System of Controls

Risk never sleeps for business as cyber-attacks continue to mount against our organizations. The very technology infrastructure that enables new business innovation and creates market value is under constant threat from digital attacks.

IT is tasked by their organizations to lead on mitigating cyber risk while simultaneously driving innovation and keeping the lights on. But IT is often overwhelmed and struggling to keep pace with all the new threats. The number of risk factors is constantly growing. There is an increasingly larger digital footprint to defend as well as more threat attackers to contend with that have dynamically evolving motives, tactics, and techniques. And there is a growing compliance and regulatory requirements that are increasingly more complex and cumbersome.

In response to these challenges, many businesses have increased security budgets, added more cyber professionals, and deployed additional security tools to keep pace with the threats. Unfortunately, many security programs continue to struggle as they rely on external practices, standards, and frameworks to guide a disjoined strategy that functions more as a bolt on rather than an embedded function to the larger organization. Cyber incidents continue to mount across all industries.

From the point of view of the business, they are asking what they are getting for all their investments in security. They need more from IT and their security programs! IT needs to change course by transforming how they think about cyber security.

This book takes a systemic look at our environment to better understand the risk landscape, improve alignment with other parts of the business, and take the lead to better manage cyber risk.

To mitigate cyber risk from disrupting our organization's achievement of its business goals, IT needs to transform how they approach security. This book lays the foundation for a transformative journey for IT to re-imagine their cyber security program through the lens of systems thinking in the context of risk management.