Authors

Image of Ashwin Pal, Partner in the Risk Advisory division at RSM Sydney. Ashwin specialises in privacy and security consulting, governance, risk, and controls advisory, IT security testing and compliance, cyber risk management, cyber security transformation, and security technology implementation for clients in energy, utilities, government, health, mining, and manufacturing sectors.
Ashwin Pal
Partner

Having worked across all of Asia Pacific in previous roles, RSM's cybersecurity and privacy specialist Ashwin Pal has seen and experienced how things are done broadly within the region. 

One of the things that have cropped up a few times is the apparent divide between risk and cyber security.  And this is unfortunate as where we have seen this done well (risk and cyber security working together), the level of security maturity overall, and awareness of cyber security risks among Boards and Executives seems to be greater.

The obvious question that arises is why should risk and cyber securitycyber security work closer?  The short and simple answer is so that cyber security risks are appropriately understood, documented, prioritised, and treated.  How this happens is that risk will usually determine the cyber security risks that may impact an organisation.  Cyber security will then work with risk to help manage these risks at a controls level.

The overall process though, is a little more complex than that. We explore this within the rest of this article.

The first thing we have to explore is the roles that both areas play within an organisation. These are as follows:

Risk

The risk division manages all risks for the organisation that may impact it in a detrimental manner. These will include cyber risk and its associated impacts. An effective risk management division will clearly quantify these risks and provide ways to manage these risks according to the organisation’s risk appetite. The risk appetite should be defined and agreed to by the Board and Executives

Cyber Security

the function of the cyber security division should be to manage all cyber security-related risks for the organisation. The primary function should be understanding these risks, and implementing and managing controls to manage these risks so that the organisation is not adversely impacted by a cyber security incident.

The above definitions are not meant to fully define the role of each division, but simply to summarise the core functions.  And even if you just look at that, the linkages become obvious.

Based on Ashwin's experience in the APAC region, collaboration working working well within risk and cyber security entails the following:

  • Risk quantifies and documents the risks that may impact the organisation
  • Cyber security risks are then discussed and agreed to with the cyber security division
  • The heads of risk and cyber security (Chief Risk Officer and Chief Security Officer) then work together to determine a risk treatment plan
  • They will then jointly present this to the Board and Executives to:
    • Firstly, educate them on the cyber security risks likely to impact the organisation with priorities assigned based on the likely impact
    • Outline risk treatment plans for each prioritised risk
    • Present return on investment figures to the Board and Executives to gain support for the risk treatment plan that then becomes a cyber security program of works to enhance the organisation’s security posture and reduce its risk exposure.
  • Once the program is running, both ‘heads of’ will regularly present to the Board and Executives the progress being made and clearly articulate the reduction in cyber security risk
  • The overall risk posture and treatment plans are then updated at least six monthly in light of new and emerging cyber risks.
     

Three points need to be at this juncture:

  1. Cyber security initiatives should be part of the overall organisational risk management framework and cyber security risks should be prioritised and treated within this framework as any other organisational risk
  2. Any cyber security initiative should be aligned to the organisation’s risk management goals risk and cyber securityand justified in monetary terms with respect to risks reduced
  3. The Board and Executives should be a part of this process in terms of understanding the need for cyber security initiatives as well as being the ones that approve these initiatives.  Regular and accurate reporting on this program of works is important in order to ensure the Boards and Executives have visibility of progress being made (security is a journey after all!)

 

So to summarise, for cyber security initiatives to be successful in an organisation, both risk and cyber security must work together:

  • Risk will help determine and quantify the cyber security risks that may impact the organisation
  • Cyber security will validate these, help prioritise and implement controls that will help manage these risks.

 

For more information on our Cyber-Security & Resilience services, please contact Ashwin Pal or visit our webpage.