major risks (dozen or so)
• Each comprised of: definition; goal; roles and responsibilities (1st/2nd/3rd lines); appetite; tolerances

9. Language

• Succinct; simpler is better
• Don’t throw in unnecessary phrases (“I was able to…”)
• Precise; exact
• Iterative; over and over
• Powerful
• One shot; on the mark; needs to resonate
• Use present tense whenever possible (alive, here and now)
• Pragmatic (understands dynamics, keeps big picture in mind)
• Embedded and actionable
• Positive (figure out a way, convince)
• Purposeful and insistent
• Rigorous and disciplined
• Not merely esoteric, hypothetical or academic
• Put away the pom-poms; self-praise is no praise

10. Reporting

• Risk arrow heat map
• Risk owner report

11. Overall Cultural Model

• Code of ethics
• What do your people do when no one is watching?
• Behaviors you expect and tolerate

12. Risk Culture

• Shared understanding towards risk

13. Deputized Risk Owners

• Subject matter experts
• Hold them accountable
• Don’t be afraid to critique or challenge
• Ensure that people are not just going through the motions (e.g. no changes year-to-year)
• Educate them; understand this is not their day job
• Depend upon them, and their perceptions, heavily
• You are only as good as what they provide
• Be respectful of their time

14. Risk Owner Surveys

• Take the opportunity to ask special, “hot-button” questions each year
• Don’t overdo it

15. Risk Appetite

• High, medium, low
• Tolerances – exact point at which appetite exceeded

16. Configurability

• Collaborate with a vendor having a matching mindset

17. The Fuel of Passion Fuel

• Get excited and stay excited
• How many people have this opportunity?
• Keep turning insights into actions
• Don’t be dragged down by leanness of resources, staggering workload, sometimes-mundane nature of work or undervalued role by others

18. The Importance of Pride

• No slouching
• Do not accept a back seat
• No sloppiness or mistakes should be tolerated; prompts the question – what else is wrong? How can I have confidence in anything?
• It’s a huge job; don’t ever forget that
• Keep the mission statement in mind
• Cognizant of the overall framework that melds together strategic context and tactical execution

19. Transferability to Other Risk-Related Areas

• Every single risk-related area could benefit by adhering to these 20 elements

20. Risk Register

• Organizational (“tree”) view as well as workbench view
• workbench for risk owners
• doesn’t need to be exorbitant $
• seemingly fashionable these days to downplay or disparage importance of the risk register
• ERM One – a viable alternative to:
  • doing without an automated tool or
  • tolerating someone else’s system

Closing Thoughts:

• Get ready for the elevator speech
• Trapped in the elevator with CEO and asked to give him/her your impressions of GRC/ERM priorities in 30 seconds
• No excuses – take the time to do the dirty work beforehand
• Connect the dots, dot by dot
• Build the program, brick by brick
• Bold, presumptuous goal (“World-Class”)?
• Shoot for the moon; even if you miss, you’ll land among the stars
• Common denominators
• Better every day; better than yesterday
• Incremental improvements
• Keep attacking
• Heed the children book classic – “Little Engine That Could”
• Mission: reach the boys and girls on the other side of the mountain
• When it found itself in trouble in trouble, neither a shiny new passenger engine, with all sorts of compartments, or a big strong engine was necessary
• All that was needed was a little blue engine who “tugged and pulled”, “pulled and tugged”
• “I think I can” was converted into “I thought I could”

About the Author:
Michael Cawley is a risk management executive with a 35-year record of broad and diversified accomplishment in the strategic and tactical elements of corporate enterprise risk management (ERM). He performed day-to-day development and execution of a risk management program that covered all elements in the identification, assessment, mitigation and monitoring of all exposures within the corporate risk universe. Specific experience involved being a corporate risk manager for a service-related conglomerate (15 years) and then a biopharmaceutical manufacturer (10 years) before assuming an ERM governance and disclosure leadership role (10 years, through 2021) for a major worldwide financial entity. Currently, Mike serves as a Subject Matter Expert (SME) in an advisory role for ERM Best Practices for the advancement of DoubleCheck’s new ERM One application.

The post Why Settle For Less? Twenty (20) Elements in a World-Class ERM or GRC Program first appeared on DoubleCheck Software.

An ice cream headache, for sure, trying to understand the similarities, differences and connectivity between all these terms.

You need to do it, however.

Simplify, simplify, simplify.

Break it down and truly comprehend everything.

Get ready for the proverbial elevator speech, if the need for one materializes.

Toward that goal, here are several recommendations:

1. Establish Enterprise Risk Management (ERM) as Your North Star

• • This is not meant to diminish or disparage other acronyms but merely to state an undeniable fact that needs to be accepted.
  • ERM is the granddaddy of them all.
  • Every component of all other risk-related acronyms or topics emanates from ERM or the framework established around ERM (Risk Management Framework).
  • In other words, the world revolves around ERM.
  • If you don’t like that fact, get over it.
  • Get on with the business of managing risk.

2. Don’t: Quibble, Be Smarter by Half, or Get Hypothetical, Esoteric or Academic with your Language

• • Every word matters.
  • Take no chances.
  • Leave nothing up in the air.
  • Use precision in all matters in such an important discipline.
  • Several useless debates, for example:

1. 1. 1. Three Lines of Defense vs Three Lines of Responsibility. Use the former.
      2. ERM vs Integrated Risk Management (IRM). Use the former.
      3. ERM vs Strategic Risk Management. Use the former.

3. It’s All About the Risks, Stupid

• • I say this with affection, and as a reminder to myself, as much as to others.
  • Easy to lose sight of.
  • Treat risks as if you are bare-naked; do not rely on the safety blanket of insurance.
  • Remember: in the long-term, you will pay all your losses.
  • Another way of saying this: if a company had the financial wherewithal, it could (and should) self-insure all risks. No insurers, no brokers – just risk managers.
  • Imagine that.
  • GULP! 

4. The Risk Register

• • It can also be termed a Risk Universe; that’s OK
  • It’s not, however, a Risk Taxonomy (ouch, that sounds painful) or a Risk Catalog (when did we end up in the library?)
  • Call it Severity, not Impact, so that everyone in the organization is on the same page.
  • Define Severity in multiple ways, Using a 1-5 Rating Scale (e.g. Financial (% of Capital), Brand/Reputation, Regulatory Intervention, Strategic)
  • For the same reason, call it Likelihood, not Frequency.
  • Define Likelihood in a temporal manner, using a 1-5 Rating Scale (e.g. significant event happening every one, 5, 10, 25 and 50 years)
  • Bottom line: the fewer terms you use and the more rock solid certain those terms and definitions are, the better

5. ERM vs GRC

• • GRC is a well-accepted, more bite-sized, subset of ERM, plain and simple.
  • The R (Risk) in both acronyms is identical – refers to ERM
  • The C in GRC is Compliance, an operational risk in the ERM risk register as well as one of the foundational components (Culture and Ethics) of ERM
  • Finally, G refers to both Corporate Governance, an ERM Operational risk, as well as to another ERM Foundational component, namely Governance. There, the various roles and responsibilities in the ERM equation are definitively laid out (e.g. Three Lines of Defense)

6. ERM vs Compliance

• • As stated above, the C refers to Compliance, an operational risk in the ERM risk register
  • There is nothing to prevent the Compliance function from deciding to further break down that exposure into sub-risks, in order to better delineate and manage on a more granular basis. (The last company I worked for broke down Compliance into 62 such sub-risks)

7. ERM vs Internal Audit

• • Internal Audit plays a vital 3^rd Line of Defense role in all risk matters
  • Audit Planning should align with risk priorities
  • Certain risks on the ERM risk register are more logically tied to Audit (e.g. Fraud); Head of Internal Audit could, in fact, be risk owner for those exposures

8. ERM vs ESG

• • The G (Governance) in ESG has already been covered, within ERM.
  • The S (Social) in ESG can be tracked to the ERM foundational component of Culture (Overall Cultural Model, Ethics and Compliance).
  • E, for Environmental, will align with the Climate Risk particulars enumerated on the ERM risk register.

9. ERM vs DEI

• • There is not a more important risk related acronym on the horizon today than DEI (Diversity, Equity and Inclusiveness)
  • Start before you are ready on this – just get going.
  • If it needs improving, do so tomorrow from the base of today.
  • All of these items (DEI) need to be embedded in your Cultural Model, a vital ERM foundational component.
  • A crucial ERM risk like Human Resources – Management Development needs to be appropriately expanded and honed to yield the type of organization you want. How do you develop diverse talent, then grow and mentor them?
  • You need to operationalize DEI throughout the culture of the organization.
  • Set up key risk indicators (KRIs) in your ERM risk register to allow you to monitor – and constantly improve – your controls.
  • Like ERM, DEI is an iterative, evergreen process.

