Security Management : frameworks

Risk, Risk and More Risk

Mike Hoefgen — Tue, 15 Dec 2009 14:00:00 GMT

Can you hear it? That buzzing sound!

The buzz I’ve been hearing is about ISO 31000, the new Risk Management Standard from the International Standards Organization. Then again, my wife continues to remind me that I'm hard of hearing.

Search for the phrase “risk assessment” with Google and you’ll get over 11.5 million hits. And if you're a risk manager trying to choose a risk methodology, you have many to pick from (this is not a complete list):

With all of these risk assessment methodologies available, why was it such a big deal when ISO introduced a new standard earlier this year? ISO 31000 was adapted from the very successful and widely accepted AS/NZS 4360 Standard, but it has been refined and consolidated making ISO 31000 even more effective than the existing AS/NZS standard.

The new standard has been widely praised by industry analysts and experts:

One of the big draws for Arnold H. Schanfield is that it’s short and to the point. ISO 31000 is only 34 pages long, as compared to COSO ERM which has over 125 pages and 116 pages for AS/NZS 4360.
One of the things Michael Rasmussen likes is the simple but effective risk definition “effect of uncertainty on objectives.”
Dan Markiewicz writes that people are excited because it “brings together a global consensus on risk management.” That includes all forms of risk management, such as financial, security, safety, health and environment.

After reading numerous articles on this topic, the common thread that authors seem to agree on is that ISO 31000 is simple and adaptable. From what I've read, it's possible that ISO 31000 will be the risk management framework that harmonizes risk management processes in existing and future standards.

Michael Rasmussen summarizes that point very well:

“ISO 31000 provides a risk management approach that can be used across the silos/domains of risk scattered across the organization. It is just as relevant to areas such as legal risk management as it is to information security, quality, or environmental, health & safety.”

This reminds me of a famous quote by Albert Einstein:

“Any fool can make things bigger, more complex... It takes a touch of genius - and a lot of courage to move in the opposite direction.”

What do you think about the new ISO 31000 standard? Will you be considering it for your organization? Feel free to share your reactions in comments to this post.

Why Content is King for GRC

Mike Hoefgen — Thu, 24 Sep 2009 13:05:00 GMT

When you open Microsoft Word, Excel, or PowerPoint, what do you see? You see a blank screen representing a sheet of paper, a blank spreadsheet, or a blank presentation. At this point you can either create your own document or open another file. If you're like me, you prefer starting with another file (like a template), and then editing, rather than starting from scratch. I think you'll agree that starting with something that's relevant is much easier.

The goal of having GRC content is to make your job as a compliance/risk professional easier and more effective. How can content help? Let's first level-set to make sure we are on the same page.

What is "Content"?

Content generally refers to the Regulations, best practices, and frameworks that an organization may want to abide by. Common examples include: SOX, HIPAA, PCI, COBiT, NIST, ISO and many others. One such provider of GRC content is the Unified Compliance Framework (UCF), which provides over 400 regulatory documents in a subscription model. The subscription model will save you a tremendous amount of time otherwise spent on continuously looking for new and updated regulations. Each of the regulations has been further broken down into paragraphs, page numbers and sections that identify parts of the authority document that describe things you must do to be compliant.

Additionally, each of the authoritative documents is mapped to a set of controls that need to be implemented to be compliant. Adding up the individual controls that are mapped to each of the authoritative documents yields over 10,000 controls. Luckily for you, these controls are rationalized in the Unified Compliance Framework down to about 2,500 common controls. This allows you to easily identify how one control can satisfy many authority documents.

These controls are your blueprint for creating a compliant organization.

Authority documents and controls are typically the largest part of the content that can be provided by a GRC solution, but it's not the only thing. A Risk Library can help you identify common risks that are inherent in any organization. These risks are hierarchical, reusable and will help you quickly identify common risks so you can focus on identifying more industry-specific risks.

Some vendors also offer additional regulation specific solutions. For example, CA has NERC and FISMA specific solutions. These include the NERC and FISMA regulations, related controls, typical workflows and dashboards/reports that can be used to help satisfy NERC and FISMA audits.

The content is "King," but linking to your environment is "Queen." To get the full benefit of the content you must marry your controls, policies, and your organization structure to the software . And what do I mean by marry the two? Associating the UCF controls and authority documents with your assets, applications, business units, policies and procedures will give you a real-time map, like a GPS, to guide you along your way to becoming compliant -- and staying compliant.

Just imagine, a control fails and you are able to very quickly identify what application is at risk, what regulation is being breached, and what business units are affected. You now have the ability to "govern" your compliance posture and can make decisions based on facts rather than intuition.

Video Blog: Scott Mitchell of OCEG on Untangling the Web of Frameworks

CA GRC Blog Admin — Thu, 14 May 2009 12:50:00 GMT

In the final installment of our 5-part video blog series, Scott Mitchell, CEO of OCEG, shares his thoughts on untangling the web of risk and compliance frameworks.

Trouble viewing the video? Click here to view this and other CA videos on the CA YouTube channel.