How To Respond To Tough Questions From Leadership Teams Faster and Better

Have you ever been asked difficult questions from your leadership teams that you couldn’t answer? How do you intelligently and succinctly respond to the following questions and have the supporting data to back up your metrics and business outcomes?

• Are we secure?
• When was our last security incident, how did we respond and will it happen again?
• Are our critical assets and data protected? If not, what will it take to add protective measures?
• We’re still compliant with all of our regulatory requirements, right?

Regardless of your role in compliance, risk management or information security, these questions can potentially trigger a mild case of anxiety or even a full on panic attack, depending on your organization’s level of control maturity. The way I see it, we have three choices:

1. We can avoid questions like these all together by cowering under our desks or running the other way down the hall (virtual or physical hallway, that is)
   1. For all remote workforce members, please note that the mute button and webcam cover only hide you for about 5-10 seconds, tops, not that I’m speaking from personal experience, of course
2. Piece together a response from a multitude of spreadsheets, meetings, emails, disparate SIEM tool reporting and vulnerability scanning data
3. Face the questions with confidence and ease, armed with accurate supporting data and using minimal effort.

Obviously, option #3 is ideal and option #1 is not really an option, so we don’t recommend you try it! All joking aside, wouldn’t it be much more effective not only to have the answers to the tough questions, but also to automate the process of getting to those answers?

What if we took a more proactive approach instead of simply reacting and responding to emerging threats and incidents?

Current State of Information Security and IT Risk

Given today’s threat landscape, Information Security teams need the ability to rapidly respond to and recover from incidents. In fact, the threat of cyber attacks has never been higher. This makes strategic planning and formalizing risk and communication plans imperative.

According to a Gartner 2021 Baseline Survey for Midsize Enterprises¹, the top three strategic priorities expected from the CIO for the next three years are:

• Security – 39%
• Cloud – 20%
• Digital – 17%

Similarly, a Gartner 2021-2023 Emerging Technology Roadmap for MidSize Enterprises survey indicates that the top area with the highest IT investment within the next year is Information Security at 41%.

CIO’s Top Three Challenges

While CIOs want to protect their organizations, make it secure and prove to customers and partners that they can entrust their sensitive data to the organization, it’s not easily done.

RiskOptics surveyed 50 mid-market CIOs representing IT leadership across multiple industries nationwide to understand their current struggles².

The top three challenges from our CIO respondents are:

1. Limited resources and budget – 42%
2. New and changing regulations – 19%
3. Tracking and maintaining compliance – 15%

Limited Resources and Budget

As your compliance requirements and risks grow, it is often resource intensive to increase the number of programs/frameworks you need to manage, vendor security assessments you must conduct and audits you must coordinate and manage. This is where Risk Management helps. It shows you where to apply resources to reduce your highest risk areas while deprioritizing the lower risk areas. It allows an organization to choose where they apply the highly sought after dollars.

New and Changing Regulations

Ever-increasing regulations, coupled with an increasingly diverse set of business risks and evolving threat landscape, means that businesses need to make sure they are on top of compliance and risks as complexity increases.

The aim is to get assurance to invest resources wisely and that nothing critical or high risk slips through the cracks; otherwise, you wind up in the news and are blasted across social media when things go wrong, regardless of your purest intentions.

Again, better risk management helps you know where and when to apply resources to mitigate your highest risk while ignoring lower risk areas. This is true even when regulations increase in volume or complexity.

Tracking and Maintaining Compliance

Once more, applying risk management can reduce the regulatory burden because risk management guides you to apply your resources to reduce risk in the highest risk areas.

Risk management principles drive better security by prioritizing resources towards the highest risks, which more effectively safeguards business data and assets. In turn, this fosters trust among customers and business partners, ultimately supporting your go-to-market initiatives.

Essentially, Risk Management helps with all of the top three challenges: limited resources and budget, new/changing regulations and maintaining compliance.

Bridging the Gap to a Common Language

Both CIOs and CISOs are now empowered to use risk management activities to achieve compliance and gain a competitive advantage. So that begs the question, how can your organization take action today?

• Stage 1: Plan your risk strategy around strategic business priorities
  • Determine how to communicate risk to the C-suite and Board by using a common vernacular centered around your strategic business priorities
  • Work with peers across the business to balance investments with objectives
  • Create cyber risk programs that optimize cyber risk in a business context
• Stage 2: Automate evidence collection, risk scoring and monitoring in the execution phase
  • Free up time, reduce errors and optimize your teams’ talent
  • Start the shift to a risk-first approach
• Stage 3: Gain actionable insights to help you clearly communicate with key stakeholders
  • Communicate risk in business context. In other words, balance the need to protect with the need to run the business
    • What’s the right amount of security? It’s really the amount that is defensible to your key stakeholders like citizens, customers, shareholders and regulators
  • Focus on outcomes, not metrics
    • Enable business conversations with stakeholders that highlight the true value of security
    • CISOs and other leadership team members need to see data at a roll-up level in a business context. This data is not technical, but rather expressed in business language tied to investments, ultimately satisfying risk appetite³

By shifting to a risk-first approach centered around business outcomes, you’ll be able to answer tough questions from your leadership teams and stakeholders more effectively. To learn more about this and automating GRC, download this white paper by Meghan Maneval, Director of Technical Product Management: Automating GRC: The Next Frontier in Risk Management.

---

Resources

• ¹Gartner, Midsize Enterprise Performance Benchmarks for Information Security, CIO Research Team, 8 December 2021
• ²New CIO Study: GRC Challenges and Priorities for 2021
• ³Automating GRC: The Next Frontier in Risk Management – a White Paper by Meghan Maneval