دانلود کتاب ایجاد یک برنامه مدیریت ریسک سایبری

We (Brian and Brandon) have been on a multiyear mission to better define a cyber risk management program. This journey has been driven by curiosity and an intentional effort to challenge existing notions. We hope this book will also inspire you to embark on a new or continued journey, hopefully one that stirs your own curiosity and thoughtful approach to maturing your practice, but also your department, or your personal career. This book not only defines risk management but describes how to build your own cyber risk management program. Ideally, this program would be supported by existing standards, laws, and authoritative guidance. It should stand on its own as a true foundation for the strategic elements of a security practice. It also has expected outputs and is defendable. Lastly, it can support security’s practice through the unknowns of digitalization, and it can drive strategic decisions, protect against budding liability, and communicate security’s value as a strategic partner. As we started breaking down the SEC’s guidance to support our definition of a cyber risk management program, a bigger picture emerged. Not only was the SEC formalizing an obligation, but the courts were beginning to close in on corporate-officer-level liability, including the CISO. In addition, every industry experienced digital risks, with new threats and breaches appearing constantly. Security organizations struggled to communicate the value of their efforts, and tried to avoid finger-pointing should something happen. These organizations were continuously fighting the perception that everything is protected because budgets have been approved. Today, all of these challenges are increasing, in degree and complexity. Every enterprise is digitalized, increasing the surface area of risks exponentially, with increasing speed and without the necessary or appropriate conversation of risk balance. All the while, business leaders are starting to get budget fatigue, putting even more pressure on the security organizations as they look over their shoulders at even bigger threats—competition and even more serious consequences if they don’t move fast enough in this new economy. Our journey has led us to map a variety of authorities that helped clearly define a cyber risk management program. It turns out, there’s a lot to pull from. It just hasn’t been organized. We mapped the SEC guidance, international risk standards, regulatory approaches, case law, and guidance from the National Association of Corporate Directors (NACD) into a cyber risk management program (CRMP) framework. The framework covers four core components that make up a formal program along with supporting principles that provide more detailed guidance for implementation. This framework supports the concepts in this book and can be found at CRMP.info. When implemented, it should result in a standalone formal program—a needed program that answers the question that stirred this all up.