About the Author:
Michael Cawley is a risk management executive with a 35-year record of broad and diversified accomplishment in the strategic and tactical elements of corporate enterprise risk management (ERM). He performed day-to-day development and execution of a risk management program that covered all elements in the identification, assessment, mitigation and monitoring of all exposures within the corporate risk universe. Specific experience involved being a corporate risk manager for a service-related conglomerate (15 years) and then a biopharmaceutical manufacturer (10 years) before assuming an ERM governance and disclosure leadership role (10 years, through 2021) for a major worldwide financial entity. Currently, Mike serves as a Subject Matter Expert (SME) in an advisory role for ERM Best Practices for the advancement of DoubleCheck’s new ERM One application.

The post De-Mystifying (and Explaining the Connection Between) Risk-Related Acronyms and Phrases first appeared on DoubleCheck Software.

From a vendor’s perspective, GRC refers to an automated suite of capabilities designed to address a broad range of challenges associated with critical disciplines managed by the client (e.g. compliance, risk management, audit, corporate governance etc.), allowing that same company to reduce uncertainty, achieve the entity’s key strategic objectives and meet its stakeholder obligations.

Again, that perspective on GRC, which sounds straightforward enough, is being viewed through the eyes of the vendor.

Probably the same for every vendor, right?

Not so fast.

More holistically, would it be identical to how the client defines GRC?

Another no.

Let’s look at the delineating factors.

From a vendor perspective, what comprises each individual GRC system is totally dependent upon each vendor.

Simply put, not all systems are created with identical features.

The rationale is straightforward and understandable.

Look no further than the broad construct of the GRC umbrella – consisting of risk, compliance and a final element of governance that, drilling down to more specific risks, can be incredibly broad and wide-ranging (e.g. audit, corporate governance oversight, policy management, fraud, model, ESG, AI etc.).

It’s not hard to understand how the inevitable differences in system emphasis and packaging could (and do) result.

As a consequence, the GRC marketplace has found itself flooded with competing vendor-centric solutions, each seemingly in search of the next, new GRC challenge.

A skeptic could argue that each successive GRC solution becomes more inflexible, costly, complex and/or esoteric than the prior one.

With all these drivers, the “ask” of the GRC client often becomes to:

• Accept a system that is unwieldy and inflexible
• Tolerate system features that you don’t need
• Sacrifice other elements that you (or your Board of Directors) really want
• Endure a bevy of reports, scorecards etc. that are neither pertinent nor understandable
• Tolerate service standards that seem average, at best

Needless to say, this is not really music to the client’s ears.

From a client’s perspective, therefore, the pursuit of a GRC solution all too often narrows to a choice that is best termed as “one-size-fits-all” or “take-it-or-leave-it”.

That’s not the way it’s supposed to be, if you roll back the tape and try to comprehend what GRC means, at the 40,000 foot level.  Maybe it’s time to take all this in and perform a sanity check of your GRC system.
After all, system capabilities and design should be all about the client.

With that in mind, how does a client think about GRC and, as a result, how should the vendor “ideally” design the system to meet those client needs?

First, the basic governing premise for GRC needs to be established, as follows:

The profound, pervasive and vitally important challenges that drive GRC emanate from the company, not from the vendor.

This principle, which always has been, and always will be, true, cannot be overstated.

It’s not about forcing the client to perform contortions – and sacrifice functionality – to align with an inflexible, rigid tool.

As a 35-year real-life practitioner in the GRC space (25 years as a corporate risk manager and 10 years in the ERM Governance and Disclosure world), I know whereof I speak.

While the concept of GRC is said to have been created over 20 years ago (2002), the underlying challenges actually constituting those GRC exposures have been around forever.

They were certainly there in front of me on my first day as a risk manager in 1985, well before that “umbrella” concept of GRC was “created” and/or the first automated tool was developed.

Having said that, and mindful that there is no one “best” prescribed system or solution, it can be stated with certainty that a GRC automated tool should possess the following attributes:

• Capable of evolving and growing over time
• Potential upgrades should be straightforward
• Solution must be dynamic, nimble and agile
• As such, it should be configurable
• Can be either modular or holistic
• Data must be able to be shared across modules
• There needs to be cross-functional coordination
• The system must be unified and linkable
• There should be rich, robust functionality
• The system needs to understand the business context of the company (what it does) as well as its culture and stakeholders
• GRC strategy must be aligned with the overall business objectives
• The tactical execution for each of the constituent parts of the GRC automated application must be part of the tool
• Monitoring of GRC system performance must involve a robust, fully-embedded business intelligence platform

With all these features in hand, a unified approach to GRC capabilities within the overall solution should allow a company to leverage GRC information across the enterprise.

By linking key elements across risk, compliance, audit and corporate governance (as well as related disciplines), the solution should be able to streamline processes and maximize utilization of information dashboard and analytics that cross boundaries.

Similarly, linked solutions reduce overlap, share overall insight, reuse work and tackle siloed GRC responses while securing what’s private.

A representative listing of GRC system activities might be, as follows:

Compliance

• Document controls, assess performance, manage exceptions
• Tools to manage regulatory change and document compliance framework
• Test or assess performance, manage remediation and share status results with stakeholders
• Financial (SOX, PCI); Industry (NERC, HIPAA); Departmental (HR, IT)
• Approvals, Attestations, and Certifications

Risk

• Systematic approach to identify, assess, mitigate and monitor risks
• Centers on risk register
• Empower Risk Owners to manage and assess their own topic risk set
• Goal is to collaborate with risk owners and other internal and external associates in a clear and transparent manner
• Board-level reports and scorecards should be available to be generated in order to assess performance and establish risk priorities

Audit

• Program definition based on client-specific reporting
• Management insight into audit execution and planning
• Management review, overrides to final plan
• Engagement planning
• Electronic workpaper management
• Issue and remediation management

Governance

• Policy definition
• Policy review and renewal
• Demonstrable performance

Other GRC-Related Activities

• Model risk surveys, including reliance on Artificial Intelligence (AI)
• Fraud-risk studies
• Cyber risk (information security)

Summary

An “ideal” GRC solution revolves around specific customer needs. Enterprise GRC software that supports Compliance, Risk, Audit or Governance needs should be highly configurable solutions that can be tailored to a company’s users, data and processes. Embedded Business intelligence features should generate dashboards and reports that are needed for internal and external purposes. GRC Solutions should support business processes, not the other way around. Each of the components of GRC are integrally linked to the achievement of a company’s corporate objectives.

About the Author:
Michael Cawley is a risk management executive with a 35-year record of broad and diversified accomplishment in the strategic and tactical elements of corporate enterprise risk management (ERM). He performed day-to-day development and execution of a risk management program that covered all elements in the identification, assessment, mitigation and monitoring of all exposures within the corporate risk universe. Specific experience involved being a corporate risk manager for a service-related conglomerate (15 years) and then a biopharmaceutical manufacturer (10 years) before assuming an ERM governance and disclosure leadership role (10 years, through 2021) for a major worldwide financial entity. Currently, Mike serves as a Subject Matter Expert (SME) in an advisory role for ERM Best Practices for the advancement of DoubleCheck’s new ERM One application.

The post Governance, Risk and Compliance (GRC) – Pursuing the “Ideal” Frame of Reference first appeared on DoubleCheck Software.

Today’s tools are dramatically more powerful, as are the portable systems on which they run. Beyond power, the diversity of data manipulation tools, visual display options, formats, presentation options of color, perspective, and style all capable of publication and distribution through multiple electronic means create limitless opportunity to create and present compelling representations of structured and unstructured data to managers and executives eager for reports on performance, profit, customer preferences, brand value, opportunity, and risk. And that brings us to a significant problem facing contemporary business leadership in the 21st century.

A triad of questions defines the problem:

“Do you know what you need to know to effectively run your business?”

coupled with

“As a result of knowing _____, what action would you take?”

The third question is one rarely asked by senior leadership, in my experience…

“If you had answers to the first two questions, would your management team know what to do with the information?”

A Data Feast Amidst Information Hunger
We have plenty of facts and details about all sorts of macro and micro measures. The proliferation and transformation of business processes into digital methods has given rise to volumes of raw data businesses in the late 20th century could only dream of capturing, storing, and exploring. Risk data was far more subjective, unstructured and lacked the precision available today. The same was generally true for many other data categories covering operating, financial, customer, partner, regulatory and compliance data. Facts alone are often incomplete communicators. And while associations possible through data manipulation tools may be novel and “interesting”, they may not be actionable. For example, relating new customer location data with lunar phase data might create something interesting. But, “As a result of knowing this what action would you take?” We cannot manage the phase of the moon. Also, data presented in charts and graphs doesn’t always tell you something useful. Let’s look at a very simple instance and see how a small alteration can lead data down the road toward useful information.

