Someone Has to Decide How Much Cyber Risk Is Enough

GOVERN: Cybersecurity Governance in Plain English

Part 3 of the TCGB Subscriber Series

Every organization accepts cybersecurity risk.

Every one.

The organization with a world-class security program accepts risk.

The organization spending hundreds of millions of dollars on cybersecurity accepts risk.

The organization with a sophisticated security operations center, zero-trust architecture, continuous monitoring, penetration testing, cyber insurance, and an experienced CISO accepts risk.

There is no alternative.

The question is not whether your organization accepts cyber risk.

The question is:

Who decides how much is acceptable?

That is where cybersecurity stops being purely a technical discipline and becomes a governance responsibility.

And it is the central idea behind the second Category within the GOVERN Function of the NIST Cybersecurity Framework 2.0:

Risk Management Strategy — GV.RM.

The terminology may sound formal.

The underlying problem is something businesses deal with every day.

Resources are limited.

Threats are not.

Someone has to decide what matters enough to address now, what can wait, and what risk the organization is willing to live with.

There Is No Such Thing as Zero Cyber Risk

Imagine your security team identifies a serious vulnerability in a production system.

There is a patch available.

Problem solved?

Not necessarily.

Installing the patch requires taking the system offline for six hours.

Operations says the outage will interrupt production.

Sales says several major customer commitments could be affected.

Finance estimates the interruption could cost $1.5 million.

Security says exploitation of the vulnerability could lead to a much larger loss.

Now what?

You could patch immediately.

You could delay the patch.

You could implement a compensating control.

You could isolate the vulnerable system.

You could accept the risk temporarily.

Every option creates a different combination of cybersecurity risk and business risk.

Even the seemingly safest choice—patch immediately—has consequences.

There is no risk-free decision.

There is only a decision about which risks the organization is prepared to take.

Security Can Describe the Risk

This distinction is critical.

Cybersecurity professionals should identify threats.

They should analyze vulnerabilities.

They should assess likelihood and impact.

They should recommend controls.

They should explain what could happen if a risk is not addressed.

But there is a point at which the decision becomes larger than cybersecurity.

Suppose the CISO says:

“We recommend shutting the system down immediately.”

Operations responds:

“That will stop production.”

Finance says:

“The outage will cost approximately $250,000 per hour.”

Legal adds:

“We have contractual delivery obligations that could be affected.”

Security has not suddenly become wrong.

Operations is not wrong.

Finance is not wrong.

Legal is not wrong.

Each function is describing a different dimension of the same decision.

Someone must weigh them.

That is governance.

Risk Appetite Is Not a Number Security Invents

Organizations often use two terms when discussing this problem:

risk appetite and risk tolerance.

They are sometimes used interchangeably, but they describe related ideas.

Risk appetite expresses the amount and type of risk an organization is generally prepared to pursue, retain, or accept in pursuit of its objectives.

Risk tolerance becomes more specific. It establishes acceptable variation or boundaries around particular risks or objectives.

In plain English:

Risk appetite asks, “How much risk are we generally willing to take?”

Risk tolerance asks, “How far are we willing to let this particular situation go?”

Neither should be invented by the cybersecurity department in isolation.

Why?

Because cybersecurity risk exists alongside financial risk, operational risk, strategic risk, legal risk, safety risk, reputational risk, and other enterprise risks.

An organization may have an extremely low tolerance for anything that could threaten human safety.

It may have a higher tolerance for temporary disruption to an internal administrative service.

It may accept significant technology risk when entering an emerging market because the strategic opportunity justifies it.

It may have virtually no tolerance for unauthorized disclosure of certain regulated information.

Those are enterprise choices.

Cybersecurity helps leadership understand the cyber dimension of those choices.

“Critical” Cannot Mean “Fix Everything Immediately”

Security teams routinely encounter words such as:

Critical.

High.

Severe.

Urgent.

Emergency.

Those classifications are useful.

But if every critical vulnerability requires immediate remediation regardless of business context, then the organization has not really established a risk strategy.

It has established a severity rule.

Consider two vulnerabilities with identical technical severity.

The first exists on an internet-facing system supporting a critical customer service and is being actively exploited by threat actors.

The second exists on an isolated internal system scheduled for retirement next month.

Should they receive identical treatment?

Probably not.

The technical severity is one input.

Business criticality is another.

Threat intelligence is another.

