Organizational Governance

0:06Within information security and IT in general we hear a lot of buzzwords and one of those buzzwords is governance. And if you ask 10 different people what governance is, you might end up with 10 different answers. So we are going to put this to rest right now, we're going to talk about what governance is, why we need it and how we do it. So come with me as we discuss governance. All right, governance here we go, what on Earth is it?

0:38Well, it really comes down to the oversight of something, and along with oversight of something comes some tasks and things that we do. And it really comes down to the efforts by our executive management via like strategy and oversight, which I just mentioned, over key business activities to make sure that they're doing what they're supposed to be doing. And that's where oversight comes into play. Now there are four activities we're going to mention right off the top here, such as defining objectives, because if we don't define objectives then we're not sure where we're headed because an objective is something we want to achieve.

1:21It's something that, as we look down the road, it's that pot of gold at the end of our rainbow. And that's an objective, it's where we want to go, where we want to get to. So if we don't have objectives then we really don't have anything we're trying to achieve and that's not good. So we need objectives. That's right, that's numero uno. Next up, we're going to have to have some policies. Policies are outlining the organization's stance on things. It lets people know what we want to do with, of course, our stance as I said but really how we want to do business, how we want to achieve it.

1:58And it helps us outline a path or different ways that we can achieve our objectives. Next up is delegate authority, and that's because we know that executive management can't do everything themselves, that's right. We need to delegate authority so other folks can do the day-to-day tasks because we've got executive management up here and they're saying this is our objectives over here, this is how we're going to do it, and then they delegate, of course, the authority down here to the other folks to make sure that our plans are carried out so that we can meet our objectives, absolutely.

2:38And lastly, we need to monitor our objectives or our controls, everything we put in place via metrics. So that means we need to create metrics so that we can monitor different processes and controls that we have in place because if we're not measuring something then we can't really tell for sure if it is succeeding or if it's failing. And that's why metrics are such an important piece of governance and overall, IT and IS strategies.

3:12Now when it comes to IS or information security governance, it has a main purpose, and that is to make sure that the information security efforts that we're putting into play, everything we're doing toward information security, all those efforts are in alignment with business objectives. So you'll see these here are in alignment with each other. And that is super important because everything we do when it comes to management, and that could be information security, information technology, risk management, all these things, everything we do here, needs to be in alignment with business objectives.

3:52And that means they need to be in support of the objectives. If our business objectives are here and we are working on risk management processes and objectives and our efforts, and they're going along like this and they start to veer off in a different direction, then we've got a problem and we need to stop. We need to go back and re-observe our business objectives and get this back in alignment with it. Because everything must be in alignment with business objectives.

4:23That is a very key takeaway from this lesson. Next up, the primary objective of information security governance. Now, we mentioned, the primary purpose was to be in alignment with business objectives, yes, we got to make sure it's in alignment but then our objective, that's our pot of gold at the end of the rainbow, what we're trying to get to, is to protect our CIA triad, that's our confidentiality, our integrity, and, of course, our availability. So we're protecting our assets in the CIA triad.

4:56And that is the primary objective of information security governance, protect our assets' confidentiality, integrity, and availability. Now, as we talk about governance, there's lots of different activities that are required for governance to happen. So let's talk about some of these activities. Now, first of all, we've already mentioned this once, and it was define objectives because again, we need to have someplace that we're headed to, we need objectives, something we're working towards.

5:30So an example of an objective would be maybe to protect the organization from unnecessary risk, that's one of our objectives. So then we'd be looking to see what is unnecessary risk? How do we identify it, so that we can protect from it? And that would be one of our objectives. Next up, we need a strategy. So we need to create a strategy. Now again, a strategy is let's say we are here, this is today, and we have an objective of where we want to be at a later date because we know it's going to take some time to get there, everything we need to do in between here and there, each one of these tasks that I'm putting on here, these are all tasks here, are our strategy.

6:14If we do this, and then this, and then all these, by the time we're done, we will have reached our objective and this whole plan that we've outlined here is our strategy. So we create a strategy. Next up, we're going to need to create some policies. Hey, we talked about this on the first slide as well, as one of the things we need to be doing because these policies are going to define the organization's stance on security and on risk and on all different types of things. But we need to have policies, because they are defining and they are communicating-- let's put comm down here-- because really they are providing a way of communicating the organization's stance to everybody within the organization.

