In the movie Moneyball, the Oakland A’s didn’t need more data; they needed to know which data actually won games. Risk assessment data has the same problem. A CVSS score of 9.1 might mean little to a CFO; the fact that it represents a vulnerability in a payment system processing $2 million daily means a great deal. This data must therefore link to information about operational disruptions that can cause financial loss, product delays, or draw the ire of regulatory authorities, for it to become more actionable.
A More Connected Risk Lifecycle is the Way Forward
Periodic risk assessment cannot keep pace with a dynamic threat landscape, underpinned by a volatile geopolitical environment and emerging technologies such as AI and quantum computing. Information risk management must instead become an ongoing process that connects risks, how well controls are working, and the potential consequences for the business if the controls don’t work.
Different risks have varying levels of impact, available data, and stakeholder needs.; therefore, the depth of analysis also varies. There are two analysis tracks you can use for this purpose. Qualitative analysis works when you need a fast decision with limited data, such as quickly rating the risk of a new SaaS vendor during procurement. Quantitative analysis fits when investment decisions need financial backing, e.g., deciding whether money spent on endpoint detection is justified given the projected cost of a ransomware incident. The IRAM3 methodology brings both tracks into a single unified framework that follows the same process flow end-to-end and is designed to be modular, so organizations can enter at whichever phase best fits their immediate needs.
