Recommendations

Solutions to common CRQ problems.

Obtain stakeholder buy-in. Identifying stakeholders and obtaining their buy-in is imperative throughout any kind of transformation process, including a CRQ program. Banga expresses that to be successful, organizations “need to make sure [they] have a mandate from the very top. Cybersecurity fails if it is not blessed by the leadership of the organization.”

Leverage a program that addresses business needs. According to Gibbler, “what we hear most often is frustration with existing cyber risk management practices coming up from security and risk managers and down from senior management and boards of directors. Vulnerability scans, controls on maturity scores, assigning colors or numbers to risks based on votes around the table – none of these common approaches and others like them give useful decision support in terms the business needs.”

Your data does not have to be perfect when you are getting started. Ward cautions organizations to “recognize that you’re not looking for 100% clean data.” Organizations should consider “the controls that are in place, what the crown jewels are, what your systems are sitting on top of, and what adversaries have an interest in coming at you. Do not convince yourself that the data needs to be perfect. Start with what you have and refine from there.”

Ensure that your objectives are focused. When organizations begin assessing their security risk, their “fix it” list can become lengthy and overwhelming. To avoid losing track of risks or not properly treating them, Ward recommends that organizations elevate their program as the “north-star guide for how you prioritize your operations.” This includes having a business conversation with the risk outputs, exposing to stakeholders what they need to know, and buying into a strategy that does not redirect resources when they it focuses on priority objectives.

Find the balance between people, processes, and technology. Ward explains that organizations must “seek ways to get to the quantified output that doesn’t add more complexity to the organizations or require a massive strain on resources. Look for automated ways to calculate cyber risk as compared to a highly manual, resource-intensive approach.” Banga further expands that organizations “have to carefully look at how [they’re] going to minimize or mitigate risk to an acceptable value with the right allocation of time and the right allocation of people in your program.”

Don’t put all of your eggs into the “maturity” basket. According to Banga, “Maturity levels are reactive, relative, and checkbox items – they’re opinions. Opinions are important; they’re how you interpret data, but they should also be balanced by quantifiable data. The best results come from CRQ approaches that allow you to program the system, so it accurately reflects your business or organization with a specific threat landscape.”