How to Measure Anything in Cybersecurity Risk

Chapter 12 A Call to Action: How to Roll Out Cybersecurity Risk Management

There are three general themes to this book:

1. What measurement is
2. How to apply measurement
3. How to improve measurement

What distinguishes this tome from its predecessors, How to Measure Anything: Finding the Value of “Intangibles” in Business and The Failure of Risk Management, is that this book is domain focused. More than that, it’s designed to be a road map for establishing cybersecurity risk management as the C-level strategic technology risk practice. To this point, we believe cybersecurity as an operational function should be redefined around quantitative risk management. This book has provided more evangelism and proof to that quantitative end. If you are of the mind that cybersecurity risk management (CSRM) should be a program as opposed to a grab bag of quantitative tricks, then this chapter is a high level proposition to that end. We will lay out what such an organization might look like, and how it could work alongside other technology risk functions.

Establishing the CSRM Strategic Charter

This section answers the question “What should the overarching corporate role be for CSRM?” What we are framing as the CSRM function should become the first gate for executive, or board-level, large-investment consideration. Leaders still make the decisions, but they are using their quantitative napkins to add, multiply, and divide dollars and probabilities. Ordinal scales and other faux risk stuff should ...