Manage the risk your business faces

A BIA enables you to identify and document critical business processes and their underlying dependencies, as well as the assets associated with them and ranks them based on criticality. It considers both technical and non-technical factors as dependencies such as physical assets, people, information assets, facilities, and systems. The BIA reveals how those key operations, processes and business functions would impact business continuity if they were hindered or eliminated. These impacts should consider loss of sales and income, information, delays, increased expenses, regulatory fines, contractual penalties and loss of customers and staff. The BIA identifies critical business processes and their supporting elements, helping you understand your environment, and what is most important, before you take steps to protect it. Conduction a BIA is also the initial step in creating a Business Continuity and Disaster Recovery plan.

A Risk Assessment is a quantitative and qualitative process that will identify threats, vulnerabilities, and regulatory requirements that apply to your respective business processes and underlying dependencies. The assessment will consider the likelihood of the risks happening. It will then calculate potential impact if those threats were actualised and produce a risk output rating. The organisations Risk Appetite is also considered, which is the degree of risk they are prepared to accept. Quantitative Risk approach is based on factual or statistical data to support the impact and likelihood whereas qualitative is largely subjective but backed by agreed rationale to back it up. The output of the risk assessment gives management invaluable information to understand and prioritise the risk facing the organisation. It will create a Risk Register which is a tool that consolidates your risk assessment results into one place. This will be the starting point for focussing resources to mitigate risks by implementation of controls. A Risk Register is a live document and should be reassessed periodically.

Controls are actions that need to take place to reduce risk. They provide details on how to mitigate or minimise risks, assign responsibility and instruction on how to implement. There are a number of industry pre-packaged cybersecurity control frameworks available, Archway Securities uses the ISO 27001/27002 series of controls. These can be customised and implemented for your organisation. Controls provide structure and focus on the activities needed to minimize the risks to the organization. It provides an opportunity to document the entire decision making process and demonstrates that the organization understands the threats that’s the controls cover and have adequately applied them or used other compensation controls based on cost-risk analysis. They can be used to communicate to the management, staff and regulatory bodies that the organization takes risk management seriously and actions have been taken to mitigate. Controls are an essential part of any accreditation including ISO 27001.

Controls once implemented need to be tested and validated to ensure they work as expected. There are various testing techniques such as penetration testing, additional risk assessment, internal audits, compliance assessments, fail-over testing, back-up recovery testing and the like. Testing and validating the controls give the organization the confidence that they are working. Periodic assessments should be carried out to reassess vulnerabilities considering new threats or changes to systems or business processes. Risks can be given new risk scores, called Residual Risk, based on the testing and documented in the Risk Register. This will in turn improve the overall risk score for the organization. Testing and validation will provide a means to demonstrate progress to the management, compliance and regulatory bodies that controls are in place to mitigate risks. In addition, it lays the groundwork for creating gap remediation and escalation processes.

Rince and repeat. The previous 4 phases need to be incorporated into a business process. Risk Assessments should be carried out at least every year. Businesses evolve and change, new processes and systems are implemented, there may be gaps in the controls, and cybercriminals find new ways to attack organizations and their assets. Reporting mechanisms should be put in place to enable employees to identify and share potential risks, control oversights and weaknesses. Continuous governance will instill a cybersecurity awareness with stakeholders, will drive accountability and consistency for control implementation and assessment. It will highlight non-compliant stakeholders and gaps in the process or the need for additional policies or procedural documentation. Undertaking a risk-based approach has many benefits for an organization, including prioritized risk scoring that is specific to the business, controls that are tailored to your business processes and systems as well as a continuous cycle of monitoring and addressing risks and vulnerabilities.