Informed Risk Decisions

The most compelling lessons learnt from this experience are:

Securing and protecting critical information assets that underpin an enterprise is not simply a technical problem and there are often no black and white answers. The shades of grey demand a risk-based consideration.
Guidance and recommendations on information security must be tailored to the cultural, ethical, and organisational make-up of any enterprise. Without considering these factors, recommendations will not be effective and will be difficult to implement.

All enterprises have some understanding of risk. However, becoming mature in understanding and addressing information and cyber risk is a challenge for all enterprises. All enterprises can benefit from an evidence-based approach to understanding the risks they confront from cyber threats that might be directed at them.
We live in an increasingly regulated world, and cyber risks are very high up this regulatory agenda across all facets of an enterprise’s business. Understanding the regulatory mindset and their concerns is essential if enterprises are going to develop a proportionate and adequate response to meeting regulatory expectations.