6:57So that is our policies. Next up, we need to look at adopting standards. And that's because if we pick a standard that we want to go with, that's going to help us to become consistent, let me put that down here consistent. So that everything we do in our organization as long as it's in alignment with this standard as far as policies and putting out controls and processes and such, well, if they're in alignment with the standard, they're going to be consistent across the organization.

7:28And that's what we want, consistency. Then we need to create something else, we need to create processes. And the processes are defining how activity should be performed. So if we want to do something, there is something that has to be done, we create a process that outlines how exactly that should be done. Do you know why? Well, it's because we want it to be repeatable, a repeatable process because if it is repeatable, guess what it goes back to? That's right, consistency, and that's what we're looking to achieve because if we can have consistency in everything we do throughout the organization, it's going to help governance and metrics and everything to work better because we're all in alignment with the business objectives.

8:10Then we need to define controls, that's something else we need to define. Now controls are something that's put in place to help detect or avoid or counteract something like a security risk to an organization. And that's really what we're looking at here is with controls, risk. Now some of these controls could be like firewalls, you could have antivirus, security guards, security cameras, fire suppression systems, there's a ton of different things that we can put in place that are controls and it helps to control risk.

8:42And then lastly, we need to define, and other than define, we need to analyze metrics, that is right. We need to, of course, collect metrics because if we want to be able to see if something is a success or a failure, like a control or a process or something, we have to measure it. And how do we measure things? Well, we do so via metrics. So you might say, well, what kind of metrics am I collecting?

9:12Well, depends on what you're trying to measure. So first of all, you have to define what do I want to measure or monitor? That would be like number one, that's your question one, and then you're going to say, well, how do I define a success or failure? So you say success or failure-- and this is just a kind of a shorthand here-- and then you're going to say three, all right, I have this list of success and failures of what would determine that. How do I monitor each one of those, what data do I need to collect? And then those are the metrics that we're going to start collecting so that we can define success or failure in something like a control or a process.

9:51And we can also, if we monitor those, over time we can see kind of a rise and fall, and we can catch things if they go out of our comfort zone really. So if we say we're willing to accept this amount of deviation from normal within our metrics that we're collecting, and if it goes outside that then we can be notified and we can go ahead and implement a corrective action and figure out what happened.

10:22So those are metrics. And these are some of the IS governance activities that we have to do in order to make sure governance is working properly. But there's still a couple more activities. And these are a little different. So let's take a look at these. Some additional IS governance activities. Now the first one is risk management, and heck yeah, you better believe it is an information security governance activity, risk management is rock star-level super cool stuff. And yeah, we've got to control our risk, we've got to manage it.

10:52Another thing we need to be concerned with is compliance. So when it comes to compliance if your organization has regulatory or legal or even contractual compliance requirements, well, we need to identify the requirements, and then we need to monitor those compliances. And how do we monitor something? That's right, back to our metrics. Metrics come back into play as we're monitoring something like compliance. So we can ensure that we stay within compliance because if you fall out of compliance well, there could be financial penalties and there's always the risk of losing business because of being out of compliance.

11:30So compliance is important. Next up, BC/DR planning, that's our business continuity and disaster recovery planning because, of course, business continuity, disaster recovery is all about, that's right, responding to risk. So if a risk event happens, how do we deal with it? Well, hopefully, our business continuity and disaster recovery plans will cover that because if not, then we didn't do a good job in creating them and we need to do better next time. So of course, business continuity and disaster recovery planning is a governance activity.

12:03And then lastly, resource management. Now in order to get things done, we have to have resources, we have to have people that will do the work, we have to have budgetary support. We have to have other things like supplies and such that may come into play. So basically, we have to have various resources. And that means we need to manage our resources, we need to make sure that we have enough resources but not too much, because the thing is, if we have too much, then we're wasting.

12:36So you need to find a balance here and that is what resource management is about, making sure we have enough to get the job done but not so much that we're wasting resources. So again, these are all activities that are part of IS governance. Now, effective IS governance has two-- I'll put this little arrow in-- two primary outcomes, number one, is increased trust. Now, this is trust from inside the organization, this is trust from business partners and from customers but basically, it's increased trust.