Here’s a simple bar chart in figure 1: By itself it really doesn’t provide much more than a representation of a distribution of values. Perhaps that’s useful, but the measure of actionable information is nearly zero. Now, let’s add a “goal line” to Figures 2 and 3, where values above the line represent clear success and those below opportunities and challenges that should be explored and addressed. Your results, areas for attention and likely next steps vary greatly even between figure 2 and 3. These are very simplistic examples. Today’s graphical arrays are visually more sophisticated, and analytically often more complicated. The point is, the tool alone is not where the “intelligence” is expressed in Business Intelligence software. The intelligence comes from the interpretation and useful combination of data, which requires prerequisite understanding of what the data is, where it came from, how it was created, and when. While these examples are oversimplified, figures 2 & 3 begin to offer some useful and actionable information by pointing out performance against a standard of expectation, leading to follow-up on what is working well, and what is not, and what performance drivers may be adjusted to help marginal performance cases improve. Those answers may lead to changes in a variety of operating, policy, or process directions to correct performance concerns.

This is an example about one very simple metric, using a very simple graphical representation. Today’s business intelligence (BI) tools can do much more with much more complicated data. If you tracked every possible metric you could measure, and presented results this way, you’d overwhelm even the most knowledgeable stakeholder or leader. Knowing and applying context and conditional relationships helps narrow focus, support drill down detail where beneficial, and bring the real power of business intelligence tools to bear.

What Do You Need To Know?
The oft cited, but very wrong answer is “everything”! It’s just not functional. And you’d be buried in data points that told you nothing useful. Do you drive a car? Examine your dashboard. Where is the indicator for each cylinders’ compression ratio? Where is your brake pad temperature monitor? What?! You don’t know the precise volume of fuel remaining in milliliters and ounces? How are you possibly functioning? But you are. You have all the key performance and status indicators needed to operate and direct your car safely to your intended destination. You have transportation. If there was a problem, and your mechanic were to seek out some of these answers as part of a diagnostic exercise, that more concise and focused context brings in the need for different, and more specific detail. You need to know when something is and isn’t working as intended and designed. When you learn of a problem, you need to inform your specialists with the information needed to diagnose the root cause, proscribe solutions, and test remediated functions. Go back to the questions at the start of this article, to test the utility of the metrics you wish to gather. See how many pass successfully through no.’s 2 & 3. Start with that subset.

You also need to know the key driving chains that influence the metrics you do monitor. This is a kind of technical perspective upon context. For each of your key performance indicators (KPI’s) and key risk indicators (KRI’s) you need to map out what business processes influence those measures, where the source data is gathered that is used to calculate each indicator, how often, where it’s stored, and how it’s validated. This is vital context, that can provide actionable direction should an indicator’s value suddenly shift from expected norms.

So, Where Does BI Fit?
Business Intelligence software is a tool. And, like any other tool, its value is in the thoughtful, careful application by its handler. BI software is really good at helping you explore data relationships. It works best when applied in conjunction with your own knowledge of how your business works. Often the relationships between data values and different metrics may be obvious, and some may offer new insights to how seemingly unrelated processes impact one another. Use these features to explore these unique key driving chains. They may reveal important metrics to incorporate onto your standard “dashboard” of key operating metrics.

There’s an implicit benefit here that may not be obvious. Data silos, created by and supporting of dedicated systems for a specific discipline or purpose may be present across your enterprise. One of the key features of a BI tool is its ability to aggregate, interpret, and represent data from a consolidated variety of sources. This is significant. Without this capability the potential to identify useful key driving chains, letting you identify and represent the most insightful KRI’s and KPI’s would be seriously hampered. Embedding BI functionality within a platform that can collect and store data from a variety of disciplines or functions, such as an Enterprise Resource Planning (ERP) or an enterprise Integrated Risk Management (IRM) solution can deliver significant value through its ability to provide a single, authoritative resource for decision data. Value is created in part through streamlined processes, enhanced efficiency, and simplified system management. Additionally, the ability to manage access, protect confidential data, provide vetted information, and efficiently publish business information through a consistent, reliable portal cannot be overestimated.

BI tools can offer insight into how clients and customers engage your business, help inventory managers fine tune reorder horizons to minimize overstocks and stock-outs, and inform you of sales trends, client preferences, and campaign reactions far sooner than training periodical reporting. Having data and BI tools proximate helps polish efficiency in getting actionable information into managers and leaderships’ hands sooner, so that your business runs with clear vision of the road before you.

Visual Tools, Actionable Information
Visual representation of data is a valuable characteristic of BI tools. We are a visual society. While there are some of us who relate best to columns and arrays of numbers or symbols, for the most part people relate to visual representations of data. Pictures over words. It’s a very powerful method for effectively communicating fact, concept, and relationships. Pictures often traverse the boundaries and nuances of words and speech. Pictograms and charts form an almost universal language of their own. Whether you are working with simple heat maps representing significant risk areas, or double axis charts depicting client attributes and revenues, or more complex and sophisticated arrays, data visualization helps you highlight and pinpoint key messages and information. They are able to take large amounts of relatively complex data and create images that simplify and communicate actionable information messages your leadership can employ to manage your business, and maximize its potential to achieve stated goals. Great visualizations are clear pictures of declarative statements. As a best practice, I recommend visuals be titled by a declarative remark stating exactly what the visual is illustrating. Figure 4 reuses our example from earlier in this article, but  note the clarity the title now adds to the image from figure 3. There can be no doubt about the message, and it immediately leads to a discussion of what’s work so well so often, and why not in the one location with disappointing results. More sophisticated visuals can convey other relationships, changes over time, year over year comparisons, the driving chain influences implicit in your KP/RI’s and more.

BI Tools and Your GRC
Your GRC is an integration platform that can host data about many different risk categories, including operational, financial, third party and cyber to name a few. It’s also a place where regulatory and contractual obligations, compliance, and audit processes may be managed, remediation specified, tracked and reported. This single point repository for overall governance, risk, and compliance is a great place to house BI tools to explore the consolidated data, across these disciplines and actions, to help you identify, explore, analyze, and communicate current performance, key relationships, and potential opportunities to protect and enhance your overall performance. BI tools help you realize and maximize the value inherit within your consolidated data. Product and service performance, both current and predictive are within its grasp. Likewise, critical risks, vulnerabilities and opportunities for leveraged remediation become clear. Potential third party issues, whether supply chain related, or implicit in vulnerabilities they impose on your infrastructure become visible. And so much more.

The investment in a GRC tool is enhanced and brought to maximum value in large part through the business questions it answers, the proactive vision it affords, and the informative support it provides leadership. Your BI tools are the glasses that clarify this world and sharpen your vision of your current state, with enhanced acuity to look towards the horizon and anticipate tomorrow.

About the Author:
Simon Goldstein is an accomplished senior executive blending both technology and business expertise to formulate, impact, and achieve corporate strategies. A retired senior manager of Accenture’s IT Security and Risk Management practice, he has achieved results through the creation of customer value, business growth, and collaboration. An experienced change agent with primary experience in financial, technology, and retail industries, he’s led efforts to achieve ISO2700x certification and HIPAA compliance, as well as held credentials of CRISC, CISM, CISA.

—

Some observations from DoubleCheck Software on Business Intelligence tools :

It is critical to have flexibility and simple tools for extracting BI data from your GRC system into comprehensive, visually informative documents and slideware. Reports 1 & 2 below demonstrate different ways to render information to Management, Board of Directors, and team members. Report 1 (Risk Dashboard) provides a snapshot of the entire Risk Register, including overall Risk Status, Risk Distribution via a Heat Map with drillable values, Risk Distribution over Time, and monetary Risk Impact over Time. Report 2 (Enterprise Risks) goes deeper and provides more specific Risk Details.

Report 1

Report 2

The post Harvesting Information From GRC Data—The Promise of Business Intelligence Tools first appeared on DoubleCheck Software.

• What has worked quite well in the past year?
• What has not, and why?
• What unique challenges do you anticipate for 2022?
• Are there processes that bear attention and refinements
• Are there gaps in what you do that should be addressed?
• Are you aligned to your firm’s business goals and strategy for 2022?

It can be useful to get some input from your stakeholders and key users. Their perceptions, insights, and priorities may offer other perspectives for you to consider. The information you provide to inform decisions and direct actions only realizes its full value if it’s readily available and comprehensible for them. Also include your support resources, in IT, staff education, contributing departments, and management. And if there’re gaps in the program from their perspectives, it’ll be made clear from their feedback. Just including your primary audiences in your review process incorporates them into shared program ownership, which is important of itself.

