Why existing compliance programs won’t always protect you from IT risk

Risk is a business concept, in that anything that threatens an organization’s ability to achieve its financial goals is considered a business risk. When it comes to IT risk, many organizations rely on compliance regulations and standards to enforce security and reduce cyber-risks.

However, the scope of these regulations and standards are often narrowly focused to specific aspects of the business or type of data handled, and don’t provide a comprehensive evaluation of the state of security surrounding the entire IT infrastructure.

With an ever-changing threat landscape, an increase in the number of cyber-attacks, and sophistication of new threats, it’s critical that organizations methodically evaluate IT risk with enterprise-wide assessments and don’t rely solely on a check-the-box compliance strategy to mitigate threats and vulnerabilities.

COVID-19 changes

The COVID-19 pandemic is a prime example of a risk that took most companies by surprise; and one where compliance requirements did little to help mitigate the rise in security vulnerabilities.

COVID-19 has:

• Forced businesses to reevaluate how they operate
• Created talent shortages due to furloughs and layoffs
• Increased security risks due to home network vulnerabilities, VPN issues, cyberattacks through email and phone, malicious video conferencing, and more

The need for enterprise-wide IT risk assessment is especially clear during times of disruption. Organizations must be diligent in identifying, evaluating, and mitigating technology risk to protect confidentiality, integrity, and availability of IT assets.

For more details, please see a Cybersecurity checklist for remote work.

Bolster security with IT risk assessment

An IT risk assessment aims to provide a comprehensive evaluation of an organization to identify potential threats and countermeasures to reduce the risk. No organization can completely eliminate risk, so an IT risk assessment helps determine which vulnerabilities present the most risk to the organization.