Cybersecurity & Data Privacy Risk Management Model (C|P-RMM) Overview

To help simplify risk management practices, ComplianceForge and the Secure Controls Framework (SCF) jointly developed the Cybersecurity & Data Privacy Risk Management Model (C|P-RMM). The concept of creating the C|P-RMM was to establish an efficient methodology to identify, assess, report and mitigate risk across the entire organization.

The C|P-RMM:

• Is a free solution that organizations can use to holistically approach that breaks risk management down into seventeen (17) distinctive steps;
• Exists is to help cybersecurity and data privacy functions create a repeatable methodology to identify, assess, report and mitigate risk;
• Offers flexibility to report on risk at a control level or aggregate level (e.g., a project, department, domain or organization-level); and
• Guides the decision to a risk treatment option (e.g., reduce, avoid, transfer or accept).

The most important concept to understand in cybersecurity and data privacy-related risk management is that the cybersecurity and IT departments generally do not “own” technology-related risks, since that “risk ownership” primarily resides with Line of Business (LOB) management. An organization’s cybersecurity and data privacy functions serve as the primary mechanism to educate those LOB stakeholders on identified risks and provide possible risk treatment solutions. Right or wrong, LOB management is ultimately responsible to decide how risk is to be handled.

Where the C|P-RMM exists to help cybersecurity and data privacy functions create a repeatable methodology to identify, assess, report and mitigate risk. This is based on the understanding that the responsibility to approve a risk treatment solution rests with the management of the LOB/department/team/stakeholder that “owns” the risk. The C|P-RMM is meant to guide the decision to one of these common risk treatment options:

1. Reduce the risk to an acceptable level;
2. Avoid the risk;
3. Transfer the risk to another party; or
4. Accept the risk.

It is a common problem for individuals who are directly impacted by risk to simply claim, “I accept the risk” in a misplaced maneuver to make the risk go away, so that the project/initiative can proceed without having to first address deficiencies. This is why it is critically important that as part of a risk management program to identify the various levels of management who have the legitimate authority to make risk management decisions. This can help prevent low-level managers from recklessly accepting risk that should be reserved for more senior management.

Fundamentally, risk management requires educating stakeholders for situational awareness and decision-making purposes, where reporting risk can be summarized by explaining the “health” of the cybersecurity and data privacy program as to how the assessed controls provide assurance that the organization’s stated risk tolerance is or is not achieved. Therefore, the goal of the C|P-RMM is to categorize the risk assessment results according to one (1) of the following three (3) risk determinations:

1. Conforms;
2. Significant Deficiency; or
3. Material Weakness

Views: 6