Cybersecurity risk management: Best practices and frameworks

Cybersecurity risk management helps organizations proactively identify, evaluate, mitigate and monitor threats to their systems, applications and data.

Also known as cyber-risk management, it is a subset of the broader strategic risk management umbrella, focusing specifically on IT security issues and their potential impact on the business. Effective cybersecurity risk management includes a broad mix of important practices, including the following:

• Assessments. Performing regular security assessments to identify vulnerabilities and evaluate preparedness against potential attacks.
• Policies. Developing comprehensive security policies and workflows to maintain security, mitigate incidents, preserve compliance and ensure business continuity.
• Infrastructure. Implementing and managing security technologies such as firewalls, intrusion detection and prevention, antimalware and analytical tools -- including AI-powered threat detection systems.
• Training. Teaching security staff and all employees how to recognize and prevent common security threats.

Cybersecurity risk management is only effective when it's part of an organization-wide effort that develops input and cultivates collaboration among cross-departmental staff, senior executives, the security team and third-party vendors. Working together ensures that threats relevant to the business are identified, that suitable infrastructure is procured and deployed, and that well-considered policies and procedures are put in place to maintain an appropriate security posture.

Cybersecurity risk management frameworks

Established frameworks are extraordinarily helpful for cyber-risk management, providing a structured, repeatable set of standards, policies and workflows to help an organization address cybersecurity threats. Several frameworks are well-suited to cybersecurity risk management. Each framework has its own tradeoffs and can suit different business needs or models.

NIST CSF, ISO 27001 and CIS Controls

The NIST Cybersecurity Framework (CSF), ISO 27001 and CIS Controls all focus on cyber-risk and are all intended to improve an organization's cybersecurity posture, manage cyber-risk and protect digital assets.

NIST CSF is a comprehensive, voluntary and highly adaptable platform for managing and mitigating cybersecurity risks. CSF 2.0 provides a structured approach that focuses on six functions: govern, identify, protect, detect, respond and recover. NIST's complementary AI Risk Management Framework is designed to gauge trustworthiness in the design, development and use of AI systems.

ISO/IEC 27001 and 27002 are international standards for information security management and controls. 27001 specifies requirements for establishing, implementing and continually improving an information security management system, while 27002 provides guidance on implementing security controls and best practices. Organizations can obtain ISO/IEC 27001 certification to demonstrate conformity to the standard. 27001 and 27002 are suited to many different business types, including IT, services, manufacturing, government and nonprofit organizations.

The CIS Critical Security Controls is a framework from the Center for Internet Security that provides a community-driven set of 18 prescriptive, prioritized cybersecurity best practices designed to mitigate risk and enhance resilience across IT infrastructure. CIS Controls offer top-level security controls and safeguards, along with implementation guidance, and can support cloud and hybrid infrastructures.

FAIR, COBIT, COSO ERM and RMM

Other frameworks, such as Factor Analysis of Information Risk (FAIR), Control Objectives for Information and Related Technologies (COBIT), COSO Enterprise Risk Management (ERM) and the Risk Maturity Model (RMM), vary significantly in specific focus and methodology, but they provide synergistic frameworks designed to enhance how an organization manages holistic risk.

The FAIR framework helps organizations analyze and quantify the severity of cybersecurity risks by estimating the probable frequency and financial impact of potential loss events. Expressing them numerically enables business leaders and stakeholders to better prioritize and understand the implications of security threats.

The COBIT framework, created by ISACA, focuses on IT governance and management. COBIT is recognized for aligning IT with business goals and offers detailed guidance on cybersecurity and other IT-related risks.

The COSO ERM framework supports a broader initiative to identify, manage and mitigate enterprise risks, among them cybersecurity risks.

The RMM framework provides a detailed risk maturity self-assessment that enables organizations to benchmark the alignment of their current risk management practices with RMM indicators. The goal is to create a sustainable, repeatable and mature ERM program. The self-assessment provides the business with a maturity score, ranging from Ad-Hoc (Level 1) to the most advanced risk maturity level, Leadership (Level 5).

Other frameworks

These aren't the only frameworks used for cybersecurity. Many other options are available for specific businesses or industry verticals, among them the Mitre ATT&CK framework and Cyber Defense Matrix. Industry-specific frameworks include HIPAA and HITRUST CSF for healthcare; FERPA, CIPA and COPPA for education; PCI DSS for payment systems; and regional frameworks such as GDPR and Cyber Essentials for the EU and the U.K.

