Latest Articles

"High Risk" Isn't Enough — Quantify Vendor Risk in Dollars the Board Understands The Quantification Challenge For years, vendor risk has been communicated with colored heatmaps and qualitative ratings—"Red" for high risk, "Yellow" for medium, "Green" for low. But executives don't need more "orange/red/green." They need consequences, options, and tradeoffs expressed in business language . Why Quantify Vendor Risk? Board-level communication: The board speaks dollars, not technical risk scores. Translating vendor exposure into concrete financial terms empowers business owners to make fast, risk-informed vendor choices . Investment justification: Compare risk reduction ROI across projects. Is it worth spending $100,000 to address a vendor risk? Quantification provides the answer. Risk prioritization: Focus on vendors with the highest financial exposure. Budget allocation: Allocate resources where they deliver most value. The CRQ Approach What is Cyber Risk Quantification? CRQ translates vendor exposure into concrete financial terms. It answers the question: "How much financial exposure do we have from this vendor relationship?"  Key elements: Loss exposure in dollars Likelihood in percentage terms Expected loss (Exposure × Likelihood) Mitigation cost and effectiveness Quantifying Vendor Risk: A Framework Step 1: Identify the Risk Scenarios What could go wrong with this vendor? Data breach Service outage Regulatory fine Reputational damage Step 2: Estimate Financial Impact (Loss Exposure) Scenario Estimated Cost Data breach $4.88M (industry average) Service outage $100K per hour Regulatory fine $5M Reputational damage $2M Step 3: Estimate Likelihood What is the annual probability? Vendor security rating (C, B, A, etc.) Historical incident data Industry benchmarks Step 4: Calculate Expected Loss Expected Loss = Loss Exposure × Probability Example: Loss exposure: $4.88M (data breach) Probability: 15% (based on vendor security rating) Expected Loss: $4.88M × 15% = $732,000 Step 5: Evaluate Mitigation What is the cost and effectiveness of controls? Mitigation cost: $100,000 Control effectiveness: 60% Expected Loss after controls: $732,000 × 40% = $292,800 ROI: ($732,000 - $292,800) - $100,000 = $339,200 The "Blood Supply" Example Matthew Modica, CISO at BJC Health System, gave a powerful example of prioritization from the health industry: "Would you rather I report on how many vulnerabilities that a vendor company has or that the company supplies 20% of the blood supply to our hospitals?"  This question reframes risk from technical details to business outcomes—the real measure of what matters. Real-World Impact Organizations that use CRQ for vendor risk can: Compare risk reduction ROI across vendors Justify security investments to the board Make faster, risk-informed vendor choices Demonstrate VRM value in financial terms Conclusion When TPRM connects to loss exposure, mitigation cost, and operational impact, it stops being compliance theater and becomes a decision system . Organizations that quantify vendor risk in financial terms will make better decisions and communicate more effectively with stakeholders. Action Items for Your Organization Adopt a Cyber Risk Quantification model Translate vendor exposure into financial terms Use CRQ to justify VRM investments Report VRM success in dollars, not colors Train teams on CRQ methodology  

AI Agents Are Moving from Recommending Actions to Taking Them — GRC Will Never Be the Same The Autonomy Shift Agentic AI is reshaping GRC by enabling systems that can independently plan and execute multi-step workflows rather than simply generating outputs . This represents a shift from reactive compliance to continuous assurance, from static risk registers to real-time risk visibility, and from manual workflows to orchestrated risk management . What Agentic AI Can Do in GRC Autonomous Evidence Collection AI agents can continuously gather and validate evidence for audits, dramatically reducing manual effort . Automated Risk Remediation When risks are detected, agentic AI can initiate remediation workflows, orchestrate cross-functional actions, and generate executive-level insights . Continuous Third-Party Monitoring AI agents autonomously retrieve vendor data, validate responses, and correlate external risk signals . Regulatory Mapping AI systems interpret regulatory texts and map them to internal controls, generating audit-ready narratives . The Agentic AI Ecosystem The transformation involves a network of specialized agents: Agent Type Function Perception Agents Scan for risks and anomalies Reasoning Agents Analyze and interpret risk data Control Agents Validate compliance Action Agents Execute remediation Learning Agents Adapt and improve over time CISO Takeaways The shift requires a fundamental