13:11And this is because we're doing security the right way. Meaning, when a customer asks to see maybe our information security policy to make sure that we have one, hey here it is and it is an awesome policy. Maybe they want to take a look at some of the metrics we're using to verify that our controls are actually functioning. Guess what? We've got them, here you go, bada bing, bada bang. We can provide that information at a moment's request. And I'll tell you what, I have filled out a ton of questionnaires for clients who I provided security services to and they were a service organization or they provided services and their customers would send over questionnaires to fill out all about security, how are you doing this, how are you doing that?

13:59And if you can honestly answer all of those checkboxes in that questionnaire and provide things like copies of metrics or your policies or whatever, you know what, when that customer gets this back, they're like, holy cow, these folks are on top of it. That is where your trust comes from. And your internal personnel are going to see how things are being done, going to see things are done right and properly, there's documentation, there are policies, there's all the things and they're going to trust that the organization is on the up and up, so that is increased trust.

14:31And with that comes improved reputation. So within the industry, you will have an improved reputation and the organization will be known as someone who does security the right way and of course, can be trusted. So these are two of the outcomes of effective information security governance. And that covers our security governance lesson. I hope this has been informative for you, and I'd like to thank you for viewing.

0:07If you've ever set out to achieve a specific goal and you're maybe talking with someone about it, they might ask you what's your strategy for achieving that goal? So maybe your goal is to start a new business or make the Olympic team or become an astronaut, who knows what it might be? But what is your strategy to achieve that goal? Now, this can be a little tricky because really I mean, what is a strategy? I mean, it could be a lot of different things. And in information technology, information security, risk management, governance, all these things, we use strategies.

0:43And if you're not sure what a strategy is well guess what, you're in the right place because right now we're going to talk about strategies, what they are, how to create them, and how they can benefit us in reaching our goals. So let's get started. So first off, we've got to define what in the heck a strategy is and it's as simple as a plan to get to where you want to be, it is a plan. OK, so a plan but how do I come up with this plan, right?

1:13Because just knowing what it is doesn't help me all that much. I need to know how do I create this plan. And that's what we're going to talk about. So cool, you're in the right place. So of course, we start off with a goal or an objective. We say a goal, sometimes we call it an objective, they're the same thing, right? It's something we want to achieve. So first of all, we need to define what this is. And then we need to figure out how do we get there.

1:44How do we get to this place? And this how is guess what? It's your strategy. It's that simple. So let's go ahead and let's outline a quick strategy. So steps to defining your overall strategy. Now, what was step one? It was defining our goal or objectives. So we've defined that, we'll say our goal in this strategy is to reduce the risk of let's say data loss from lost devices.

2:17That is our goal or our objective because we're trying to keep it focused in this example. So we have a very focused goal or objective, reduce the risk of data loss from lost devices. So like portable devices, cell phones, tablets, laptop computers, so on, so on, so on, and so forth. Now, we need to identify where we are in comparison to where we want to be. So here's where we are today, and when it comes to portable devices and such, do we have any policies, that would be the first question.

2:53And we say nope, there's no policies around portable devices. So all right, so this is where we are today. And where we want to be is we want to be in a place where we have reduced risk of data loss from lost or really-- I'll put stolen-- lost or stolen devices. So what do we need to do to get from here all the way over to here? And what we're doing is performing a gap analysis. And this gap analysis is going to tell us what we need to do to get from here to here.

3:28And so let's start with this. Let's talk about this, we had no policy. So step one is probably going to be to create a policy. We need to create a policy. And this policy will be around the management of portable devices and what kind of data can be on these devices. Then we probably need some type of way to manage the devices themselves. So maybe a device management system. All right, cool. So that way we can manage devices, we can do remote wipes and we can reduce the lost or stolen data.

4:03OK, so that's going to be a step in it. So now we have policy around our devices and we have a way to manage the devices but here's a question for you, how do we know if we're succeeding or not? That's right, metrics. Now we need to include some type of metrics for monitoring devices. So how many devices do we have? How many of them are managed? So we can see if there is some that aren't managed or such. All right, there we go. So now we have metrics. So now we have a strategy because our strategy is going to be to first create a policy, then to implement some type of system that will help us manage these devices and maybe do like a remote wipe on them or encrypt the data on them so the data can't be stolen.