Features and Processes
Improving your GRC program’s usefulness requires consideration of both. Basically, what and how, and also when. Tailoring here is not so different than tailoring of good clothing (confession: I’m the grandson of a master tailor). You examine fit, identify areas that need alteration, determine what that adjustment needs to be, examine the resources available to employ, decide what you can do to create the best “fit” result, size and mark your adjustments, and execute from there. The first two steps are accomplished through review and feedback. Those help you identify which changes would refine your program to a more perfect “fit” for your business.

Next, consider what’s missing or imperfect. The content here generally falls into two categories, features and processes. For your GRC, features would likely include modules you might want to add, like third party risk management (TPRM), (or activate if you’ve not yet made use of them), or interfaces to other data, internal or external, extended security provisions, even changes to labels and language to reflect norms and culture within your firm. Processes may relate to risk assessment methods, workflows, communications, training practices, even alterations to authentication and permission granting.

Features
Answer these simple questions: “what do we need to know that we cannot today?”, and “How can we get that information?”. Armed with those answers you can evaluate whether you need to adjust a configuration or setting in what you already use, need to integrate a data source that already exists somewhere else within your infrastructure, or in fact, you need to acquire something that will enable you to do what you cannot. This is not just a cost saving exercise. It’s also a design and maintenance management practice to keep your infrastructure as straightforward and contained as possible. Security plays a role here too. Internal data feeds are easier to validate, manage, and secure. Configuration management is a more straightforward approach too, helping to assure your software maintenance path remains relatively linear. Adding modules to your GRC is also a great way to extend functionality, when it’s represented through features designed for that specific purpose. Modules likely will open doors for opportunity to do more than you may need at this moment, but present greater flexibility and resources to continue to refine and extend your capabilities as they continue to evolve. They are also a “hedge” against any perceived desire to insert custom code into your platform as a way to get that information or perform a required process.

I’ve often spoken out against custom code unless your vendor commits to incorporating and supporting it in subsequent releases. (This is sometimes called an advanced feature by some). Many of the biggest maintenance and performance issues I’ve seen have their root cause in some piece of unsupported custom code interfering with a future product release. It’s something to avoid if at all possible. Instead, explore your available configuration settings and work with your vendor to seek a supportable solution. Also keep in mind that custom code is not always the same as customization. Many vendors offer you options (configuration capabilities) and allow you to create custom fields, and to rename existing fields to use language and conventions consistent within your own company’s and industry’s culture. All those changes are consistent with the “no custom code” approach mentioned above. Also, when you do change field names, look for functions that support global changes, so you maintain consistency across panels, modules, and processes. That will keep user training much easier and adoption more rapid.

Processes
Often times, for control or regulatory purposes, or just to further tailor a system to do things “your way,” how you get somewhere is of equal importance to arriving where you were headed. One obvious place to start is with workflow configurations. Have you identified any process bottlenecks from your risk assessments, vendor assessments or onboarding processes (if you have some TPRM functions incorporated within your platform), or compliance management? If so this is the time of year to review feedback from participants and stakeholders, to address those concerns by making adjustment to step sequence, escalation paths, timing, routing, and reporting. If you don’t have a dashboard or some other means for a risk program manager to identify workflow issues and intervene when needed, consider setting up something to make those situations easier to identify. In like manner, you could address any other process workflows in any other areas.

Consider the interfaces your program employs to incorporate data from other sources, i.e., suppliers and partners, regulatory and compliance reviews, internal and external audits, industry data stores (like Dun & Bradstreet), or any others you may use. Have you had any timeliness or interface issues? Is maintenance of these interfaces straightforward? Automated? Do you have clear escalation practices in place if there is a problem? Are these practices documented so backup staff can implement them if necessary? Add these to your review checklist too.

Some other processes to review and tune are end user training, risk assessment, TPRM onboarding, and subject matter expert (SME) reviews wherever they occur. Consider what seemed to be easily grasped by your GRC’s end users, and what required frequent post training support. Also, keep your training aligned with any adjustments made to your processes, features, interfaces, or security provisions. Alterations to user training may have positive impacts upon the performance and experience in those other processes. It’s a good time to examine your risk scoring methods to assure they are clear, make sense for your line of business, and provide a level of clarity and specificity useful to managing the risks under review.

Security is somehow often left behind in these review practices. It shouldn’t be. Your GRC holds a lot of potentially sensitive, and perhaps proprietary data—content you and your partners, clients, customers and stakeholders would not be pleased to openly share. So, are your authentication methods current? How are you segregating and assigning permissions? Do you employ a role based security model? Have you or are you integrating a single sign on (SSO) means of enabling access? How are you administering this? How do you terminate access when the situation merits? Are you using a hosted or cloud based solution? How are you ensuring security there is in line with your needs? Do your processes generate the audit trails and documentation you need to meet regulator’s requirements? Again, tailoring and tuning some of these processes as you look forward to 2022 will add efficiency and strength to your risk management program.

Reporting
Some think there can never be too much reporting. I disagree. There is always room for specific targeted reporting that answers important business questions. The rest is just confusing and disruptive volume…noise. Needing or wanting to know “everything” just means you don’t know what’s important. If a report, dashboard, or other information device doesn’t answer this question, consider discontinuing it: “As a result of knowing this information I can and will now take ____ action.” If the report doesn’t answer a clear business question that leads to a decision to act or not in a specific manner, what value does it provide? Proof you could produce the report? So? I’ve seen many businesses buried in reporting while actionable information starved. Don’t become one of these. The practice wastes money, time, and drains valuable resources best applied to other aspects of your program.

Also, look over your access, publication, and distribution processes for the information reporting you create. Does everyone with current access need it? How difficult is it to access if entitled? Do you push reports out to people or post them securely and enable access? Are they produced in formats that support repurposing where and when it might be wanted? Can recipients create their own ad hoc queries? Or drill into or restrict the scope of distributed information?

Last, are the reports free of jargon, clear and easy to understand, and do they provide meaningful, actionable information within the context of your business? Have you asked your key audiences and stakeholders if they might want new, or additional information, in different forms, or in different frequencies? This is a good time to gather such input and plan for any adjustments in the coming year. Don’t hesitate to challenge requests with that key question. It helps avoid what’s referred to as “report creep”.

Alignment To Your Mission
Annual goals change, missions are less volatile. Was your risk program aligned with either? Both? How does the configuration and capability of your GRC contribute to your risk program’s support of your company’s mission and goals? One approach you may consider is to list your company’s mission and key goals for the coming year. Then list, based upon your 2021 efforts in cyber and IT risk management, the key risks you determine pose the greatest threats to accomplishing those goals and staying true to the mission. Look at the array. Are there areas where your program has identified risks that are not well addressed, do not have methods and resources to monitor, evaluate, prevent or remediate those threats, should they materialize? There are your “hot spots” for 2022! Would you need assets, features, processes or some combination of them to improve your program’s alignment? This kind of analysis positions requests for resources in the context of the business, bypassing the argument of “professional polishing” of a good program for its own sake. The value of your risk program is in its contribution to your business’ mission and success. This is a way to illustrate where you are, how you contribute (beyond the obvious “keep us safe”), where and why you want to refine the program from its current state.

Looking Ahead…
There will always be new challenges, unexpected events, and situations that are completely outside your control you will need to respond to in useful ways. Nobody saw a pandemic coming. Nobody forecasted the “great resignation”, and by sometime very soon there will be additional events or situations to add to that list. Looking forward, assessing risk potential, monitoring the trends of malicious behavior by threat actors inside and outside your company is what cyber risk management is all about. But with careful planning, thoughtful maintenance and refinement of tools, processes and practices, and a critical look to emerging new methods such as AI based monitoring and assessment, digital twins, careful third party management, and automated detection tools, you will position your cyber and IT risk management programs to serve your company, its investors, client and customers well into tomorrow. With a little tailoring, your fit and performance will suit you well, and continue to mature and improve with age.

About the Author:
Simon Goldstein is an accomplished senior executive blending both technology and business expertise to formulate, impact, and achieve corporate strategies. A retired senior manager of Accenture’s IT Security and Risk Management practice, he has achieved results through the creation of customer value, business growth, and collaboration. An experienced change agent with primary experience in financial, technology, and retail industries, he’s led efforts to achieve ISO2700x certification and HIPAA compliance, as well as held credentials of CRISC, CISM, CISA.

The post When Comes December; Tailoring Your GRC Programs For The Coming Year first appeared on DoubleCheck Software.

