Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Risk, exceptions and acceptance

Writing, scoring and deciding on risk, and handling the gaps you can't close yet: exceptions, acceptances and segregation of duties.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we write a risk so it's a risk and not an audit finding?
  2. How do we score risks consistently when two people assess them?
  3. How do we decide between treating, transferring, avoiding and accepting a risk?
  4. How do we build a risk register from nothing?
  5. How do we score an exception and set how long it lasts?
  6. How do we separate duties when there are only a few people?
  7. How do we stop the exception register becoming a graveyard?

When do we…

Triggers and timing: when something has to happen.

  1. When does a risk need reassessing outside the annual cycle?
  2. When is a risk outside appetite, and what has to happen then?
  3. When does a deviation from policy need a formal exception?

Who decides…

Authority: who may approve, accept or act.

  1. Who can accept a risk, and does the answer change with its rating?
  2. Who approves a Critical exception in an organisation shaped like ours?

Is it…

Judgements with a yes or no at their centre.

  1. Is this a risk acceptance or a security exception?

If…, then how…

Situations: something has happened, what now.

  1. If the business wants to accept a risk I think is unacceptable, then how do I proceed?
  2. If an exception expires and the gap is still there, then what?
  3. If the same exception comes up for renewal a third time, then what?
  4. If risks sit "in treatment" for years, then how do we get them moving?
  5. If the only IT administrator also manages the security logs, then how do we control that?
  6. If developers deploy their own code to production, is that a conflict, and what compensates?

Other categories