rethinking of how GRC is operationalized : Move from audit readiness to continuous assurance. Leading enterprises are collapsing audit cycles into always-on validation through AI-driven control monitoring. Prioritize platforms over point solutions. Move away from fragmented point solutions toward unified, AI-enabled GRC platforms. Shift focus from detection to orchestration. The true value of agentic AI lies in autonomous execution—enabling systems not only to identify risks but also to initiate remediation. The Adoption Reality Avasant research found that 68% of Gen AI projects are in production, while 30% of agentic AI projects have moved past the pilot/POC stage . The technology is moving from experimental to operational. Conclusion Agentic AI is enabling closed-loop GRC systems where risks are not only detected but also acted upon through orchestrated workflows. The future of GRC will be defined by the ability to operationalize intelligent, autonomous, and governed risk management at scale . Action Items for Your Organization Assess which GRC workflows could benefit from agentic AI Start with a pilot focused on one autonomous capability Establish governance for AI agent autonomy Define human-in-the-loop requirements Measure the impact on manual effort and response time  

What's the Real Risk After Controls? — The Critical Distinction Every GRC Pro Must Understand The Two Risk States Risk assessment must consider both inherent and residual risk: Type Definition Inherent Risk The level of risk that exists before any risk treatment or controls are applied Residual Risk The level of risk that remains after risk treatment and controls have been applied Why the Distinction Matters The distinction is important because: It shows the value of controls It enables informed risk acceptance decisions It helps prioritize risk treatment It demonstrates control effectiveness Calculating Inherent Risk Inherent risk is assessed by considering: The potential impact of a risk event The likelihood of occurrence The vulnerability of the asset No controls are considered in inherent risk assessment. Calculating Residual Risk Residual risk is assessed by: Starting with inherent risk Subtracting the effect of controls Considering the remaining risk Residual risk = Inherent risk × (1 - Control Effectiveness) Example: If inherent risk is $1,000,000 and controls reduce it by 60%, residual risk is $400,000. Accepting Residual Risk Risk acceptance should be the least preferred option over risk mitigation through implementation of primary controls . When risk is accepted: Risk acceptance should be formally documented, approved, and signed-off by the business owner Risk acceptance should be provided with detail justification including impact of not implementing controls and compensating controls in place The accepted risk should be within the risk appetite Risk acceptance should be renewed periodically Risk acceptance should be presented and reported to the risk committee  The Risk Treatment Continuum 1. Risk Avoidance Eliminate the activity or asset that creates the risk entirely. 2. Risk Reduction (Mitigation) Apply controls to reduce likelihood or impact. 3. Risk Transfer Shift financial exposure through insurance or contractual terms. 4. Risk Acceptance Consciously tolerate residual risk within defined appetite. Why Organizations Avoid Formal Acceptance Many organizations avoid formal risk acceptance because: It requires executive visibility It creates accountability It exposes control gaps But formal risk acceptance is essential for effective risk management. Without it, risk is accepted informally—with no documentation, no accountability, and no visibility. Conclusion Understanding inherent and residual risk is essential for effective risk management. Organizations that calculate both will know the value of their controls and make better decisions about risk treatment. Action Items for Your Organization Calculate inherent risk for key risks Assess control effectiveness Calculate residual risk Document risk acceptance decisions Report risk acceptance to the risk committee Review risk acceptance periodically  