4:47And then lastly, of course, we need metrics to make sure everything's working like we hope it should. So there we go, we have just created a strategy and that is step three which was decide how we're going to get there, how to do it basically. So our goal was-- so step one, was to establish a goal. Step two was to do basically a gap analysis to figure out what we need to do to get there, and then step three is put that into a plan. And that is our strategy right down here.

5:20There we go. That's defining a strategy. And this was a very simplified strategy, it was very focused. So if your strategy is to reduce risk, well, that's a pretty wide strategy. So you're going to have a big list of things to do in your gap analysis and a rather large strategy but you have a plan, that is your strategy. So now that we have the strategy there are some tools that will be part of this strategy or achieving our strategy such as policies and procedures.

5:51So we'll say policies and procedures, P&Ps. Because we're going to have to have policies in place to outline our stance on certain things like managing data that goes on mobile devices or the devices themselves. We have to have procedures around how to register new devices that come into the organization. So we make sure they get managed and procedures for reporting lost or stolen devices, things like that. So as we follow that example, you got policies and procedures. We're also going to need a risk assessment program.

6:22And risk assessment, that's going to be a tool that we use as part of the strategy so we can assess the risk associated with different activities. We're going to need to implement the security or risk framework because if we implement a framework or a standard that we're going to follow, that takes us back to our consistency that we talked about in the last video so that we can make sure we're all doing things the same way, there we go. We're also going to need asset management as part of our strategy because no matter what it is, there's assets involved and we need to make sure that we're able to identify those assets and track them and make sure that they are being managed properly.

7:04And then lastly, our business continuity and disaster recovery planning. And some of these tools are the same thing we saw with our governance, that is absolutely right. Thank you for pointing that out because that is very true. A lot of these things will overlap because they are such useful tools. Now, one question you might have is well, where do I want to be? I know where I am today kind of but I don't know where I really want to be. And this goes back to frameworks and standards.

7:37Now, these are going to help you decide where you want to be. So you may want to go ahead and pick a specific framework or standard like the ISO 27000 series, and that way you have something that's going to help you identify where you want to be. It's going to give you an outline of some best practices. And the thing is, there's lots of standards out there. So let's talk about some of those standards and different frameworks. So you have COBIT, that is by the folks over at ISACA. And COBIT is a framework around information security and risk as well as addressed in there.

8:12You got the ISO/IEC 27001, part of the ISO 27000 family. And this is all about information security management. There's the ITIL, of course, ITIL is a well-known framework. You've got HIPAA, and that's around patient data information. NIST, or National Institute for Standards and Technology, NIST has the SP 800-53, this is about your security and privacy controls. The CIS folks, CIS always put out a top 20, so the CIS top 20 is kind of a list of top 20 security controls that you should consider implementing.

8:52They are the top 20 controls that are going to give you the most bang for your buck. And then, of course, PCI-DSS as well for credit card-related information. There's all these. And there's a ton more out there. And the thing is, maybe you think, well, let's see, we do handle patient information, that's something we do because we're a medical clinic and we also process credit cards. So maybe we need to follow this one as well. So you may end up selecting more than one of these.

9:23Or it may be you don't process credit cards or patient information but you'd like to combine a couple of these to make them custom. You can make your own custom framework if you want to or standard. And that's OK, you can do that it's your decision. But what I want you to know is when trying to decide where you want to be, just remember you've got all these frameworks and standards out there that are industry-proven. And they're put together by some pretty smart people out there too who know what they're doing. So why not just choose one of these or another one and go from there?

9:56So now you figured out you're going to go with a specific framework or standard. Now how do you figure out where you're at today because remember, we have to figure out where we are today because now we have our standard or our framework, we know where we want to be. We want to be over here with our standard over here but how do I know where I am today? Well, there's a couple different things that we can do. We can perform some assessments. Number one, we can perform a risk assessment, and that will help us identify where we are with risks and our risk maturity program within our organization.