Now, we are “out” again—sort of. Working remotely at coffee shops, on beaches, travelling through airports, on cruises, aloft in airplanes, sleeping in hotels, meeting in restaurants and cafes. And, since much of our knowledge worker staff were part of that “work from home” crowd of the past year’s sequester, we are out and about with all our portable tech, connecting via public WIFI, and perhaps not being in practice to pay rigorous attention to the rules, policies, and best practices so many of our firms worked to instill in the hearts and minds of those of us who can be remote. This presents a rich opportunity for malicious actors who see a population whose guard may be temporarily down, who may behave in ways that open doors to all sorts of vulnerabilities. These could include ransomware, hacks and breeches of all sorts, stolen devices containing sensitive or proprietary data, malware injections, and phishing attacks, and more.

A Proactive Approach
There are four (4) actions to take at a minimum to address these concerns.

• Revisit your related policies
• Republish key policies, re-educate your workforce and promote best practices for remote working
• Review and reassess your controls and monitoring methods
• Monitor your third party partners, vendors, and suppliers

Let’s look a bit more in detail at each, and see how your best practices for managing cyber risk can be applied to this somewhat unique moment in time not anticipated by anyone in the recent past.

Revisit your related policies
You may have completed a cycle of review at the beginning of the 2020 pandemic. Still, that was with consideration to a substantially remote-in-place workforce. The attention then was to remote device management, WIFI connectivity, access controls, phishing, and perhaps data management practices. In addition, now the best practices for handling those devices in travel situations, use of flash storage devices, physical security when working in public areas, and best practices for storing devices in vehicles or hotels while on the road become concerns again. Small, portable storage devices such as flash drives have become convenient, and somewhat ubiquitous parts of everyday mobile computing. Do you have policies and monitoring practices to manage the use of only authorized devices, ones that are encrypted and only applied to machines under your mobile device management control? Is business use of personal computing devices permitted by policy? What other provisions for remote, but relatively isolated and stationary working were made during the height of the pandemic? Were they temporary or permanent policy adjustments? What exposure does the return to mobility create while these policy and practice adjustments remain in force?

Republish, Re-educate, and Promote
There’s never a bad time to remind everyone of important policy provisions—particularly during periods of frequent, substantial change. Those are times when confusion is at its peak, and clarity is particularly valuable. Use this opportunity to refresh awareness of policies that seemed irrelevant during the constraints of living and working under a pandemic’s restricted mobility. People’s attention may have contracted substantially during that period, and security practices, provisions, and cautions unexercised may have become weak over the past year.

This offers an excellent opportunity to offer a fresh round of end user training to remind staff of basic policies and practices, care for mobile devices while traveling, rules for remote data handling, and so forth. It’s also a good idea to test how well people respond to potential phishing and social engineering scenarios. The feedback and test results of these efforts can be factored into your overall cyber risk and security assessments; comparing current results with past cycles to identify weaknesses and prepare to address/reinforce vulnerable behavior.

Internal promotion of security and cyber best practices, warnings about phishing and malicious social engineering efforts aren’t often recognized as effective cyber risk strategies. But well crafted, short, focused and direct messaging can be effective educational tools that support learning. Such messaging, whether delivered by email, through wall posters, or short videos posted online can effectively sharpen staff attention to security practices and skills that may have been overlooked in the past year.

Review, Reassess Controls And Monitoring Methods
While looking at your policies, also examine the effectiveness of your controls. Are you following a framework such as NIST Cyber Security, COBIT, or HITECH, to name a few? If so, are there new control or revisions to the framework you follow that require incorporation into your risk program. Some frameworks issue guidance on how to handle certain controls. Examine these frameworks to identify controls most likely to have been attended to in a lax manner or seemed less important in the last year. Look at the data from your most recent controls assessment. Were there controls that were frequently left aside, replaced by ad-hoc compensating practices, or frankly ignored? If there are some that many areas reported as unpracticed, you might want to look at their appropriateness to your business processes.

Do your monitoring processes and tools give you the coverage and real time alertness you need to identify and respond to threats as soon as they are detected? How have you adjusted your monitoring devices and alert filters to detect and identify low frequency anomalies? Have you deployed procedures and tools to support remote users’ access to your network via VPN services? Are these appropriately sized to service growing demand? How are you monitoring confidential information flows? Have you deployed a data loss prevention (DLP) solution? And, how are you monitoring the activity and access of your third parties—not just the “vendors”, but the professional service providers, logistics services, and more subject to consideration. And, in some regards, the remote working environment has evolved since the pandemic began. Services such as Amazon’s Sidewalk are now present, offering a blended, and further blurry determination of connection points and the boundaries extended by staff working at home. The continued proliferation of IoT devices has created new vulnerabilities and opportunities for malicious actor entry to your world. Such dynamic change cannot be ignored.

Monitor Your Third Party Partners, Vendors, And Suppliers
When people mention third parties, they often presume vendors. While that’s true, it’s an incomplete description of the categorization. Do you include your service providers, from building maintenance, gardening, HVAC, and general repair in this category? How about delivery services where you have some online interaction? Do some of the services, including professional services, rely upon sub-contractors to fulfill commitments to you (of particular importance if you are subject to HIPAA or HITECH compliance)? Virtually any service that provides electronic invoicing, or provision of services that includes communication through electronic means, even if there is no authenticated access to your network, or exchange of data, should be subject to some measure of care and monitoring to effectively protect your own business. As the world begins to reopen, vigilance of travel, transportation, and hospitality services that were all but eliminated from necessary consideration now must be restored. The category of third party is widely larger than material or service providers alone.

Knowing Where You Stand
So, how do you know where you are with regard to all that’s noted above? It can seem like a lot to track, to monitor, to review, and to analyze. And, it’s why for the growing or well established concern, the acquisition and deployment of a GRC platform becomes an asset rather than an expense. A quality platform can offer the means to function as an information “manifold” to serve as an authoritative point of reference for information, status, and planning for all your risk activities, while relating and leveraging other processes whose information products inform your risk management, whether it be focused upon cyber, financial, third-party, IT, operational, or more. Most importantly, a quality GRC automates routine tasks, reduces the labor footprint needed to manage and coordinate all the activities necessary to manage company risk, while keeping executive leadership informed of current issues, vulnerabilities and opportunities so resources can most effectively be made available. It can also extend these benefits to related practices, such as Audit, and Compliance, further increasing the value/expense benefits provided. Such a platform supports the reuse and leveraging of data gathered through one process area, such as Audit, in areas such as Compliance or Risk. This capability represents an expression of value that exceeds any base monetized calculations of operating savings. It represents real efficiency offering more timely access to reliable information. As the world grows more complex, and the pace of change increases, quicker access to reliable information will become an increasingly valuable strategic and operating advantage to your business and the clients and customers you serve.

About the Author:
Simon Goldstein is an accomplished senior executive blending both technology and business expertise to formulate, impact, and achieve corporate strategies. A retired senior manager of Accenture’s IT Security and Risk Management practice, he has achieved results through the creation of customer value, business growth, and collaboration. An experienced change agent with primary experience in financial, technology, and retail industries, he’s led efforts to achieve ISO2700x certification and HIPAA compliance, as well as held credentials of CRISC, CISM, CISA.

The post Summertime, And The Cyber Risk Is Easy… first appeared on DoubleCheck Software.

Articles abound today in Forbes, in the Wall Street Journal, from large consulting firms, and business schools, (i.e., Accenture, Deloitte, and Kellogg) addressing artificial intelligence (AI) and its impact upon risk management. Some talk about the risks of AI technology, others about how AI will enrich risk management. They all offer insight to technological directions and strategies well suited to large firms with ample financial and human talent resources dedicated to taking leadership actions in this emerging arena. To be frank, we are all surrounded by emerging AI of different capabilities in different places. Staff working at home, surrounded by “smart” appliances, voice activated devices, and new TV’s to name a few are all capable of “seeing” and “listening” to the activity around them; gathering this data and storing it in some provider’s cloud.  This is just one example. Mobile devices are another source of AI “opportunity”.

So, what’s a company to do when they do not have the robust financial and talent resources to acquire and apply AI tools and services to their risk management efforts right now? They take advantage of tools in place, thoughtfully applied, to gain some measure of closure against these possibilities.  AI is in large measure about the ability to churn through endless mountains of data to find obscure but significant trends or associations that would otherwise be difficult to discover. It’s also about machine learning, which also involves massive but efficient data churning and pattern detection and response. AI is not magic. Often, at its roots, it’s not even science, but algorithmic muscling through these data stores. Well, there is some science in specialized hardware like LIDAR, (Light Detection and Ranging) used in smart cars, but we’re not going there here.

If you have a GRC platform solution in place for risk assessment and management, accompanied by or (better) integrated with an effective internal audit process, you have the foundations of data stores needed to address some of these newer threat and risk vectors potentially impacting your business. This affords you the opportunity to use data analysis tools help you achieve some very useful and directive results for your risk program. If your current GRC doesn’t incorporate such tools there are numerous OTC solutions available.

