Inflection Point: Granting Exceptions to Cybersecurity Policies and Standards
cr-map.com

Inflection Point: Granting Exceptions to Cybersecurity Policies and Standards

Happy New Year!

As you think about your new year as a cyber risk manager, what’s top of mind for you?

There’s no lack of important things to think about, right?

What usually bothers me, when I’m being reflective at a time like this, are the things that are important but not urgent.

Someone recently asked me about when (and how) to grant exceptions to cybersecurity policies and standards.

What a great example of an important, but not urgent, problem!

Of course, that assumes you aren’t processing an exception request right now. But even if you were, it would be easy to just grant it and move on. Those things rarely blow up in your face immediately, right?

If you don’t have a good exception-handling process right now, here’s what I suggest:

  • Use the table of authorizations from the finance department to know who can approve exceptions based on the estimated dollar value of the impact and recovery if the exception results in a major cyber incident.
  • For example, a $1 million cyber risk can’t be accepted by someone who only has $10,000 in spending authority.
  • When estimating the dollar value of cyber risk, start with rough estimates and refine them as needed until they are considered acceptable to your stakeholders.
  • Put all exceptions granted into your risk register.
  • Review all granted exceptions annually with the cybersecurity steering committee; revoke exceptions if the stakes get too high.
  • BONUS: If you do not grant an exception, did the requestor follow the policy or procedure afterward?

If you don’t have an exception-handling process, this example might be inspiring, but I suggest you reduce it down to a “minimum viable” amount of rigor:

https://security.calpoly.edu/content/exception-process

Remember: Minimum Viable means the least you can do and still move the needle towards your goal.

Do you already have something like what I’ve described above in place? If not, are you going to get this done before 2024 gets going at full speed?

Click comment and let me know.

And, yes, I really do read every comment you post.

-Kip

P.S. Please repost this “Inflection Point” to share with your network.


Current Podcast Episode: EP 147: SEC Complaint against SolarWinds Corporation – Cyber Risk Management Action Plan (CR-MAP)

What can we learn about the SEC Complaint against SolarWinds Corporation and Timothy G. Brown? Let’s find out with your hosts Kip Boyle, CISO with Cyber Risk Opportunities LLC, and Jake Bernstein, CISSP, CIPP/US, Partner with K&L Gates.

EP 96: “Normalizing Greater Accountability For Cybersecurity Fraud”

EP 109: “FTC’s Strange Action Against Cafe Press”


Want to know how to quickly make your company a smaller target for cyber-attackers?

Prepare for the Akylade Certified Cyber Resilience Fundamentals (A/CCRF) certification exam by picking up a copy of the textbook “Mastering Cyber Resilience: From Theory to Practice: Practical Strategies for Cyber Resilience”.


By the way...

We’re currently making plans to attend the Spring series of SecureWorld conferences being held around the United States and Canada in 2024.

Have a look at the schedule and see if you can attend one of them:

I’d love to meet you in person!


Kip Boyle, Founder, vCISO, Best-Selling Author, Speaker, Podcast Host, Entrepreneur, Trainer, Consultant, Cyber Resilience Subject-Matter-Expert

Kip Boyle is a husband, dad, entrepreneur, and experienced cyber risk manager. He founded Cyber Risk Opportunities LLC in 2015, after seven years as the CISO of PEMCO Insurance in Seattle. As a captain on active duty in the US Air Force, he served in the Combat Archer and F-22 Stealth Fighter programs where he was the director of enterprise network security. These days, he serves as virtual chief information security officer for many customers, including a professional sports team and fast-growing FinTech and AdTech companies. Over the years, Kip has built teams by interviewing hundreds of cybersecurity professionals. And now, he’s sharing his insider’s perspective with you!

Connect with Kip on LinkedIn

Visit Cyber Risk Opportunities

Download Kip's Book


Don't ever miss the opportunity for cyber resilience! Click subscribe to see our monthly newsletter in your inbox for your competitive business advantage.


Cyber Risk Opportunities LLC

113 Cherry St #92768, Seattle, WA 98104-2205

Robert Finch

Cyber Risk Analyst at Cyber Risk Opportunities / CR-MAP Practitioner / Cybersecurity Consultant

1 年

Awesome inflection point! Taking a nebulous question like "should I grant an exception" and turning it into a set of quantifiable risks makes a ton of sense.

要查看或添加评论,请登录

Kip Boyle的更多文章

社区洞察

其他会员也浏览了