10:36Then we can also do a threat assessment so we can assess the threats to our organization, the likelihood that something would happen. Number three, we could perform a compliance assessment. So if there are some types of compliance, regulatory compliance, legal or contractual compliances that we have, well guess what? We need to assess those to see where we are today. And then lastly, a general security assessment so that we can identify what policies, procedures, standards, guidelines, controls, metrics, what all we have in place when it comes to security.

11:17And all of this information here will tell us where we are today. And that way we can go ahead and figure out how do I get from where I am today to where I want to be so that I can create my strategy. Now, once you define your strategy there are a couple of key points that you'll want to adhere to. Number one, strategic alignment. And this means that everything you do must be in line with, you guessed it, organizational goals.

11:48Because everything we do in the organization or in business needs to be in alignment with the organization's goals as well. Number two is manage risk. And that's because risk management is super important for something and that is decision making. So we have to be aware of risk, we have to be managing risk, we know what risks we're dealing with. So when it comes to making decisions about the business that we can provide senior management and the C-level execs the information they need to know about risk to make good decisions.

12:21Number three is manage resources. And again, this goes back to managing your personnel, making sure you have enough personnel, as well as managing your budgetary restrictions so that you're not wasting resources. So resource management. And lastly, number four, we need to measure. That's right, that comes down to our metrics. So we need to have metrics in place so we can measure what we're doing to make sure that we are succeeding on it.

12:52That we're making a forward and upward progress because if we're not collecting metrics, if we're not measuring something, we're not going to be able to tell if we are succeeding in that or not. And these are four key points to adhere to with your information security strategy. I hope this has been informative for you and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] Now that we've identified what a strategy is and we went through and we actually put a little strategy together as an exercise, now the question becomes, how do I manage my strategy and my objectives? That's what comes up next, because now we have it. We have our plan or a strategy, how do I manage that strategy? How do I manage my objectives? That is what we're going to talk about right now.

0:31So starting off. To manage a strategy or an objective, we can use the SWOT, S-W-O-T, that stands for strengths, weaknesses, opportunities, and threats. And that is our SWOT analysis. Now, the way this works it's an exercise, and allows us to identify what we're doing good, what we're not doing good, and where we can improve. And that's what this exercise is all about. Now, let's walk through this as an exercise, and let's say we're going to do SWOT analysis for cloud security in our organization, because we have recently moved to the cloud or move some of our applications to the cloud, and now we want to do a SWOT analysis on our cloud security.

1:16So let's walk through how this works. So now we're starting off with our strengths. So we'll put S, I'll put W over here, O over here, and T down here. That's our strengths, weaknesses, opportunities, and threats, and this way we can outline. Now, strengths. What are our strengths when it comes to cloud security as we sit around the table here and we discuss this as a group? And we find out that well we have cloud engineers. So we do have cloud know how on staff.

1:48So that's good, and we have off-cloud backups. Meaning, we have backups that are to another location other than the cloud. All right, that's good. So we have how here. We have brainpower about cloud. We're doing good backups for our cloud, because we got them onto another platform out of our cloud provider so that we have a second copy somewhere. So that is good. That is definitely strengths. But when it comes to weaknesses, we find out, as we discussed, that we really have no cloud security program.

2:22And that's very good to know, because we need one. So that is a weakness. We don't have a program. So that being said, what kind of opportunities do we have here to improve our weakness? Well, actually, ISO, international organization for standards, puts out the 27017 which is security controls in the cloud. We'll put down here security controls in cloud just so we can have a reference there.

2:56There we go. Now we know that there is a standard out there that can help us implement a security program. So this is definitely an opportunity for improving our weaknesses. Excellent. Cool. So now lastly, what are our threats? Well, we could have misconfigurations. Yes, you're absolutely right. We sure could. We've got human error, and that really goes a long way, so human errors, and then lastly, how about a security problem?

3:26A security event, would say, security event could happen. That's definitely a threat. All these are threats. So what are some opportunities that we could have to improve on these threats? Well, misconfigurations in human error. How about we go through and make sure that we have a change management program in place? So let's put a cloud change management program. If we had one of those, that would help us with misconfigurations in human error, because every change that happens has to be approved, it has to be verified.