How to choose a cyber-risk management framework

Selecting the best framework for an organization's cybersecurity risk management initiative can be difficult. Many risk management frameworks focused on cybersecurity exist, but each one is different. For example, major frameworks such as NIST CSF, ISO 27001 and COBIT use significantly different approaches and can't be used interchangeably.

Adopting the correct framework requires careful consideration of the organization's specific needs, risk tolerance and risk profile, staff expertise and capabilities with each framework, and detailed security needs and compliance obligations.

Although risk management frameworks can assist organizations in finding and evaluating cybersecurity risks, no framework can make those critical determinations for them. The onus is always on the framework's user to do the following:

• Establish business goals.
• Recognize the prevailing compliance requirements.
• Define the organization's risk tolerance.
• Inventory and track current and future assets.
• Identify vulnerabilities of each asset.
• Objectively define the associated business risks and consequences involved with each vulnerability.

Frameworks can be highly effective in keeping each of these points organized and in context, but it's up to business and technology leaders to fill in the details themselves.

Match the framework to organizational needs

The selection process should involve a range of suitability considerations that match each framework's strengths and capabilities to the organization's specific needs. Typical criteria include the following:

• Business size. Ensure the framework is suited to the organization's current size and complexity and scalable enough to meet future needs.
• Unique needs. Consider any unique security requirements specific to the business or industry, such as healthcare or finance. Also, ensure the selected framework will properly evaluate and includes the risk discussions for those requirements, such as support for PCI DSS in businesses that process credit card payments.
• Staff expertise. Frameworks can be complex and comprehensive mechanisms. It requires skilled staff to use frameworks to their best advantage and implement resulting determinations successfully. This can make more familiar frameworks faster, easier and more successful to implement than others.
• Cost. Framework implementation and management can impose significant time and resource requirements. Budget-sensitive organizations might select a simpler and less detailed framework that is faster and less costly to implement and manage.
• Avoid overlap. Consider existing security controls or risk management tools in place across the enterprise and determine whether those controls are mutually beneficial or simply a waste of time and effort -- leading to wasted cybersecurity resources.

Consider maturity, resources and compliance needs

Any cyber-risk management approach must include a detailed examination of the organization's technological maturity, available resources and compliance obligations. This requires detailed and ongoing discussions with various stakeholders throughout the business.

• Technological maturity. Maturity loosely defines how adept the business is at designing and implementing a proactive, automated, well-aligned cyber-risk strategy. A common scale involves three broad levels of maturity. The low (or ad hoc) level is highly reactive and manual, relying on legacy systems, shadow IT and basic security services. The medium (defined) level standardizes policies and performs periodic audits, often enabling strong network segmentation and endpoint protection. The high (optimized) level uses highly proactive, automated practices, such as zero trust, and employs automated threat detection and prevention, including AI-based tools.
• Resources. Resources directly influence an organization's ability to identify, assess and mitigate cybersecurity threats. This includes prioritizing assets based on real business impacts, controlling cybersecurity implementations within budgets and available tools, using frameworks -- such as FAIR -- to predict financial loss, and maintaining an appropriate state of readiness and resilience as cyberthreats continue to emerge and evolve.
• Compliance. Compliance involves establishing an essential baseline for cybersecurity controls, underscoring the importance of audit readiness and enforcing accountability. For example, regulations such as GDPR, HIPAA and PCI DSS mandate technical and operational controls, including IAM, encryption and logging. Compliance requires copious record-keeping, incident reporting and routine policy reviews, all of which help make cyber-risk assessment more proactive than ad hoc. Compliance audits help business leaders spot missing controls, unpatched vulnerabilities and weaknesses in data protection that might otherwise go unnoticed.

Implementing a cybersecurity risk management framework

Although every organization implements and supports cyber-risk management differently, there are some conventional ways to develop and integrate the concept as part of a strong and effective overall business posture.

Align the framework with existing risk processes

Start with ERM. ERM is an umbrella term and should support cybersecurity risk management -- not the other way around. A strong ERM clearly defines the organization's risk tolerance, including cybersecurity risks. ERM should also incorporate a well-defined governance structure where business and cyber-risk management roles and responsibilities are clear. Use a standard set of terms and concepts for communicating risks so that everyone speaks the same risk management language.

