Insights
Your cyber-risk assessment is finished. What happens next?
Decide which findings need action and give the work an owner, a due date and evidence that will show whether it is complete.
A risk assessment can leave management with a long report and an uncomfortable question: what should we actually do first?
For each important finding, management needs to understand what could happen and decide how to respond. The work then needs an owner, time and funding.
Write the risk in business terms
Take a technical finding and explain the event you are concerned about. Include the activity affected and what the resulting disruption or loss could mean.
For a finance mailbox, the concern might be that someone could take over the account and use existing correspondence to request a fraudulent payment. Describe that event and its consequences in the assessment.
Make clear what the assessment verified and what remains uncertain. A missing record of a backup test does not prove recovery will fail. It does mean recovery capability has not been demonstrated by that evidence.
Consider the controls already in place
Ask what currently reduces the likelihood or consequence of the event and how well those measures have been checked. A payment verification process, for instance, may help limit the consequences of an email compromise. It needs to work in practice, including when the usual approver is away.
The Cyber Centre's baseline controls guidance asks organizations to consider harm from lost confidentiality, altered information and unavailable systems. Those are useful prompts for discussing impact without pretending every risk can be reduced to an exact dollar figure.
Choose a response and name its owner
For each priority risk, decide whether to reduce it, stop the activity creating it, share some consequences through an appropriate arrangement or accept the remaining exposure. Insurance and supplier agreements need careful review; they do not make an operational risk disappear.
Record the chosen response, a responsible owner, the target date and any dependencies. If a fix will take months, decide whether an interim measure is needed. If management accepts a risk, document who approved that decision, the reason and when it must be reviewed.
Plan the first round of work
Separate urgent containment from work that needs planning. For the next few weeks, select a small enough set of improvements that owners can realistically complete them. Include the people who will need to approve disruption, provide information or change their procedures.
Record the risk, agreed task, owner, due date and evidence needed to close it. “Improve recovery” is difficult to close; “complete and document an agreed restore test for this system” gives the team something concrete to demonstrate.
Report progress and check the result
Review progress at an agreed interval. Discuss blocked work and changed circumstances, rather than reporting only the number of completed tasks. Verify the result before marking an important risk as addressed, then reconsider the remaining exposure.
Keep the assessment current when the business changes. A new location, acquisition, major supplier or critical application can change the assumptions behind the original priorities.
Turn your findings into a workable plan
Bring the assessment you have or the concern you need investigated. We will help you decide which risks need action and put the work in order.