Basic integration of Risk and Audit at the Results Level

Good reporting answers business questions leading to actionable direction.  Some of the key questions to be explored for any cyber risk management program would include these:

• What threats pose the greatest risk to our business?
• What have we done to reduce the risk posed by these threats?
• Are these controls in force and effective? How do we know?
• Have we done enough? What is our risk appetite?
• Are we compliant with commitments in place through regulation and contractual obligation?
• Do we have the resources to assure risk is managed within our needs?
• What processes are in place to identify and manage incidents or breaches when they occur?

The data combined from risk management and audit processes is not the complete set of information a risk solution aided by AI analysis processes could handle.  There are external factors, such as marketplace data, client or customer data, financial and competitive inputs that might also impact comprehensive inputs to threat or risk identification.  But the pair of audit and risk can provide a strong basis for threat identity and risk management. You’ll be able to know what the state of threat identification is within your enterprise. How well current controls address risk mitigation will be clear to see. Risks remaining in place with no apparent management strategy should also be straightforward to identify. Sharing these data with your executive team will enable clear, well informed decisions regarding your current risk position.

The risks and threats associated with the use of AI operationally can be addressed within standard enterprise risk management (ERM) frameworks if you treat the use of AI technologies within your firm as just one more potential source of risk.  The core processes of identification, response, remediation, and such apply to risks associated with threats and attacks employing AI technologies, whether they originate from the operational use of AI by your enterprise, or from attacks enabled through its use by threat actors. This doesn’t mean you should avoid employing AI powered risk technologies when you can, but need to understand fully what they might do, how they work, and how to manage any inherent bias in the algorithms they employ.

Commercial products are often designed to meet a wide swath of market and industry needs.  To do that, some assumptions are likely made about how those businesses behave, how their customers interact, what transactions are most “common”, and what threats are most likely present. These assumptions naturally establish some biases that can often be tuned through configuration, but still impact the results of any data analysis.  So, employing such tools needs to include a thorough review of risks associated with the application of AI. Inherit bias in operations or in risk management tools also exists outside the AI sphere, but human intervention, operation, and interpretation of results often counteract those attributes.

One way to integrate audit, security, and cyber risk is through common controls mapping—understanding which activities and controls contribute to more than one operational or regulatory compliance obligation, security best practice, or help thwart a malicious threat. Looking for consistent patterns in these controls, and then in the data resulting from audit findings, the state of remediation efforts, the frequency of discovery of weak or inadequate findings can all point to trends useful to managing your overall enterprise risk posture.  While AI risk management tools might help automate some of this analysis, these tools are data consumers, and do not have the ability to apply the inherent human knowledge, comprehension, and experience with the operation and performance of any particular business.  For that, experienced human review and interpretation of the data, however arrayed or combined, remains an invaluable contributor to comprehensive data analysis, and the resulting risk identification process.

The common data stores offered by consolidating data from many sources into an AI tool, or through an integrated GRC program with internal and external audit processes, will both lead to opportunity for better informed understanding of enterprise risk and the effectiveness of controls and remediations set forth to address foreseen threats. As always, there are multiple approaches and paths to achieve these informed ends.  AI is useful for large businesses with complex and extensive risk footprints and trained staff to manage these tools, and interpret their findings.  Firms with less complicated circumstances employing strong audit programs and supported by GRC technologies to help consolidate, integrate, and evaluate results from these program activities may be able to achieve much the same ends.  Both approaches benefit from oversight and results interpretation by experienced, knowledgeable people, who can employ what they know to filter inherit bias while taking advantage of the best information before them.  Likewise, as a check or control of human bias, consolidated data from multiple sources helps strengthen arguments for new discovery or positions previously downplayed or ignored because of past practice, habit, or management preferences to date.

Together, consolidating, integrated technologies offer better opportunities for sound risk and security management than siloed disciplines reporting separately and operating independently. They help prevent needless duplication and redundancy of effort, reduce operating overhead, and lead to more complete and comprehensive solutions to address weaknesses and confirm strengths in your risk management program. Artificial intelligence, whether employed to support operational business transactions, or to evaluate risk, will grow in utility and reliability as technology matures.  Meanwhile, its current state will continue to offer risk opportunities for enterprises to resolve. Creative, thoughtful deployment of well vetted and reliable GRC and audit tools will continue to provide sound risk management information to support enterprise leaders’ informed decisions for some time to come.

About the Author:

Simon Goldstein is an accomplished senior executive blending both technology and business expertise to formulate, impact, and achieve corporate strategies. A retired senior manager of Accenture’s IT Security and Risk Management practice, he has achieved results through the creation of customer value, business growth, and collaboration. An experienced change agent with primary experience in financial, technology, and retail industries, he’s led efforts to achieve ISO2700x certification and HIPAA compliance, as well as held credentials of CRISC, CISM, CISA.

The post Integrating Audit and Cyber Risk Management Processes to Address AI Risks first appeared on DoubleCheck Software.

Let’s review what this regulation, enacted into effect in March of 2017, puts forth for financial services throughout NY State.

It begins by acknowledging the growing threat of cyber-attacks and setting forth the regulation’s intent; summarized by these points:

• Promote the protection of customer information and IT systems of regulated entities
• Proscribe regulatory minimum standards
• Allow cybersecurity programs to match the relevant risks and keep pace with technological advances.
• Require each company to assess its specific risk profile and design a program that addresses its risks in a robust fashion.
• Set Senior Management responsibility for the organization’s cybersecurity program
• Require Covered Entities to file an annual certification confirming compliance with these regulations.
  
  

While these points set forth foundational, core requirements and expectations, they bear a strong resemblance in language and intent to the primary components of the NIST Cybersecurity Framework, and now to the proposed revisions to NIST Security Standard 800-53 rev5. And, they offer common ground between what a cyber risk professional would view as requirements for a professionally managed cyber risk program.  They also, through the specific details of control requirements noted in the regulation, describe minimal compliance activity.  NIST 88-53 Rev4 and 5 are built around a tiered approach to structuring information systems security, while offering 18 control families to be addressed, specifically:

• Tier 1 – The Organization
• Tier 2 – Business Processes
• Tier 3 – Information Systems 

And…

Numerous detail controls are noted within the standard utilizing this tiered approach to organization. In conjunction with this, a draft Special Publication known as the (SP) 800-37 Revision 2, and several other Federal standards combine to offer a Cyber Security Risk Framework, noting six (6) core steps:

• Step 1 – CATAGORIZE Information Systems (FIPS 199/SP 800-60) – IMPACT ASSESSMENT
• Step 2 – SELECT Security Controls (FIPS 200/SP 800-53)
• Step 3 – IMPLEMENT Security Controls (SP 800-160)
• Step 4 – ASSESS Security Controls (SP 800-53A)
• Step 5 – AUTHORIZE Information Systems (SP 800-37)
• Step 6 – MONITOR Security Controls (SP 800-137)

This compares well to the NIST CyberSecurity Framework and its core organizing process categories:

All of these standards represent efforts to place scores of detailed, process-oriented security or risk management control practices into an organized structure that makes sense to business leaders outside the professional domains of information services, technology, and cyber risk management. Business-oriented organization of these control, risk, and security practices is essential to enabling useful cross domain conversations and decisions about significance, risk, priority, resource allocation and alignment to organizational goals. It supports creation and application of a standardized, common taxonomy for these discussions, regardless of the details applicable to any single practice, or the technological know-how needed to assure their effective implementation.

Most organizations with regulatory obligations of any substance benefit from these kinds of organizing frameworks in these 10 ways by:

• providing a common structure for comparing regulatory requirements and identifying common controls.
• offering a common terminology to discuss regulatory, security, and risk management requirements and activities.
• simplifying the identification and justification for remediation activities that benefit compliance, security, and risk management, often offering efficiencies where one set of actions achieves a benefit in more than one area.
• enabling efficient and effective allocation of resources to best protect the information assets of an organization, its members, staff, and clients or customers.
• providing a common means to apply best practices for security, risk, and operations methodologies in unregulated businesses, assuring customers their information is protected in a rigorous manner.
• promoting comprehensive internal services to address risk, security, and compliance
• helping organizations sustain currency in best practices regarding risk, security, and compliance.
• recognizing and leveraging the benefits of common controls across multiple processes, disciplines, and regulatory requirements.
• comparison to peers and competitors within your vertical, whatever the dimension
• ready identification of best practices applicable to your most important concerns

Regardless of what path an organization takes, there is clearly a great deal of data that needs to be gathered, managed, organized, stored, and analyzed to support the fundamental processes of cyber risk management, information security, and regulatory compliance.  Any single one would create significant need for structure and careful oversight. The presence of all three greatly increases that workload. 