For example, consider adopting a risk management framework such as COSO ERM, NIST CSF or the general ISO 31000 standard. All focus on enterprise risk management but make cyber-risk management an integral part. Next, look for alignment. Just as ERM seeks to align risks with business goals and risk tolerance, cyber-risk management should strike the same relationship between the business and its overall needs. Decisions and initiatives generated by cyber-risk management should be consistent with the broader ERM. Otherwise, critical risks can be missed and business goals not addressed.

Establish ownership and accountability

Cybersecurity risk management isn't a blame game. It's a careful, deliberate assessment of risks, followed by a conscientious plan to mitigate and remediate them. Ownership and accountability typically start with the senior management team, so begin by assessing risks in business rather than technical terms. Cyber-risk management is often most effective when risks and impacts are expressed in business terms, such as financial or legal impacts. This is typically most consistent with ERM efforts and helps executives understand and prioritize the potential seriousness of risk issues. Other stakeholders, including IT leaders and legal or compliance teams, also have a direct stake in risk ownership and accountability.

Measure risk and control effectiveness

Use cybersecurity risk frameworks that yield objective metrics for monitoring and tracking. Examples of such metrics include mean time to detect and patch compliance rate. Metrics enable risk to be measured, and the effectiveness and outcomes of risk management plans to be evaluated honestly, leading to continuous improvements.

Next, focus on consistent response plans. Develop and review cyber-risk management plans, such as cyberincident response, with ERM plans, such as business continuity. Discuss potential overlaps and resolve conflicts so the business can deliver a unified, consistent response to disasters, data loss, business disruptions and other serious incidents.

Finally, review and update the risk and response plans regularly. ERM analysis and discussion are ongoing processes, and cyber-risk management should be a key part of those discussions. Anytime the broader ERM is reviewed and updated, the cyber-risk management process should undergo the same scrutiny.

Cybersecurity risk management framework best practices

There is no single way to implement cybersecurity or manage risks. Consider these 10 best practices as a guide:

1. Think like an attacker. Identify risks and deploy threat intelligence resources that educate staff about current and emerging threats. For every threat you see, there might be two more you don't. Risk identification is among the most difficult parts of risk management.
2. Combine CRM with ERM. Don't approach cyber-risk in isolation. Instead, align cyber-risk discussions with business objectives and consider financial impacts, with senior-level oversight rather than managing cybersecurity and its risks as a siloed IT duty.
3. Inventory and manage assets. You can't protect what you don't see -- or even know you have -- so use comprehensive asset inventory methodologies to track hardware, software, data flows, cloud services and third-party vendors.
4. Trust nobody. Implement zero-trust policies across the board -- lock everything down and allocate authorization and access based on clear rules, such as job roles. Apply cybersecurity monitoring and tools to all elements of the infrastructure. Even CISOs get fooled by phishing scams or download infected files from time to time.
5. Develop clear documentation. Document security policies and practices, such as incident response or acceptable use, and ensure everyone from employees to executives to partners receives, understands and agrees to documented practices. This puts everyone on the same page about security and their respective duties and responsibilities involved.
6. Monitor carefully and continuously. Use tools capable of comprehensive security monitoring, such as anomaly detection, intrusion systems and behavioral analytics, to oversee activities across the infrastructure and its users. Monitoring tools should provide comprehensive security dashboards for real-time reporting and decisive alerting when potential incidents are detected.
7. Respond rapidly. Use automated and AI-based cybersecurity tools to respond rapidly -- even autonomously -- when an event is detected. The time elapsed between an alert and a response is critical for the business. Better to deny access and possibly annoy a user now and wait for human intervention later than risk a catastrophic data breach.
8. Test and re-evaluate. Test your cybersecurity preparedness. Generative AI, for example, is being used to simulate ethical hacker attacks to validate security. Regularly test other important practices, such as backup and restore and incident response, as well. Evaluate the effectiveness of cybersecurity efforts and make regular adjustments to correct deficiencies or meet changing threats over time.
9. Guiltless post-mortems. Don't assign blame after an incident occurs. Little silences a human more than humiliation. Incidents are followed by investigation, analysis and discussion. Keep these post-mortem discussions objective. It's easier to gather information, understand events better and take more meaningful corrective action.
10. Educate repeatedly. Implement detailed cybersecurity education for employees at all levels. Ensure every employee understands the need for security, their role in security and the possible consequences when security fails. Education isn't a one-time effort, but an ongoing business process.

Stephen J. Bigelow, senior technology editor at Informa TechTarget, has more than 30 years of technical writing experience in the PC and technology industry.