Cybersecurity Risk Management

Acknowledgments

This book is the culmination of at least eight years of research on how organizations can better position themselves to manage cybersecurity risk. My work on the material in this book began in 2013 when CSO Online commissioned me to document the development of what is now known as the NIST Cybersecurity Framework.

To accomplish this documentation, I attended all six of the workshops that led to the Framework’s release in 2014, flying to universities around the country and talking to the world’s leading cybersecurity experts for my CSO reports. A trade association also hired me to help industry executives understand cybersecurity. This client subsequently hired me to develop a series of courses to help train their workforce, particularly their non-cybersecurity technical personnel, in the best risk management practices using the NIST Cybersecurity Framework as a guide. (And I’m grateful that I was able to retain the rights to most of my work for this client.)

I’ve based the content of this book on the many discussions I have had with experts who have graciously given me their time over the years to explain how they manage risks in their organizations. Thanks to the following individuals in particular, whose skill and guidance helped bring many of the NIST concepts, so often abstract and high-level, down to earth and understandable to non-cybersecurity tech workers:

• Paul Anderson, Director of Corporate Information Services, Hubbard Broadcasting,
• Howard Price, ...