Some small firms will try to do this using home-grown tools.  I’ve seen many examples of “Management-by-Excel” to address cyber risk, IT risk, regulatory requirement compliance, assessments, remedial action tracking, and reporting on all these fronts. Audit is another area where this malady sometimes takes root. Frankly, even the best of these “solutions” was largely undocumented, required constant attention by its creator, and offered little flexibility to address the changing requirements each of these disciplines is subject to address. It may be a great way to organize thoughts and represent portions of frameworks as they are described to fit an organization’s culture, internal taxonomy, or scope of business. And, it’s good way to organize initial thinking about these risk management practices. But such solutions are not sustainable, responsive to rapid change, nor are they readily extensible.

The advantages offered through using a framework are often best exploited through the implementation of a comprehensive GRC (Governance, Risk, and Compliance) software platform.  In fact, establishment of a program founded upon a framework, even one customized through the adoption of common controls across several standards, actually makes GRC implementation more straightforward. These tools are designed to work with frameworks.  They often can be delivered preconfigured with one or more standards, and some will support creation of customized ones through “cherry-picking” of common controls in conjunction with standard frameworks from other company or regulatory requirements.  But that’s just to start. GRC tools are platforms for leveraging standards and other control sets to facilitate risk assessments, audits, compliance reviews, and more. 

They provide tools for recording remedial activities, (both against audit findings and risk assessments of all kinds), tracking progress of related projects, correlating data from one process or operating discipline with another to cross-validate risk or audit findings, while relating all this accumulated data into meaningful status and state reports managers and executives can use to make informed decisions.  GRC tools and features, properly applied, can lead to greater compliance, security, and operating effectiveness while establishing a means of directing and monitoring cost effective management for IT, operating, and cyber risk, audit, regulatory compliance, and operations.  They support creation of standardized, methodical, documented, repeatable practices that can be managed with equal efficiency in centralized or distributed organizations. They scale. And they are engineered to be flexibly responsive to change. And they can be secured. Their aggregate data is often sensitive, and most support access controls appropriate to such content.

Let’s look back now to the intent of the New York State Cybersecurity Requirements For Financial Services, with some thought to how a framework and a GRC tool might specifically help:

KEY

There is clearly a lot to be gained through the use of frameworks, and of GRC tools.  They add considerable structure and a sense of process firmness to actions and efforts that may often seem unrelated, duplicative, and of questionable business purpose on their own.  They support discipline and enable staff to function as professional process managers with regard to cyber, IT, and operational risk, while contributing those benefits to audit, compliance, regulatory review, and other areas benefiting from sound risk management practices.

Compliance with regulations is, for many industries, a practical matter that’s part of business as usual. Frameworks of controls and practices, supported through careful, thoughtful implementation of quality GRC software tools, can bring these benefits of structured professional management to this challenging aspect of contemporary business. It certainly would be of great benefit to managing compliance with the New York State Cybersecurity Requirements For Financial Services Companies.

About the Author:

Simon Goldstein is an accomplished senior executive blending both technology and business expertise to formulate, impact, and achieve corporate strategies. A retired senior manager of Accenture’s IT Security and Risk Management practice, he has achieved results through the creation of customer value, business growth, and collaboration. An experienced change agent with primary experience in financial, technology, and retail industries, he’s led efforts to achieve ISO2700x certification and HIPAA compliance, as well as held credentials of CRISC, CISM, CISA.

The post Applying NIST Standards to Managing Cyber Risk and Regulatory Compliance first appeared on DoubleCheck Software.

Once upon a time, people paid cash for their purchases. Credit cards were few, and the idea of “paying on time”, even through a credit card, was shunned whenever possible. So when people needed cash, they went to a bank, stood in line, and interacted with a bank teller. If they were not well known by their branch staff, they had to produce identification on the spot. Simple, safe, secure. Then ATM’s were introduced. They offered convenience, and were accessed using a plastic card indistinguishable from a credit card… familiarity, acceptance. Early ATM’s were often called cash machines (or automated teller machines) because they did little else but display balances and dispense cash. (Human Tellers did more). And using a card to gain access, coupled with bank marketing of the convenience and ease credit cards offered, began our love affair with both. The growing foundation of computerized account management, transaction processing, and funds transfer made possible by investment in mini and mainframe computers in central data centers, joined through dedicated communications networks, made everything seem effortless. And safe and trustworthy. There were humorous stories of people trying to “rob” ATM’s by hauling them away only to have the ATM yank their truck axles from under them… Credit card fraud was rarely reported. Everything was secured by 4 digit PIN’s, or maybe slightly longer ones used by a cautious few. “Good people” everywhere used both technologies.

Scaling computers down to tabletop or desktop size, complete with software to do useful things like record and manage financial and statistical data, automate document production, and prepare visual representations of ideas, plans, and results positioned them as work machines. Graphical user interfaces made them approachable by people outside of business, but they remained isolated tools for specific tasks. Dial-up services provided early access to remote resources, and exposed machines with no security provisions aside from a user ID and password to open an onboard account to anonymous access from afar. One week after my first purchase of a travel map from a dial-up service, my credit card was compromised, though the event was caught by my bank. Even then, in the 1980s banks had begun to monitor user credit card buying patterns and flagged suspicious out-of-pattern behavior. Banks had always evaluated risk as part of doing business. Customer computer use for retail events was just another risk. They had a jump, for the time being, on this emerging phenomenon. But people had no frame of reference, no history, and little or no available education about the possible cyber threats developing in parallel to the technology. Events were isolated, and often investigated, “handled”, and filed away, unreported outside the impacted organization. Education and awareness were limited to the small population of curious and aware computer scientists.

Computer viruses came into being in the 1980s too, first passed through shared disks, then, online boards and services, and finally, with the arrival of the internet, they achieved mass distribution. Steve Jobs may have thought he changed the world with the introduction of the first Macintosh, and its user-friendly graphical user interface, but Tim Berners-Lee and all those who contributed to the internet gave everyone a reason to have a computer, and to use one. With the internet, email, and electronic commerce, retail (in specific), brought convenience to the public once again. Chat followed email, first as an add-on, and later as a stand-alone application. Communication to anyone anywhere became quick, simple, and affordable. Shopping became easier than going to the mall, as working hours and family demands created lifestyles and needs outside traditional retail hours. It was like the invention of the telephone all over again, but now with pictures, products, video and so much more; and it was interactive!

But these feature and service advances rapidly outpaced consideration, attention, and effort to make them safe and secure. New software technologies, then called object-oriented programming, led to thoughts about new platform architectures where small dedicated programs called “apps” would define the overall utility of a computing device. Security was not at the forefront of the promotional seminars and workshops I attended on these advances. All too often I sat in meetings where security staff with awareness of cyber risks were silenced as the “product prevention” people, always asking that projects slow down to engineer security provisions into new designs and new product or service features from the start. But, in the rush to be first, to be better, to compete in a fast-paced marketplace of rapid innovation, developers and management everywhere adopted product development methods based upon multiple successive iterations to refine offerings, often leaving security to a “future release”. Scant start-up resources were prioritized to deliver competitive edge, and security was not in the public’s mind as a competitive feature. The “homes and businesses” were going online fast, with unlocked doors and open pathways to personal and financial information. It did not take long for malicious actors to begin to realize what was there for the taking, and begin its harvest in earnest.

Cyber criminals, first individuals or small groups of actors, later forming more organized and professionalized groups, were more technologically sophisticated than the user population they exploited. And, early on, services and firms did try to first warn and defer responsibility for security onto the user. Market resistance defeated that effort in relatively near term. As increasing awareness of viruses created demand, anti-virus and other security software products made way into the marketplace. Even novice end users began to be aware there were risks associated with online computing. Hardware vendors bundled anti-virus software with new computer purchases. Revenue streams were created to assure continual streams of updated anti-virus signature data to keep these products current and useful. Financial institutions, with much to lose, were often at the vanguard of security and cyber risk response, leveraging their past efforts to strengthen rules, user education, and protective technologies to detect, deflect, and recover from cyber intrusions. Multi-factor authentication and strong passwords became common features. News media began to investigate and report cyber breaches and crimes that threatened users’ ability to maintain and control their own personal identities. Horror stories of identity theft, financial loss, and the difficulties of recovery become commonplace. We had trusted too long, and paid too much for convenience.

Today the marketplace is much more aware of the risks associated with cyber activity. Security is a competitive advantage. Legislation governing breach reporting requirements is in place in every state, though no Federal law is currently on the books. Cyber security and risk management have become an important component of product and service development, at least more so than in the 1990s and early 2000s.

