Enterprise Risk Management - In the face of mounting cyber security regulations

1. Enterprise Risk Management
In the face of mounting cyber
security regulations

2. Cyber Security
o Rules established
by government
o A lot of attention
right now
o Misconceptions
o Struggle for
businesses to
stay safe
o Cyber economics
o Company culture

3. Government Approach
All Hazards

4. ISO 31000
Principles and guidelines
to formalize enterprise risk
management to
accommodate multiple
‘silo-centric’ management
systems
ISO 27005
Assists the satisfactory
implementation of
information security
based on a risk
management approach
Risk Management for Business
F.A.I.R.

5. WHERE ARE YOU STARTING?
Cyber Security

6. HOW ARE YOU BALANCING
PRIORITIES?
ERM and Cyber Security

7. ARE YOUR EXECUTIVES ENGAGED?
WHAT ARE THEY ASKING FOR?

8. DOES TRADITIONAL RISK
MANAGEMENT WORK WITH CYBER?
What’s failing?
Does all-hazards work outside of the government?

9. The Argument
for
Reasonable
Security

10. Phil Agcaoili
Distinguished Fellow and Fellows Chairman, Ponemon Institute
Board of Advisors, PCI Security Standards Council (SSC)
Financial Services – Information Sharing & Analysis Center (FS-ISAC)
Payments Processing Information Sharing Council (PPISC)
Contributor, NIST Cybersecurity Framework
Co-Founder & Board Member, Southern CISO Security Council
Founding Member, Cloud Security Alliance (CSA)
Inventor & Co-Author
CSA Cloud Controls Matrix (ISO 27017/27018)
Security, Trust and Assurance Registry (STAR), and
CSA Open Certification Framework (OCF) – AICPA SOC 2
@hacksec
https://www.linkedin.com/in/philA
Thanks