Exposure is another.

Existing controls are another.

Potential impact is another.

Cost and feasibility of remediation are another.

Risk strategy gives the organization a disciplined way to combine those inputs.

NIST Makes This Explicit

Within GV.RM, NIST CSF 2.0 asks organizations to establish, communicate, and use cybersecurity risk-management objectives.

It addresses risk appetite and risk tolerance.

It calls for cybersecurity risk-management activities and outcomes to be integrated into enterprise risk management.

It addresses strategic direction for appropriate risk-response options.

And it recognizes the need for organizations to establish lines of communication for cybersecurity risks, including risks from suppliers and other third parties.

This is important because it moves cybersecurity risk out of its own organizational silo.

Cyber risk should not live in one register while enterprise risk lives somewhere else.

A material cyber risk is an enterprise risk.

The mechanism may be technological.

The consequence rarely is.

Every Risk Eventually Demands a Response

When an organization identifies a meaningful risk, there are several basic ways it can respond.

It can mitigate the risk by implementing safeguards.

It can avoid the risk by stopping the activity creating the exposure.

It can transfer or share some of the financial consequences through mechanisms such as contracts or insurance.

Or it can accept the risk.

That final option sometimes makes people uncomfortable.

It shouldn’t.

Risk acceptance is a legitimate business decision.

Unexamined risk acceptance is the problem.

There is an enormous difference between:

“We knew about the exposure, evaluated the consequences, considered the alternatives, determined the residual risk was within approved tolerance, documented the decision, assigned an owner, and established a review date.”

and:

“We knew about it, but nobody fixed it.”

Both organizations may have the same vulnerability.

Only one has a defensible governance process.

The Exception Is Where Governance Becomes Visible

Policies are written for normal conditions.

Governance becomes particularly important when the organization cannot follow them.

Suppose policy requires critical vulnerabilities to be remediated within 15 days.

Day 15 arrives.

The vulnerability remains.

What happens next?

In a weak governance environment, perhaps nothing.

The vulnerability simply becomes overdue.

It appears red on a dashboard.

Security sends another email.

Everyone moves on.

In a mature governance environment, the missed remediation deadline triggers a decision process.

Why can’t the vulnerability be remediated?

What is the current exposure?

Are compensating controls available?

What business impact would immediate remediation create?

Who has authority to approve the exception?

How long will the exception remain valid?

Who owns the residual risk?

When must it be reviewed?

What evidence documents the decision?

This is where risk appetite stops being a paragraph in an enterprise risk policy and starts influencing actual behavior.

“We Accept the Risk” Is Not Enough

There is a phrase cybersecurity professionals hear frequently:

“The business accepted the risk.”

Which business?

Who specifically?

Did that person possess the authority to accept it?

Did the decision-maker understand the potential consequence?

Was the decision consistent with established risk tolerance?

Was Legal involved if necessary?

Was the risk material enough to require executive escalation?

Did the board need visibility?

Was the decision documented?

Is there an expiration date?

What would cause the organization to reconsider?

Without answers to those questions, “the business accepted the risk” can become organizational shorthand for:

Nobody wanted to make the difficult decision.

Governance requires more precision than that.

The Person Benefiting From the Risk Should Not Define the Boundary Alone

This is particularly important when business incentives are involved.

Suppose a new product is scheduled to launch Friday.

The product team has revenue targets tied to the launch.

On Wednesday, Security discovers a significant vulnerability.

The product leader says:

“We understand the risk. Launch anyway.”

Should that be sufficient?

Perhaps the launch should proceed.

Perhaps it shouldn’t.

But the individual whose objectives are directly served by accepting the risk should not necessarily possess unilateral authority to determine whether that risk is acceptable to the enterprise.

This is why organizations establish escalation thresholds and decision rights.

The larger the potential enterprise consequence, the more likely the decision needs to move beyond the person responsible for the immediate business objective.

That is not bureaucracy.

It is a control against conflicted decision-making.

Risk Appetite Should Change Priorities

Here is a useful test.

If an organization’s stated cyber risk appetite disappeared tomorrow, would anybody running the cybersecurity program notice?

Would remediation priorities change?

Would exceptions be handled differently?

Would certain risks escalate sooner?

Would investment decisions change?

Would vendor requirements change?

Would the board dashboard change?

Would incident thresholds change?

If the answer is no, the risk appetite may exist only on paper.