4:01Great. And what about a security event? Well, we've already covered that, because we're looking at implementing the ISO 27017 into a new cloud security program up here. And that will actually take care of that. So now you see, we just talked through a SWOT analysis about our new cloud efforts and how we could do better with cloud security. And you see how the SWOT analysis actually works. So you get the folks around the senior management, around who manage this area of the organization, you do your analysis. So that you have all the right people at the table to provide the information and discuss this, and we had a great outcome.

4:38So we end up with two opportunities. We're going to work on our security problems by implementing the ISO standard here, and we're going to implement a cloud change management program to address misconfigurations and the human error. And there you go. That is SWOT in action. Now, is that the only way to manage things? Well, heck no. Absolutely not. Let's take a look at the next one. This is our CMM, our capability maturity model. And this is basically a scale of maturity. So we want to take a look at something, and that something could be a process, it could be a control, it could be a program that we have, it could be an application that we've developed.

5:17And the idea is we take whatever that is and we rank its maturity. And it starts down here at the bottom, and it works its way up as we can see. So if we have our thing down here, whatever it is that we're wanting to rank the maturity and see how mature it is and where we can improve, well, we start off with level 1. And that is initial. And initial means that the process is inconsistent, whatever it is we're dealing with the application, the process, the control consistent. We're not measuring it, so it's unpredictable as to whether or not it's succeeding or failing, but it is in place.

5:52So, of course, that's at the very bottom. So then as we move up to number 2, repeatable, then we start to see that we've got performing consistently, and we get the same outcome each time. So that's a good outcome. We're improving there. And as we move up to step 3 to defined, well, that's where we come out with a well-defined and well documented whatever it is, the process or the controller or application. We're moving up the scale. So we'll say, well documented over here.

6:24And then actually, number 2 was we're actually getting consistency. So let's put that in here. Consistency. There we go. So we get consistency in 2, then we get good documentation on 3. And as we get up to number 4, that's where we start to see metrics, and that's where we start gathering our metrics, because we have documentation, we know how everything works, we're doing it consistently, and now on step 4 of this maturity model, we're gathering metrics so that we can show success or failure.

7:00And we can work to improve on our failures. And then lastly, when we get up to number 5, that's where we have continuous improvement. Let me put that up here. Continuous improvement, and that is 5. So once you get to 5, you are at continuous improvement. Now, not all processes or controls are going to reach level 5, and that's OK. You might just get to 4. So you're collecting metrics and it's repeatable, you've got documentation, the metrics are there to help us identify if we fall out of variance.

7:32And that's OK. That's still a good place to be. And this model helps us to see where we're at and what we need to work on. So this is the capability maturity model. And lastly, we have roadmap development. And this is what we would use to help visualize our strategy, because we're going to list out the steps that we need to complete in order to meet our objective, and that, of course, is our strategy. And it's usually based on a timeline that we see down here, and it's much like a Gantt chart.

8:07And I guess you could actually use a Gantt chart to do this. But a Gantt chart, if you're not familiar with it, is over here. We list out all of our tasks that need to be done, and generally we would list who is responsible for that task. And we list according to a timeline, which we see across the top here, when those are going to be done. And that way we can see what's overlapping. And if there are prerequisites, we can make sure the prerequisites are done before the actual task, and we can lay things out in a visual perspective.

8:38And this helps us to track our progress and see where we're at in the strategy so that we can meet our objectives. And there you go, the roadmap development is our final tool for managing our strategic objectives along the path to success. I hope this has been informative for you, and I'd like to thank you for viewing.

0:06Within organizations, we've got lots of different roles. And when it comes to risk, there's lots of different roles in risk management as well, like, who's accountable for something? Who's responsible for something? Who should be informed when something happens? These are all great questions. And we're going to answer those right now as we dive into the roles associated with risk management in an organization. Now, the first thing is document, document, document. You're thinking, I thought we were talking about roles and responsibilities dealing with risk.

0:39Well, we are. And the thing is we need to document all the roles and responsibilities in an organization. That's because whenever there is a question about who's responsible for something, or who's accountable for something, well, we can go back to our documentation of roles and responsibilities. And that's why it's super important to get these in writing on paper. Now, let's talk about risk roles.