But we still repeat some of the mistakes of the past. Smart phones, other mobile devices, and social media’s rapid rise to ubiquity all too often have followed the path and errors of their larger desktop and laptop cousins. Security was not always a top priority, and today there are still concerns about shared data across apps and hacked access into smart phones though near field point-of-sale terminals, or social media platforms. Those issues are still being worked today. Device security is getting stronger. As mobile devices extend and blur the boundaries of corporate enterprises tools, processes and technologies are following closely to help manage and police device configurations, activity, authentication, and authenticity. App sources now scrutinize new product candidates for security provisions before publication.

Those processes are not perfect. The technologies underpinning social media platforms remain largely open and rich with aggregated user data subject to distribution and repurposing agreements that drive revenues under the radar of most users. Attorneys protect their client firms with vast, detailed end-user license agreements (EULA’s) that few read and fewer fully understand. But these platforms remain rich, inviting targets for malicious actors. User data, more than any other form, has truly become a form of currency with value at least the equal of any bitcoin.

The matter does not stop at social media and mobile platforms. Artificial intelligence creates an opportunity for gleaning more useful data from raw forms. Monitoring devices on streets, in stores and homes, in cars, and recently now at airplane seats are gathering more and more raw material to share with firms that will cultivate it into value and revenue streams. These technologies and practices open questions about individual privacy, ownership, and law. They also carry their own forms of cyber risk. Once again, now and in the foreseeable future, cyber risk and security professionals will need to continually evaluate, develop and refine processes, education, and technologies to identify, measure, and manage these risks as they enter modern life throughout developed and developing societies.

We have reached a point where the pages of technological advance, security, and cyber risk, must now turn as one. Cyber risk and security must take advantage of artificial intelligence, monitoring, and social platform management technologies too. Detection and identification of cyber threats will gain complexity as data gathering and repurposing gains diversity and complexity. Risk and security professionals must ensure the foundations of their programs form a solid basis for extended scope and sophistication in the future. Frameworks, tools, procedures, and processes will all be important attributes of any cyber risk program. Lawmakers, legislators, and ethicists also need to weigh in on how best to enable progress while preserving some reasonable level of personal privacy and safety.

It’s a long way from the stand-alone piece of automated machinery to our interconnected “smart” devices and practices. There is a dependence upon many connected services now, for finding our way in cars, keeping track of important dates, making purchases, staying in touch, and on and on… the list continues to grow, as does our dependence upon these technologies, ones to come, and the data cache it all creates. Now everyone, users, makers, security folk, lawmakers, and even apparent bystanders must become equally “smart” about security and managing the associated cyber risks of an ever-connected society.

About the Author:

Simon Goldstein is an accomplished senior executive blending both technology and business expertise to formulate, impact, and achieve corporate strategies. A retired senior manager of Accenture’s IT Security and Risk Management practice, he has achieved results through the creation of customer value, business growth, and collaboration. An experienced change agent with primary experience in financial, technology, and retail industries, he’s led efforts to achieve ISO2700x certification and HIPAA compliance, as well as held credentials of CRISC, CISM, CISA.

The post Once Upon A Time in Cyber Land…From ATM’s to AI and Beyond first appeared on DoubleCheck Software.

• First, it seemed to target Mac OS, which is a rarity for technical (its UNIX roots) and opportunity (tiny user population compared with Windows) reasons.
• Second, the “malice” was limited to the ultimate introduction of adware.
• Third, the code was concealed through the use of stenography (hiding code or other content within a picture or other object).

At first glance, this seems to be a fairly sophisticated threat and one requiring a good amount of technical skill and resources to combat effectively.  Sometimes, appearances are more deceiving than code concealed by stenography. How the image’s embedded code was translated into action is not material to this article.  For those of you who are into those technical details, you can find them here: Malvertisers target Mac users with steganographic code stashed in images – Ars Technica

What’s important to this discussion was that the code embedded in the image redirected Mac users to a website that served display ads.  These ads falsely claimed a visitor’s Flash Player was outdated and offered an update. Executing this “update” actually infected the user’s machine with something called Shlayer.  It’s a trojan, first noticed about 11 months ago, used to install adware.

While adware is a nuisance, it’s not an existential threat by itself.  Which is fortunate.  As a cyber risk professional, what’s the risk in this scenario?  Is it preventing adware from distracting users?  Gathering personal information and sharing it outside the company? A bit, perhaps.  And what remedies would you recommend be deployed? More monitoring of the periphery for and blocking inbound malware concealed with increasing sophistication?  Further strengthening platforms at users’ locations?  Restricting what platforms may be tied to company networks? Adding network monitoring technology and staff? All of these? Others?

The real risk is in user behavior. And uninformed, unaware users are an existential cyber risk! The approach of the malware attack just described fails completely if targeted users are mindful of where they go online; what and from where they download updates and other files; examining and vetting sources first before acting. It doesn’t matter that the redirecting code was concealed in an image and invisible to the user’s eye.  It doesn’t matter that stenography might defeat many malware monitoring technologies. And it doesn’t really matter that some users were working on Mac OS platforms.

What does matter is that users freely, and perhaps foolishly, trusted an unfamiliar site and chose to initiate a software update from an untrusted site.  THAT is how the malware/adware was installed!  The risk is that people may act in unsafe ways, from a cyber security perspective. They may ignore rules, policies, and published practices. Thoughtless action by users, both on staff and from supplier organizations, have been the root cause of several recent significant cyber attacks.  Not everyone has been “fortunate” enough to just receive adware in a download…much more malicious code could just as easily have been substituted, with devastating effect!

The beginning of each year is a great time to evaluate your cyber risk program from the perspective of user training and awareness. It’s a time when we are all looking out at the year ahead, formalizing plans, and preparing to execute them. This is the perfect context for considering cyber risk. What are the obstacles that would derail your organization’s plans, achievement of its goals, and progress for 2019? What cyber risks were most prevalent in your experience in the year just passed? What incidents occurred, and, more importantly, what was their root cause? How likely are they to recur and what would their impact be now?  How many might not have materialized had users been better informed and trained? Have new controls been implemented? If so, how aware are users of any controls that require a change to their behavior?  How are you planning to evaluate how well these have been understood and adopted across your user population?

A well-formed user awareness program is the first, and in many respects the strongest cyber risk control to implement across an enterprise.  Answering these 10 questions may help you address this “educational” risk:

1. Do you have a plan for evaluating the effectiveness of your current user education program?
2. Are policies and procedures current?
3. Are users subject to at least annual refresher sessions on key practices?
4. Are pro-active processes in place to broadly communicate procedure and policy changes when they occur?
5. How do you measure user awareness and adoption?
6. What aspects of cyber security need more attention in your education program?
7. Are there plans to strengthen them?
8. Do you have evidence of your current position and where you need to be to support resource requests from Executive Management?
9. How do your most recent cyber risk assessments support your assertions and plans?
10. What leading metrics are monitored to identify a user awareness problem before it leads to a “front page” incident?

An entire category within the core function PROTECT of the NIST Cybersecurity Framework v 1.1 deals specifically with user awareness and training;

NIST also indicates where this imperative maps to other standards related to IT, risk, and security management.  Specifically:

• CIS CSC 17, 18
• COBIT 5 APO07.03, BAI05.07
• ISA 62443-2-1:2009 4.3.2.4.2
• ISO/IEC 27001:2013 A.7.2.2, A.12.2.1
• NIST SP 800-53 Rev. 4 AT-2, PM-13

Depending upon the content, structure, and frequency of your risk assessment program you may have considerable data built into your current risk processes to evaluate your current situation. Combining these data with results of training efforts, communications programs, user testing (you do test how your users respond to possible phishing attacks and unvetted communications like those in this article, I hope) and incident tracking may offer a comprehensive understanding of strengths and opportunities for your user education program.

User education is a foundational practice.  It enables many other controls essential to cyber risk management, including access control (logical and physical), authentication, supplier management, and more.  Treating it as such will strengthen your overall risk program and help it yield results that will justify continued attention, support, and resource assignment from your Executive Management. And, it will help you assure active, effective, cyber risk management!

Note: Another article, The Oft Transparent Link in Cyber Security’s Risk Chain — People! addresses many of the aspects of staff education critical to effective cyber security.

About the Author:

Simon Goldstein is an accomplished senior executive blending both technology and business expertise to formulate, impact, and achieve corporate strategies. A retired senior manager of Accenture’s IT Security and Risk Management practice, he has achieved results through the creation of customer value, business growth, and collaboration. An experienced change agent with primary experience in financial, technology, and retail industries, he’s led efforts to achieve ISO2700x certification and HIPAA compliance, as well as held credentials of CRISC, CISM, CISA.

The post Addressing the Right Cyber Risk…. An Example first appeared on DoubleCheck Software.