All the risk management measures an organization might take to address cybersecurity threats depend on one critical question: What is the organization’s risk tolerance? Risk tolerance is a concept borrowed from investment strategy and is part of various risk assessment methodologies. Investors with high risk tolerance are willing to endure volatility in the stock market and engage in risky investments; those with a low risk tolerance are more cautious.

All organizations have a team of C-suite executives to set strategy and run the business. Typically that group looks quite similar from one organization to the next, with the chief executive officer, chief technology officer, and chief financial officer among the most important. But do you also have a chief risk officer? Do you even need a “CRO”? What are the CRO’s responsibilities, anyway; and what is his or her role in enterprise risk management (ERM)?

Risk is inseparable from the modern business landscape – and therefore, every company needs an effective risk management program to identify, assess, manage, and mitigate risk. Robust processes, solid internal controls, and an enterprise risk management framework can help an organization identify best practices, share knowledge, and track metrics to meet these strategic objectives. But another critical element to risk management binds all those other components together: risk culture.

Healthcare organizations such as hospitals and clinics are vulnerable to all manner of cyberattacks, particularly phishing and business email compromise (BEC) scams, man-in-the-middle (MitM) attacks, and data breaches. Third-party risks and ransomware risks are also serious security problems in healthcare, especially in the post-COVID era. The medical world had already noted such cyberattacks years ago. The COVID-19 pandemic only underlined those worries about cyber attacks.

It seems like the next flavor of cyberattack is always making the news, a constant reminder of how vigilant businesses need to be to try and keep themselves, their customers and their suppliers safe. Almost every organization of any size will have some sort of vulnerability assessment and management program, security hardening framework and basic training for employees to recognize malicious emails and phishing attacks.

The Federal Risk and Authorization Management Program (FedRAMP) is a program run by the U.S. federal government to help cloud service providers bid on government contracts. Simply put, FedRAMP helps such providers achieve minimum standards of cybersecurity, so they can sell their cloud service offerings to federal government agencies more efficiently. All cloud service providers (CSPs) must achieve FedRAMP authorization to be able to contract with federal agencies.

There’s an old expression that says the most dangerous statement a person can make is “we’ve always done it this way.” I think we can all agree that we need to grow and adapt as the world around us changes. That’s why over the past few months, we’ve shown you ways to switch to a risk-first approach and align your risk and compliance activities to your business objectives.

Enterprise risk management (ERM) is a disciplined, holistic way to identify, manage, and mitigate risk throughout your entire enterprise. IT risk management (ITRM) is one subset of that effort, focused on identifying and managing risks specific to IT functions. An industry-accepted ITRM framework can help you implement an ITRM program quickly and with minimal disruption.

The Federal Risk and Authorization Management Program (FedRAMP) is meant to assure the security of cloud services used by the U.S. government. It standardizes the security assessments, authorizations, and continuous monitoring of cloud service offerings (CSOs) used by federal government agencies.