Don't Put All Your Eggs in One Basket — Vendor Diversification Is Your Best Defense The Diversification Imperative While continuous monitoring and risk assessment may help minimize the disruption and react faster in case of any escalations, measures such as vendor diversification help de-risk with a more proactive approach . Why Diversification Matters Single Points of Failure Avoiding over-reliance on a single vendor from sensitive regions helps ensure operational resilience . One vendor failure can cascade through the entire organization. Geopolitical Exposure If a vendor is sanctioned or loses operational rights in your region, services may be abruptly restricted . Diversification provides alternatives. Operational Resilience Local and alternate vendors in different jurisdictions who are capable of stepping into the shoes of an alternate provider, must also be identified to take over in the event of risk translating into reality . Building a Diversification Strategy 1. Identify Critical Services Which services are business-critical? Which would cause significant disruption if unavailable? 2. Assess Single Points of Failure Are you over-reliant on any single vendor? What would happen if that vendor failed? 3. Identify Alternative Vendors For critical services, identify a plan B upfront . This could be a different vendor or an internal capability . 4. Develop Transition Plans How would you transition to an alternative vendor? What data and systems need to be migrated? 5. Test and Maintain Regularly test transition capabilities. Maintain relationships with alternative vendors. The "Parallel Open-Source" Approach "CIOs need to keep their ears and eyes open for any emerging threats and always have a parallel open-source system trial in place for any unforeseen eventuality and unavoidable breach of contract or trust, which may occur with the existing digital infrastructure provider" . Practical Implementation For cloud services : Use multiple cloud providers Implement multi-cloud architecture Ensure data portability For critical applications : Identify alternative providers Maintain integration capabilities Test migration processes For data and systems : Ensure data portability Maintain open, non-proprietary formats Document dependencies Conclusion Vendor diversification is a proactive strategy for building supply chain resilience. Organizations that identify alternative vendors for critical services and develop transition plans will be better prepared for unexpected disruptions . Action Items for Your Organization Identify business-critical vendors Assess single points of failure Identify alternative vendors for critical services Develop transition plans Test transition capabilities regularly    

NIST RMF, ISO 27005, FAIR, and COSO ERM — Which Framework Is Right for Your Organization? What Is an IT Risk Management Framework? An IT risk management framework is a structured methodology that organizations use to identify, assess, quantify, and treat risks to their information technology systems and data. It provides repeatable processes for evaluating threats and vulnerabilities, determining risk tolerance, and implementing controls that reduce risk to acceptable levels . IT risk management frameworks differ from general enterprise risk management (ERM) by focusing specifically on technology-related threats: cyberattacks, data breaches, system failures, vendor compromise, and regulatory non-compliance . Major Frameworks Compared Criteria NIST RMF ISO 27005:2022 FAIR v3.0 COSO ERM Primary Focus Federal IT security Information security risk Risk quantification ($) Enterprise-wide governance Approach 7-step process 5-step cycle Quantitative analysis model 5 components, 20 principles Risk Measurement Qualitative Qualitative or quantitative Quantitative (dollar values) Qualitative with strategy integration Control Library 1,000+ controls References ISO 27001 No controls 20 integrated principles Best For Government, contractors ISO 27001 certification Board-level financial justification Cross-functional enterprise risk Complexity High Moderate Moderate High NIST Risk Management Framework (RMF) The NIST RMF is the most comprehensive framework for organizations that need structured, repeatable processes with a deep control library. Its seven steps—Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor—map directly to federal requirements under FISMA but are widely adopted in the private sector . When to use it: You need compliance with NIST SP 800-53 controls, are a government contractor, or want the most prescriptive implementation guidance available. ISO 27005:2022 ISO 27005 provides a five-step risk management cycle (Context Establishment, Risk Identification, Risk Analysis, Risk Evaluation, Risk Treatment) with two distinct approaches: event-based assessment and asset-based assessment . When to use it: You're pursuing ISO 27001 certification and need a risk assessment methodology that integrates with the broader ISO 27000 family of standards. FAIR v3.0 (Factor Analysis of Information Risk) FAIR is the only internationally recognized standard for quantifying information risk in financial terms. Updated in January 2025, FAIR v3.0 uses the formula: Risk = Threat Event Frequency × Vulnerability × Loss Magnitude . When to use it: You need to justify security investments in financial terms, compare risk reduction ROI across projects, or communicate risk to non-technical stakeholders. COSO ERM COSO ERM takes a top-down