I recently chaired a meeting of the Center’s Member Steering Committee (13 CIO peers helping the Center to engage members and drive value). As part of our discussion, we tackled the topic of risk management, and what we as CIOs are facing now in the area of risk management and security.
I would like to share some of the pressing issues we uncovered in our conversation, and invite you to add your own thoughts on what is keeping you up at night when it comes to risk management.
Regulatory oversight is making it tougher than ever
In the US, state level regulators are increasing scrutiny on information and data protections and security, which is consuming resources. One of my Committee colleagues described it this way:
“There is an increase in oversight in many areas from State attorneys general. I have the new responsibility to safeguard information. We are seeing the regulators looking at the protections we have in place; we have significant challenges around mobile technology and how we are securing the data; and we have a broad spectrum of challenges, with plenty of remediation work needed. This is a big drain on resources and we are in middle of fire drills to see where we have exposure.”
Outside the US, regulators are going beyond mandating what to do, to mandating what technology and even which vendors to use to do it. Two CIOs on the Committee share concerns in this arena:
“The scary part in all of this is not what to do, but how to do it. It is dangerous when the regulators start pointing you to what technologies to use and what vendors to use.”
“I have a similar experience in my country. The regulators have been overbearing, and are defining the vendors we can work with. It is not helping with the differentiation that you would want as an organization.”
Globally regulations vary greatly, with the imbalance in less regulated geographies providing weak links that impact security for everyone.
“It is not about regulation in one country. It is about a balance in the world. Is it okay that some countries have tighter regulations than others? The hackers or others that are trying to get into your systems will go through the weakest link…”
The consumerization of technology is upping the ante
Another hot button issue right now for the Committee is the consumerization of technology. Several committee members agreed that the proliferation of technologies and the end users’ knowledge and expectations around those technologies are making “the consumerization of technology a problem” to enterprises globally.
Social media brings lots of opportunity for enterprise threats and risk
As CIOs wrestle with social media in their enterprise, one of the biggest issues on their mind is the exposure and risk that comes along with all of the open networks and conversations. As one of my fellow members put it:
“The propagation of social media is propagating the risk management issues as well. We don’t really know who is making comments on social media. We need to constantly monitor what people are saying, and we need to address the customers and even competitors who are putting comments on social media. And don’t forget that the regulators are mandating that we have an approach to managing this, so we need to start having a plan to address this.”
The drumbeat for transparency is beating faster but so are the risks and threats
A final point made in our discussion is the CIOs must walk a challenging line, as the demands for transparency across the enterprise accompany ever-increasing risks and threat.
“We have to be aware that risk threat is higher than ever, and at the same time we are also charged with being more transparent than ever. Those two contexts are important to remember. Our risk management is also driven by the need for reputation damage control- driven both by compliance and a commitment as a profession that our organizations are protected”
These are a few thoughts from this Committee on the subject of risk management. As I consider these comments, and think through the challenge of managing risk for CIOs, I would add this additional perspective as you think about IT risk management:
Recognizing risk to manage it
A big risk management issue I see is how to recognize a threat and to know that a threat is present for your organization. Often it is hard to realize that a threat exists. When a threat finally occurs, it is hard to know how to reduce/eliminate it. And finally, it's also difficult to quantify the threat/risk (the chance of the threat to occur and the damage it might generate). I put these threats into three groups as a way to help think through my own strategy for risk management.
- Internal threats (e.g. people: screening; physical security measures: identification, biometrics; organizational: processes)
- External threats (e.g. hacker attacks; dependency of suppliers, power supply/electricity; physical threats: earthquakes, radiation, attacks, etc.)
- Compliancy threats (legal, liability, etc.). How can an organization oversee all new regulations (what is the risk of missing one...)
My question to my fellow CIOs is - how can technology help in deterring threats? The strength of the chain is decided by its weakest link: often people are the weakest part in the chain. What are you doing to deter threats in your organization?
More broadly, what risk management issues are keeping you up at night? What should CIOs be putting on their highest priority list in mapping their strategic risk management plans going in to 2012?
