Building a Cyber Risk Management Program

Table of contents

1. Preface
   1. Brian’s Story
   2. Brandon’s Story
   3. Bringing It Together
   4. Who Should Read This Book
   5. Final Thoughts
   6. Conventions Used in This Book
   7. O’Reilly Online Learning
   8. How to Contact Us
   9. Acknowledgments
2. 1. Cybersecurity in the Age of Digital Transformation
   1. The Fourth Industrial Revolution
   2. Cybersecurity Is Fundamentally a Risk Practice
      1. Cyber Risk Management Oversight and Accountability
      2. Digital Transformation and Maturing the Cyber Risk Management Program
      3. Cybersecurity Isn’t Just a “Security” Concern
   3. Cyber Risk Management Program: An Urgent Enterprise Concern
   4. This Book’s Roadmap
   5. The Bottom Line
3. 2. The Cyber Risk Management Program
   1. The SEC Speaks—and the World Listens
      1. Incident Disclosure (“Current Disclosures”)
      2. Risk Management, Strategy, and Governance Disclosures (“Periodic Disclosures”)
   2. The Cyber Risk Management Program Framework
      1. Cyber Risk Management Program: Key Drivers
      2. Satisfying Obligations and Liability
   3. When Risk Management Fails Completely: The Boeing 737 MAX Disasters
   4. Risk Management Program Applied to the Boeing Disasters
      1. “Essential and Mission Critical”: The Boeing Case
   5. Benefits of a Security Risk Program
      1. Benefit 1: Strategic Recognition of the Security Risk Function
      2. Benefit 2: Ensuring the Cyber Risk Function Has an Effective Budget
      3. Benefit 3: Protections for Risk Decision Makers
      4. CRMP: Systematic but Not Zero-Risk
   6. Board Accountability and Legal Liability
   7. The Boeing Ruling and Cyber Risk Oversight Accountability
   8. CISOs in the Line of Fire for Liability
   9. The Bottom Line
4. 3. Agile Governance
   1. The Uber Hack Cover-Up
   2. What Does Good Governance Look Like?
   3. Aligning with the Enterprise Governance Strategy
   4. Seven Principles of Agile Governance
      1. Principle 1: Establish Policies and Processes
      2. Principle 2: Establish Governance and Roles and Responsibilities Across the “Three Lines Model”
      3. Principle 3: Align Governance Practices with Existing Risk Frameworks
      4. Principle 4: Board of Directors and Senior Executives Define Scope
      5. Principle 5: Board of Directors and Senior Executives Provide Oversight
      6. Principle 6: Audit Governance Processes
      7. Principle 7: Align Resources to the Defined Roles and Responsibilities
   5. The Bottom Line
5. 4. Risk-Informed System
   1. Why Risk Information Matters—at the Highest Levels
   2. Risk and Risk Information Defined
   3. Five Principles of a Risk-Informed System
      1. Principle 1: Define a Risk Assessment Framework and Methodology
      2. Principle 2: Establish a Methodology for Risk Thresholds
      3. Principle 3: Establish Understanding of Risk-Informed Needs
      4. Principle 4: Agree on a Risk Assessment Interval
      5. Principle 5: Enable Reporting Processes
   4. The Bottom Line
6. 5. Risk-Based Strategy and Execution
   1. ChatGPT Shakes the Business World
   2. AI Risks: Two Tech Giants Choose Two Paths
   3. Wall Street: Move Fast—or Be Replaced
   4. The Digital Game Changers Just Keep Coming
   5. Defining Risk-Based Strategy and Execution
   6. Six Principles of Risk-Based Strategy and Execution
      1. Principle 1: Define Acceptable Risk Thresholds
      2. Principle 2: Align Strategy and Budget with Approved Risk Thresholds
      3. Principle 3: Execute to Meet Approved Risk Thresholds
      4. Principle 4: Monitor on an Ongoing Basis
      5. Principle 5: Audit Against Risk Thresholds
      6. Principle 6: Include Third Parties in Risk Treatment Plan
   7. The Bottom Line
7. 6. Risk Escalation and Disclosure
   1. The SEC and Risk Disclosure
   2. Regulatory Bodies Worldwide Require Risk Disclosure
   3. Risk Escalation
      1. Cyber Risk Classification
      2. Escalation and Disclosure: Not Just Security Incidents
   4. Disclosure: A Mandatory Concern for Enterprises
      1. The Equifax Scandal
      2. SEC Materiality Considerations
   5. Cyber Risk Management Program and ERM Alignment
   6. Five Principles of Risk Escalation and Disclosure
      1. Principle 1: Establish Escalation Processes
      2. Principle 2: Establish Disclosure Processes—All Enterprises
      3. Principle 3: Establish Disclosure Processes—Public Companies
      4. Principle 4: Test Escalation and Disclosure Processes
      5. Principle 5: Audit Escalation and Disclosure Processes
   7. The Bottom Line
8. 7. Implementing the Cyber Risk Management Program
   1. The Cyber Risk Management Journey
   2. Beginning the Cyber Risk Management Journey
   3. Implementing the Cyber Risk Management Program
      1. Agile Governance
      2. Risk-Informed System
      3. Risk-Based Strategy and Execution
      4. Risk Escalation and Disclosure
   4. Selling the Program
   5. The Bottom Line
9. 8. The CRMP Applied to Operational Risk and Resilience
   1. Enterprise Functions That Interact with and Contribute to Operational Resilience
   2. A Malware Attack Shuts Down Maersk’s Systems Worldwide
   3. Guiding Operational Resilience Using the Four Core Cyber Risk Management Program Components
      1. Agile Governance
      2. Risk-Informed System
      3. Risk-Based Strategy and Execution
      4. Risk Escalation and Disclosure
   4. The Bottom Line
10. 9. AI and Beyond—the Future of Risk Management in a Digitalized World
    1. AI Defined
    2. AI: A Whole New World of Risk
    3. Adversarial Machine Learning: NIST Taxonomy and Terminology
       1. Risk Management Frameworks with AI Implications
       2. Key AI Implementation Concepts and Frameworks
    4. Beyond AI: The Digital Frontier Never Stops Moving
    5. The Bottom Line
11. Appendix. The Cyber Risk Management Program Framework v1.0
    1. Purpose and Context
    2. Structure of the Cyber Risk Management Program Framework
    3. Note: Framework Disclosure
12. Index
13. About the Authors