Govern cyber risk with scenarios, priorities and responsibilities.

Connect technical threats and consequences for the business.

Cyber risk management allows you to decide where to intervene, which risk to accept and how to verify that the measures produce the expected result. The analysis starts from processes, assets, data, dependencies and scenarios, avoiding scores without context.

Process

1. definition of perimeter, objectives and criteria;
2. inventory and classification of processes, assets and information;
3. identification of threats, vulnerabilities and dependencies;
4. building scenarios with probability and impact;
5. assessment of existing controls and residual risk;
6. choice between mitigation, acceptance, transfer or avoidance;
7. assignment of owners, actions, deadlines and metrics;
8. review after incidents, changes and checks.

Decisions and reporting

The results are presented with different levels of detail: management receives scenarios, trends and required decisions; technical teams receive controls, evidence and activities. Exceptions are formalized with motivation, duration and compensatory controls.

Output

• methodology and risk criteria;
• risk register and dependency map;
• treatment plan with responsibility;
• dashboard and risk indicators;
• calendar for review and verification of effectiveness.