Shifting cybersecurity from a compliance to a risk focus

Modern organisations now realise that cybersecurity is a crucial concern. Cyberattacks have grown in frequency and sophistication, with 3,813 data breaches reported in the first half of 2019, which was an increase of 54% over the previous year. And in light of COVID-19-related changes in workforce structure and an unplanned shift to remote work environments that might not be supported with the right infrastructure, companies became even more vulnerable to attack in 2020. While enterprises know that cybersecurity protection is essential to safeguard their companies, many envision cybersecurity protocols as a compliance-focused approach to address industry and governmental regulations, rather than looking at them from a risk analysis level.

Many industries have already taken measures to determine minimum regulatory compliance standards to protect businesses’ and consumers’ online data. However, smart organisations are going even further by implementing a risk-focused approach to monitoring and managing cybersecurity. So, what does it mean to adopt a more risk-based approach to cybersecurity, rather than focusing on compliance? In a compliance focus, you’ll look at your policies, standards, contractual agreements, regulations, and legal mandates through a specific lens to evaluate whether each meets compliance standards. This approach has several benefits: it’s easy to follow, easy to understand, and you can use a checklist to see how well your organisation is performing.

However, by using a risk analysis approach instead, you can use a formula for building your program that focuses on:

• Your risk profile: How susceptible is your company to risks, and what are those risks?
• Your risk appetite: What level of risk is acceptable, and how much are you willing to invest to mitigate it to that point?
• Your compliance obligations: What industry regulations do you need to put in place?

Keep in mind that cyber risk shouldn’t be silo-based. Other departments will often need training and education around addressing cybersecurity concerns. A robust cyber risk management process relies on automation and data analytics tools to ensure that your team is aware of the status of existing risks at all times, and that you’ll be able to implement mitigation strategies immediately if a trigger action takes place. As we’ve seen with the sudden shifts in work culture brought about by COVID-19, it’s important to be aware of your potential risks and vulnerabilities. This will let you prioritise monitoring and mitigating when the unexpected occurs, rather than scrambling to build a plan on the spot.