1:09Now, there's four main types of roles when it comes to risk, and they're known as RACI. That is Responsible, Accountable, Consulted, and Informed. So let's start with responsible. These are individuals responsible for getting the job done. So basically, we say, get the job done. These are those folks. So oftentimes these are the risk practitioners, right? These are the folks in the trenches that are getting the job done. These are the folks that are responsible for that specific task.

1:42Then we have accountable. That is next. And these are the folks who are assigning tasks. They're making sure the tasks are assigned out to someone, so that they can be performed. So that leads us to the next one, which is consulted. And these are generally subject matter experts. And we refer to them as SMEs, or S-M-Es.

2:13So these are the folks who know a lot about a particular area of the organization. It could be a specific type of system. It could be a process or something. But we are consulting the SMEs, asking them questions about, is this OK to do this? It won't break anything, right? And we're going to check in with them, right? We're consulting with them. We're asking for their advice or feedback. And then, lastly, we have informed. And these are the folks who when something is updated or something is done, who do we inform?

2:45So this is usually our senior management, as you could imagine. So down here in our responsible, these are generally our risk practitioners. Our accountable folks, oftentimes, are a committee of some sort who come up with the different tasks that need to be completed, and then they can assign those out. Our consulted, that's our SMEs down here, and then, our senior management are those who are usually informed. Now, this isn't set in stone. This is just kind of usually.

3:16So you definitely need to know your RACI, your Responsible, Accountable, Consulted, and Informed. Moving on, we have a RACI chart. Now, this is an example I pulled out of the CRISC Review Manual 7th Edition. And down here we have a little key of our RACI terms, our Responsible, Accountable, Consulted, and Informed. We're going to talk through this. So the tasks we have here, we have some different roles over here. So of course, these are roles within our organization.

3:47So our task, task number one was to collect some risk data. Now, as you can see, who's going to be doing the work? Who's the one responsible? Well, that ends up being our risk practitioner over here. Who's assigning this out? Well, that's the accountable folks. And that is our steering committee. And then, who is consulted about this? Our subject matter expert. Well, that actually, in this case, is our department managers. And then, lastly, who are we going to inform about the information we find? And as you see, senior management.

4:19And there we go. What about delivery of a risk report, number two here? Well, as you can see, it's a little bit different because our risk practitioners are still delivering the report. They're doing the work there. And our steering committee is kind of setting this in motion. But who are we informing? We're informing both senior management and department managers. There you go. What about prioritizing risks? Well, as you can imagine, this is going to be a little higher level. Our risk practitioners are not going to be prioritizing risk.

4:51Who's doing that? That's right. That's our department managers. And who are they consulting? You better believe it, the risk practitioners down there in the trenches who are working with risk every day. And then, who's being informed? Well, the steering committee is being informed. And who is setting this in motion? That's our senior management. And then, lastly, monitoring of risks, that's our monitoring to make sure that things are going OK. Who's setting this in motion? Who's accountable? Well, that's our steering committee. And then, who's actually doing the work?

5:23Who's responsible for this, the monitoring? Absolutely, that's our risk managers. Who are they consulting to make sure it's happening? And that is our risk practitioners. And then, of course, who's being informed? Senior management. And this is a RACI chart. This is kind of how it works. As we talked about the different RACI roles, now we can see those roles in action with different tasks. So that's pretty darn neat. Moving on, there are some key risk roles. Now, we've talked about some types of roles. That was our RACI, our Responsible, Accountable, Consulted, and Informed.

5:56Those were types. Now, we're going to look at the actual roles. And we're starting off with risk manager. Now, the risk manager is responsible for making sure that risk management happens, as you can imagine. So the risk manager is responsible-- we put an R. That's our RACI term-- responsible for making sure that, well, risk management happens, right? That's their whole job. Then we have a risk analyst. That is a risk analyst. And the risk analyst is responsible.

6:28There we go. It's a RACI term for analyzing, evaluating, and assessing threats. So the risk analyst is responsible for making sure risk is analyzed. It kind of works, right? These aren't too tricky of terms. Then we have risk owner. There we go. That's next up. And the risk owner is actually the person who has the authority, and RACI term, Accountability, to make risk-based decisions, and is also responsible for any loss that occurs based on a risk scenario.

