Articles & Blogs
Risk Management Framework – Managing & Measuring what matters
A risk management program allows you to manage overall information security risk. It is an approach to identify, quantify, mitigate, and monitor risks. The reason to look at risk in a comprehensive manner is to make sure no one area is getting too much attention or, too little. Frameworks also help you identify the bigger elements of risk that need review and mitigation. Additionally, it help you to prioritize the treatment of certain risks. The adherence to risk frameworks also helps give your customers comfort that a standard risk management is in place and hence, reduce your audit burden.
Typically, a Risk Management program comprises of the following phases:
- Risk identification
- Risk analysis
- Risk evaluation
- Risk treatment
- Risk Monitoring
A good risk management framework will have the following characteristics:
- Comprehensive in types of risks it covers
- Practical for an organization to implement
- Updated with current real-world risks
- Based on controls that can be reviewed and audited
- Reliable so that your vendors and customers can accept it
There are many risk management frameworks that one can choose from and it important to understand the advantages of each.
Common risk management frameworks include:
NIST (National Institute of Standards and Technology) framework is a comprehensive cybersecurity framework (CSF). It is very widely accepted across different company sizes and business domains. Most cyber-security professionals are well aware of this framework as it is readily available. Although widely available and very popular there is no certified third-party audit mechanism. Hence, it can only be self-assessed.
SOC 2 Type 2 is an internal controls report based on the scope you define. It is widely used in the United States to show the maturity of your controls. A CPA firm that is part of the American Institute of CPAs (AICPA) conducts the audit & issues an assessment report. The AICPA does not audit/review the assessment for completeness or quality.
HITRUST CSF is a framework that came leverages NIST, SOC, and ISO along with others to create a more comprehensive standard. It is widely implemented in the United States by organisations in the healthcare space. Unlike others, although there are external assessors that are involved in the certification process, HITRUST reviews all assessments and issues the certificate. Additionally, among all the frameworks above it tends to be the most expensive to implement.
It is important to choose a framework that matches your long-term security goals & needs. At Accorian, we work with all of the above frameworks. We help organizations choose the right framework and aid with the implementation. This is done by augmenting our team into your security team to help steer the rollout, aid with query resolution, choosing of the right controls & workaround during mitigation advisory, facilitating the selection of vendors & products and end to end program management.