How Do I Manage This?

Abstract

Cybersecurity risk is ubiquitous and so there is a need to manage it as such, at the enterprise level. Management strategy begins with an understanding of business fundamentals: mission, vision, and core values. These fundamentals are not simply part of management strategy; they comprise the success criteria to which strategy itself is compared. Management strategy lays out detailed business objectives that correspond to goals, and develops plans for how they will be achieved. As an organization makes business plans, risk is a key consideration in evaluating and selecting from alternative management strategies. Decision makers need to recognize the technology associated with any business strategy may be exposed to cyberattack. Cybersecurity risk management at the level of the enterprise therefore begins with understanding and communicating how technology supports strategy. The structure and function of the enterprise governance function provide the key linkage to enable organizations to execute strategy; effective governance guides the movement of the organization toward strategic goals.