Managing risk is a balancing act for organizations of all sizes and disciplines. While some organizations take on too much risk, others arguably do not take on enough. Complicating this equation is the emergence of cyber as one of the most impactful sources of risk in the modern enterprise. In fact, cyber security is now increasingly reviewed by corporate boards of directors and often discussed with financial analysts who see cyber security risk as an imminent and paramount business risk. Because the consequences of cyber security failures can be damaging to business revenues and brand reputation, CEOs have lost their positions as a result of data breaches and inept preparation and planning.
According to Deloitte Advisory Cyber Risk Services “the fundamental things that organizations undertake in order to drive performance and execute on their business strategies happen to also be the things that actually create cyber risk. This includes globalization, mergers and acquisitions, extension of third-party networks and relationships, outsourcing, adoption of new technologies, movement to the cloud, or mobility. And they are not going to stop doing these things any time soon. Cyber risk is an issue that exists at the intersection of business risk, regulation, and technology. Executive decision-makers should understand the nature and magnitude of those risks, consider them against the benefits a strategic shift would deliver and then make more informed decisions.”
Accordingly, organizations must now factor cyber into their risk appetite and explicitly define the level of cyber risk that they are willing to accept in context of their overall risk appetite. This paper will provide a foundation for organizations looking to better understand cyber risk including; a systematic process for defining and comprehensively categorizing sources of cyber risk, a description of key stakeholders and risk owners within the organization, and finally, outline the basics of how to think about calculating cyber risk appetite.
No comments yet