Rational Cybersecurity for Business: The Security Leaders' Guide to Business Alignment

© The Author(s) 2020

D. BlumRational Cybersecurity for Businesshttps://doi.org/10.1007/978-1-4842-5952-8_5

5. Manage Risk in the Language of Business

Dan Blum¹ 

(1)

Silver Spring, MD, USA

 

For too long, information risk management has been lost in translation. Technical risk analyses were unintelligible to the business and even security practitioners lacked common terms, definitions, or analysis models. Without a working risk management framework, security and business leadership have found it hard to agree on priorities, policies, or budgets. Even security teams struggle prioritizing which controls to implement.

But this need no longer be the case. In this Chapter, we’ll learn how businesses can use the standard ISO 31000 Risk Management framework, ...