Building a Cyber Risk Management Program

Chapter 4. Risk-Informed System

At the beginning of this book, we discussed a few unprecedented and increasingly unpredictable risks enterprises face in a world that’s intricately interconnected by digital communication and collaboration technologies—and the critical importance of addressing those risks via a formal cyber risk management program (CRMP).

Despite all the attention we’ve been giving to digitalization and its impacts, it’s important to recognize that digitalization isn’t the problem that a CRMP is meant to address. In fact, it isn’t necessarily even a problem at all. Digitalization definitely presents risks, many of them unimaginable just a few short years ago, but it also presents extraordinary new business opportunities. The fundamental problem this book addresses is that current approaches to security, and the immaturity of current risk management practices, leave an enormous gap in enterprises’ ability to protect themselves against emerging risks while at the same time taking advantage of new business opportunities rapidly and effectively. That requires a clearly defined CRMP based on four key components. The preceding chapter discussed the first of those components, Agile governance. Now we move on to the second: a risk-informed system.

Threat or Opportunity? The Toyota Shutdown

In early March 2022, Toyota, the world’s largest automaker, suspended operations for more than a day in 28 production lines across all 14 of its Japanese plants, after a key third-party ...