A functioning risk strategy should influence decisions.

Otherwise, it is governance decoration.

Risk Strategy Also Determines Where the Money Goes

Every cybersecurity budget is a risk decision.

Spend another $2 million on identity security?

Improve recovery capabilities?

Replace an aging platform?

Hire more security engineers?

Increase monitoring?

Improve third-party risk management?

Segment operational technology?

Conduct more frequent testing?

There will always be more legitimate cybersecurity investments than available funding.

The correct question therefore isn’t:

“What cybersecurity technology should we buy next?”

It is:

“Which investment reduces the risks that matter most to the organization?”

That answer requires the Organizational Context we discussed in Part 2.

What matters to the mission?

Which services are critical?

What obligations must be satisfied?

What dependencies create concentration risk?

Which consequences are unacceptable?

Now risk appetite and risk strategy can guide investment.

This is why the GOVERN Categories build upon one another.

Context tells us what matters.

Risk strategy tells us how we will make choices about what threatens it.

The Board Should Not Approve Every Cyber Risk

Moving cybersecurity into enterprise governance does not mean every vulnerability belongs in the boardroom.

Boards should not become cybersecurity operations committees.

Management needs authority to manage risk within established boundaries.

That is precisely why risk appetite and escalation criteria matter.

They create decision boundaries.

Management can operate within those boundaries.

When risk exceeds them—or threatens something sufficiently material—the issue escalates.

The board then exercises oversight rather than performing management’s job.

A useful governance model therefore does not ask:

“Should the board make this cybersecurity decision?”

It asks:

“At what level should this decision be made?”

That is a much better question.

Someone Has to Own the Residual Risk

Controls do not eliminate all risk.

They reduce it.

What remains is residual risk.

That residual risk still belongs to someone.

Imagine an organization identifies a $10 million potential cyber exposure.

It invests in controls that substantially reduce the likelihood and impact.

Excellent.

But the remaining risk does not vanish simply because Security implemented the recommended safeguards.

Someone still needs to determine whether the residual exposure is acceptable.

And someone needs to own that decision.

This is one of the fundamental principles behind mature cybersecurity governance:

Security can manage controls.

Security can advise on risk.

But the enterprise owns the risk.

Five Questions Leadership Should Be Able to Answer

A functioning cybersecurity risk-management strategy should make five questions relatively easy to answer.

What cyber risks are we unwilling to accept?

Those are your hard boundaries.

What cyber risks are we willing to accept under defined conditions?

Those are your tolerances.

Who has authority to accept which levels of risk?

Those are your decision rights.

When must a risk be escalated?

Those are your governance thresholds.

How do we know accepted risks remain acceptable?

That requires monitoring, review, and evidence.

If those answers are unclear, the organization may have a cybersecurity risk-management process without having a coherent cybersecurity risk strategy.

The Goal Is Not Maximum Security

This may be the most important point in the article.

The goal of cybersecurity governance is not maximum security.

Maximum security would eventually make many organizations unable to operate.

Disconnect everything.

Allow no external access.

Install nothing new.

Trust nobody.

Make no changes.

Take no risks.

The organization might become extraordinarily secure.

It would also become extraordinarily useless.

Businesses exist to accomplish objectives.

Those objectives require taking risk.

Cybersecurity governance exists to help the organization take those risks deliberately rather than accidentally.

That means understanding what matters.

Understanding what could happen.

Establishing boundaries.

Assigning authority.

Making decisions.

And accepting that sometimes the correct business decision will involve knowingly accepting cybersecurity risk.

The important question is whether the organization can explain why.

“Secure Enough” Is a Governance Decision

In Part 1, I ended with a question:

Who is accountable for deciding what secure enough means?

Now we can add something to it.

“Secure enough” is not a technical measurement.

It is the point at which leadership determines that the remaining cyber risk is acceptable in light of the organization’s mission, objectives, obligations, resources, opportunities, and competing risks.

Security professionals provide essential information for that decision.

But someone has to make it.

Someone has to possess the authority.

Someone has to accept the consequences.

Someone has to own the residual risk.

Because every organization eventually reaches the same boundary:

You cannot eliminate all cybersecurity risk.

Someone has to decide how much is enough.

And once that decision has been made, another question immediately follows:

Who, exactly, has the authority to make it?

That is where we go next in Part 4:

Cybersecurity Accountability Cannot End With “IT Owns It.”