GRC (Governance, Risk, and Compliance) and cybersecurity symbiotically support and reinforce each other in safeguarding an organisation’s digital and regulatory landscapes. Integrating cybersecurity into GRC programmes enables businesses to address risk holistically, encompassing both policy and digital perspectives.
Diligent, a GRC platform, recently explored what the biggest risk trends of 2024 might be.
With an established framework that merges policies, controls, and procedures, GRC cybersecurity ensures that business objectives are tightly aligned with cybersecurity goals.
Over recent years, the increasing intensity and frequency of cyberattacks have catapulted cybersecurity to the forefront of board directors’ concerns. Events like the pandemic and escalating geopolitical tensions have both revolutionised IT infrastructures and introduced new vulnerabilities, underlining the essential need for a comprehensive and integrated GRC and cybersecurity approach.
John Zangardi, with executive cybersecurity experience including a role as CIO of the Department of Homeland Security, observed, “Whether you’re looking at Iran, Ukraine, or even a potential China-Taiwan Strait scenario, cyber will be a part of that.”
Expanding cyber risks and corresponding regulations have seen a surge in demand for transparent disclosures regarding an organisation’s risk posture. Myrna Soto, CEO and founder of Apogee Executive Advisors, underscored the recent approval of a “slew of SEC rules around disclosures and incident reporting,” urging compliance, especially within regulated industries. In such a scenario, a robust cybersecurity GRC framework enables organisations to navigate through complex regulations while managing cybersecurity risks proficiently.
In an environment where cybersecurity poses a monumental risk to businesses, the synergy between cybersecurity and tech teams is pivotal in shaping the overarching business risk posture. “Compliance drives change. But it doesn’t make you more secure,” opined Myrna Soto. Expanding the GRC function, as she suggested, can provide a detailed and transparent representation of an organisation’s security, risk mitigation strategies, and areas of improvement, thereby facilitating board members in comprehensive understanding and informed decision-making.
The construction of a cybersecurity GRC framework ensures that organisations not only manage and counteract cybersecurity risks but also adhere to industry regulations and standards. This framework encapsulates governance, risk management, compliance, security controls, and continuous monitoring, offering a structural means to ensure digital assets are protected and regulatory standards are met.
Cultivating a new partnership between GRC and cybersecurity involves a multi-step process that encompasses addressing corporate culture, making risk relevant and comprehensible, understanding the role of audit, and utilising GRC cybersecurity technology. Both Soto and Zangardi emphasised the necessity of shared accountability and mutual goals, with Zangardi concluding, “It’s about understanding what you’re trying to achieve and working toward common goals.” Contextualising risks, building audit partnerships, and adopting technology can help in advancing this integrated approach.
In essence, an effective collaboration between cybersecurity and GRC teams, underlined by the right culture, clear communication, and robust technology, will be the cornerstone of identifying and mitigating cyber risks, ultimately providing the board with quality information for informed decision-making.
Diligent concluded that as we progress towards 2024, the integration of GRC and cybersecurity is not just a choice but a strategic necessity to enhance security, satisfy regulatory requirements, and prosper in a digital world.
Read the story here.
Keep up with all the latest FinTech news here
Copyright © 2023 FinTech Global
Copyright © 2018 RegTech Analyst