approach, integrating risk management with organizational strategy and performance. Its five components—Governance and Culture, Strategy and Objective Setting, Performance, Review and Revision, Information and Communication—span the entire enterprise rather than focusing on IT alone . When to use it: You need enterprise-wide risk governance that connects IT risk to business strategy, financial risk, operational risk, and compliance. How to Choose the Right Framework If Your Organization… Start With Consider Adding Is a government contractor or federal agency NIST RMF FAIR for quantification Needs ISO 27001 certification ISO 27005 NIST CSF for maturity benchmarking Needs to justify security budgets to the board FAIR NIST CSF for operational controls Manages risk across multiple business functions COSO ERM NIST RMF or ISO 27005 for IT specifics Is a mid-market company starting from scratch NIST CSF 2.0 ISO 27005 or FAIR as you mature Many mature organizations layer frameworks rather than choosing just one. A common approach is COSO ERM for enterprise governance, NIST CSF 2.0 for cybersecurity operations, and FAIR for quantifying risk when presenting to the board . Action Items for Your Organization Assess your regulatory requirements Evaluate your risk maturity level Choose a primary framework based on your needs Consider layering frameworks for different purposes Map controls across frameworks to avoid duplication 7. The Five-Step IT Risk Management Lifecycle Headline: From Identification to Monitoring — The Five Steps Every Organization Needs for Effective IT Risk Management The Core Risk Management Lifecycle The core risk management lifecycle follows a consistent pattern across all major frameworks, even though terminology varies. Every framework moves through some version of these phases . Step 1: Establish Context and Scope Define what's in scope (business units, systems, data types), your organization's risk appetite, and your risk tolerance . Key activities: Identify business units, systems, and data types in scope Define risk appetite—the strategic level of risk you're willing to accept Establish risk tolerance—the acceptable deviation from risk appetite Document a formal risk appetite statement approved by the board Risk Appetite vs. Risk Tolerance: Risk appetite is a strategic, board-level decision about how much risk the organization is willing to pursue in achieving its objectives. Risk tolerance is the operational, business-unit-level acceptable variation around that appetite . Step 2: Identify and Catalog Risks Build a risk register by systematically identifying threats, vulnerabilities, and assets . Key activities: Asset-based identification—what systems hold sensitive data? Threat-based identification—what attack vectors target our industry? Include third-party risks—49% of breaches now originate with vendors Include emerging risks from AI deployment Step 3: Analyze and Quantify Assess each risk's likelihood and potential impact . Key activities: Start with qualitative ratings (Low/Medium/High/Critical) if you lack data Plan to move toward quantitative analysis as you mature Use risk quantification formulas and methods Step 4: Treat and Prioritize For each risk, select a treatment option based on a cost-benefit analysis : Option Description Cost/Risk Reduction Remediate Eliminate the root cause permanently Highest cost, highest risk reduction Mitigate Reduce likelihood or impact through compensating controls Moderate cost, partial reduction Transfer Shift financial exposure through insurance or contractual terms Variable Accept Consciously tolerate residual risk within defined appetite No cost, risk remains Avoid Eliminate the activity or asset that creates the risk entirely Variable Remediation vs. Mitigation: Remediation addresses root causes through permanent fixes—patching a vulnerability, replacing an insecure protocol, or decommissioning an unneeded system. Mitigation reduces consequences of a risk that still exists—adding monitoring, implementing compensating controls, or limiting blast radius . Step 5: Monitor and Iterate Risk management is continuous, not a one-time exercise . Key activities: Establish Key Risk Indicators (KRIs) Define monitoring cadences Integrate risk reviews into existing governance processes Document residual risk acceptance Regularly update the risk register Conclusion Risk management is not a one-time project—it's a continuous cycle. Organizations that follow this five-step lifecycle will be better positioned to identify, assess, and mitigate IT risks effectively. Action Items for Your Organization Document your risk appetite and tolerance Build a risk register Implement risk quantification Define risk treatment plans Establish Key Risk Indicators (KRIs) Review and update risk assessments regularly