Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage

© The Author(s), under exclusive license to APress Media, LLC, part of Springer Nature 2024

B. ChaputEnterprise Cyber Risk Management as a Value Creator https://doi.org/10.1007/979-8-8688-0094-8_11

11. Adapting Your Process to Include Cyber Opportunities

Bob Chaput¹  

(1)

Belleair Beach, FL, USA

 

If you can’t describe what you are doing as a process, you don’t know what you’re doing.

—W. Edwards Deming¹

In Chapter 10, I introduced the ECRM Process based on “Managing Information Security Risk” (NIST Special Publication 800-39)² and the four basic steps, each informing the other steps. To summarize, they are frame risk, assess risk, respond to risk, and monitor risk.

The NIST approach to ECRM focuses heavily on “managing the downside” with a focus on risk. ...