7:01So the risk owner is accountable for managing-- let's put it here-- managing a risk. And it could be multiple risks, but they are the owner of that risk. They manage it, and they are accountable for it. Then we have a control owner. Now, a control owner is a person accountable-- that's a RACI term there-- for ensuring the controls are designed and implemented to keep risk under control.

7:35So that is a control owner. Now, a control could be a security control, like a firewall. It could be a policy. It could be lots of different things. But the control owner is accountable for making sure that controls are designed and implemented. But then, we have a control steward. And a control steward is responsible-- and when it comes to-- remember, responsible, we'll say, equals work. And then the accountable equals delegation.

8:07We'll put it that way. They delegate the work. But they manage whatever that is. And they delegate the tasks to those responsible. But they also manage whatever they're over, and they're responsible for it. So the control steward was responsible for like routine maintenance on controls and making control changes. So we'll say control changes. There we go. And then, lastly, we have our subject matter experts, or our SMEs.

8:42And our SMEs were those that we consulted for their advice on certain things that we were working on as it pertains to risk, because our SMEs were those with specific knowledge about areas of the organization. And we wanted their input on decision making. And there we go. These are some key risk roles. That was our risk manager, a risk analyst, risk owner, control owner, control steward, and our SMEs, or Subject Matter Experts. And let's wrap up by actually taking a look at an organizational chart and some of these roles.

9:18All right, here we go. Here's an org chart. We've got our senior management at the top. And then, over here, we've got a risk management unit. Over on the far right, we've got our assurance unit for auditing. We've got IT here. And of course, business units or like departments. So starting off, you'll notice that some of the blocks are different colors. And that's because the green blocks, like this one here, are actual roles within risk, whereas the blue boxes are not necessarily.

9:49So what we have here is in our risk management area here, we have a risk manager and a risk analyst. So I'm going to put risk in here, and risk here. That way it kind of makes that pop a little bit-- risk manager and risk analyst that we talked about. When it comes to our business units, we have risk owners and control owners. But you don't see control stewards here. That's because most often those will fall under IT. And I'm going to put control. Actually, I don't need to, because we have stewards that work on the systems and stewards that work on controls.

10:24So these are our control stewards. Now, remember, the control owners were responsible for a specific control, making sure they we created and implemented. And the control stewards actually did the day to day work with the individual controls. So these are some of the different risk roles, as you see them in an organizational chart. I hope this has been informative for you. And I'd like to thank you for viewing.

0:06When it comes to information security and risk management programs, what do you think the number one factor is in the success or failure of these programs? Well, I'm going to give you a hint. It's people. And it's actually comes down to the culture of the organization. So let's jump in and talk about risk culture. Now, culture within an organization is super important because people, that's right, people are the driving force of security and risk in the organization.

0:43So it is super important that leadership set the example. If we have our org chart here, and we've got our C level execs up here at the top, and then we've got senior management, guess who needs to be setting examples of risk in security awareness and practice? That's right, those folks at the top. This needs to be a top down effort. So we said people, that was number one.

1:13Secondly was top down support, that we just talked about. Then third is there accountability within security think back to our racey. Remember our RACI that we just talked about are responsible, accountable. There it is accountable, consulted, and informed. You have to have accountability because you need to ensure that folks are accountable for their roles because if they're not-- if there's no accountability, then hey, who cares if I don't do my job?

1:44There's no accountability. That's why we've got to have it. And then lastly, we need a great security and risk awareness program. That way, everyone, all those people, are aware of security practices and risk practices and what they need to be doing within the organization. And that is part of the organizational culture when it comes to risk. But we're not done. That's because decisions, decisions, decisions, are always being made in an organization.

2:18Any mature organization, let's put this down here. A mature organization will always include risk in their decision making to make sure that they see the whole picture, all the risk that's involved in it as well as the reward because oftentimes those making decisions get drawn towards the reward, and they focus on that, and they're not considering risk in the decision. So immature organization will always include risk in its decision making, and that is risk culture within an organization and why it is so important.

2:56I hope this has been informative for you, and I'd like to thank you for reviewing.