Beginner’s Guide to IT Risk Management

Managing risk is at the heart of every enterprise. Decisions about finance, marketing, expansion and human resources all include some level of risk.

When enterprises evaluate their IT-related risks, factors that come into play include security, access, data handling and regulatory compliance management. As you put together an enterprise risk management (ERM) strategy, IT risks must be prioritized according to how likely they are to result in data breaches and non-compliance with industry regulations.

What Is IT Risk Management?

Risk management is the identification, analysis, prioritization and mitigation of risks.

IT risk management focuses on risks inherent to IT functions, such as network communications and employee web access. The overarching purpose of any risk management effort is to assess the likelihood of each risk and minimize the probability of adverse outcomes.

Organizations can identify risks through several methods. Some common techniques include:

• Conducting a risk screening assessment to rank and prioritize risks
• Hiring a third party to conduct a risk analysis
• Investing in risk-analysis software platforms

IT risk management is a component of a more comprehensive ERM strategy. You can use ERM strategies to identify, assess and prepare for dangers (including IT risks) that pose a threat to your operations and objectives.

IT Risk Management Basics

IT risk management is an ongoing process that can be conducted on an enterprise-wide basis or at a more granular level, such as across a single department or IT-related project.

The three central steps of IT risk management are:

• Risk assessment and analysis
• Risk evaluation and prioritization
• Risk mitigation through implementation of risk-reducing internal controls

Because infrastructure, business priorities and threats are constantly changing, IT risk management must be a continuous process.

Conducting an IT Risk Assessment

These overarching steps can serve as a framework for performing an IT risk assessment.

1. Identify Assets and Processes

Make a list of assets — servers, data, documents — and the tools and processes related to these assets. Examples include:

• Software
• Hardware
• Stored data
• IT security policies and architecture
• Data flow processes
• Technical and physical security controls
• Support personnel

2. Identify Risks

Examples of IT-related risks include:

• Non-compliance with regulations such as GDPR, CCPA and PCI DSS
• Network security vulnerabilities
• Employee malice or mistakes
• Equipment failure

Every business will have its own unique risk profile. Of course, there will be some similarities in the tools and systems they use. For example, most organizations create and store some sort of financial information, whether it’s transaction records, credit card information or private customer data, as well as personally identifiable information (PII). Since this information is inherently sensitive, there are specialized tools for financial reporting and PII management that are useful for many organizations. Still, you have to take into account your unique business settings, your infrastructure and the settings of each specific system in your infrastructure.

3. Rank Risks

Decide which risks pose the most potential damage and rank them in order of importance. After the assessment team identifies and prioritizes these IT risks, it’s time to decide how to manage them.

4. Choose an IT Risk Management Strategy

Organizations must choose the right technique for dealing with each specific risk to protect their assets. The four most commonly used risk management techniques are avoidance, mitigation, transfer and acceptance.

Risk Avoidance

Perhaps the most straightforward technique an enterprise can take is to avoid risks when possible. While many kinds of risks are unavoidable in the course of business, some risks aren’t necessary to keep an enterprise running. For example, an enterprise can decide to stop collecting specific types of personal data, such as age or phone numbers, not required for the business to operate.

Risk Mitigation

When a risk is unavoidable, or when the cost of avoidance is too high, enterprises can try to manage risk through mitigation. Mitigating an enterprise risk can lessen the adverse impacts of known, unavoidable risks.

There are many ways IT teams can mitigate risk. Following the principle of least privilege for network access, for example, can help to limit the number of employees who have access to sensitive data, thus reducing the risk of data leaks and accidental data deletion.

IT teams can also help mitigate risks by utilizing security platforms that enable them to conduct careful network monitoring, as well as data discovery and classification tools. The extended visibility into IT infrastructure and data enabled by these platforms helps detect unauthorized activities or weak configurations before they lead to a cybersecurity breach. Finally, IT department input can help shape safer corporate policies related to risk-prone activities like internet usage.

Rolling out a new IT tool in stages is another way IT professionals can mitigate risk. For example, when migrating from on-prem Microsoft Exchange to Office 365, a gradual introduction can mitigate risk. This will allow teams to handle any issues as they arise, reducing the risk of downtime.

Enterprises have several overarching controls to choose from that can help to mitigate risk. The three main types of controls are physical, technical, and organizational.

• Physical controls are the tangible assets that organizations use to secure and monitor physical assets, including IT equipment. Examples include security guards, biometric access controls, CCTV, motion sensors, and barriers like fences and gates.
• Technical (logical) controls include hardware and software mechanisms that keep assets protected. Firewalls, antivirus software, security platforms, audit software, access control lists, authentication tools and encryption are all examples of technical controls.
• Organizational controls are the best practices, procedures and guidelines that govern the way an enterprise conducts business to comply with security goals. Policies regarding internet usage, company equipment, network access, and account provisioning and deprovisioning are examples of organizational controls.

If you don’t know how to identify which risk mitigation controls your organization needs, consider using existing IT risk management models and frameworks to protect your business:

The Risk IT Framework helps companies identify and mamanage their IT risks.

• COBIT (Control Objectives for Information and Related Technology) is a framework for IT governance and management tools designed to help managers develop an ERM strategy that ensures the quality, control, and reliability of information systems.
• The COSO (Committee of Sponsoring Organizations of the Treadway Commission) framework outlines a set of controls aimed at fostering secure, efficient operations across an entire enterprise.
• Factor Analysis of Information Risk (FAIR) is a model that explores how risk factors affect one another. FAIR also helps organizations comply with international regulations.

These frameworks can be used together, as many of their functions overlap or are actually improving upon another set of guidelines.

Transfer of Risk

Sometimes, enterprises choose to transfer risk to an outside party. Cyber insurance, for example, transfers the risk of financial loss that can result from data breaches to an insurance provider.

Another example is data storage companies that can help enterprises reduce the risk of business interruption due to data loss by providing off-site data backups. Data stored off site is safe from both network breaches and employee mishandling. Even when data stored on a local network is lost, any data backed up off site is retrievable and can help ensure business continuity.

Risk Acceptance

Finally, enterprises can choose to accept some risks as part of their ERM strategy. These decisions are made by weighing the costs of mitigating these risks against the costs that the company will face if the risk happens. It would be impossible to avoid the chance of risk altogether, so all enterprises must determine how to allocate resources according to what they determine is an acceptable amount of risk.

For example, the networks that companies use to conduct business, communicate and store data present many risks. These risks can be accepted when a potential loss caused by them will be

lower than costs of mitigating it. Oftentimes, stronger security measures may carry with them a higher cost, but companies may consider that cost acceptable considering the risks they prevent.

Preparing for IT Risk Management

An effective ERM program relies on committed resources, management buy-in and streamlined communication between IT teams and other key stakeholders within the organization. Risk management can become a sprawling, time-consuming process, but it is a critical component of running a safe and efficient operation that always stays in compliance with industry standards.

Whether you’re figuring out how to get started with ERM or fine-tuning existing processes, you might want to consider an IT risk assessment solution that helps identify and prioritize the IT-related risks that pose a threat to the security of your environment and can lead to a costly security breach.