Contents
Security Risk Management versus Enterprise Risk Management (ERM)
Security risk management — especially in the cybersecurity — can be seen as a specialized branch of the bigger Enterprise Risk Management (ERM) picture. The key difference? ERM looks at all the risks a company faces, while security risk management zooms in on one thing: keeping people, assets, and information systems safe from breaches, crime, and bad actors.
Scope and Function
Let's see where they are different and where they overlap in Scope and Function
General Risk Management (Enterprise Risk Management - ERM):
Comprehensive Approach: ERM is a comprehensive approach used to manage risk across a large organization.
Broad Focus: Leading companies apply risk management principles to address a wide range of issues, including risks associated with financial uncertainty, such as currency fluctuations, in addition to protecting intellectual property.
Goal: A successful ERM strategy aims to help organizations identify risks, assess their impact on the business, and help reduce operational and financial risk while improving compliance and security overall.
Security Risk Management:
Specific Discipline: Security risk management focuses on how organizations protect their profits, property, people, and other critical assets.
Threat Focus: It involves identifying both known and unknown internal and external security threats and building strategies to address potential liabilities, such as crime, shrinkage, and insider threats.
Component of ERM: Cybersecurity risk management has become a vital part of broader enterprise risk management efforts because companies depend heavily on information technology to execute key business functions.
Specific Categories of Security Risk
Hopefully that made things more clear for you. Now that that is out of the way, let's zoom in on Security risk management a little more. It is commonly categorized into three areas, emphasizing the need to protect assets from exploitation or disruption:
Physical Security Risk Management: This function traditionally focuses on protecting people (employees, customers, partners) and physical assets (buildings, cars, products). This includes managing issues like badging, CCTVs, emergency response, investigations, and executive protection.
Cyber Security Risk Management (CSRM): CSRM is the ongoing process of identifying, analyzing, evaluating, and addressing an organization’s cybersecurity threats. It focuses on cyberattacks from bad actors, flaws in code, and online threats. CSRM specifically addresses risks to information systems that can lead to lost revenue, stolen data, long-term reputation damage, and regulatory fines.
Information Security Risk Management (IRSM): IRSM deals with an organization’s information technology, including networks, servers, devices, and data. IRSM and IT risk fundamentally protect internal networks, while cybersecurity experts primarily shield the organization from hackers and other exploits.
Convergence of Risks
While traditionally separate, modern security risk management sees a convergence between physical and cyber risks. Thoughtful security leaders recognize that many physical security threats, such as a dangerous person of interest or a disgruntled employee, may emerge in the cyber realm. This is why addressing risks like insider threats requires collaboration between both cyber and physical security risk management professionals to reduce risk exposure and enhance incident response.
Think of Enterprise Risk Management (ERM) as the master blueprint for keeping a business steady and secure. Security Risk Management — including cybersecurity — is the part of that blueprint focused on the walls, locks, and digital defenses. Its job is to spot weak points and reinforce them so the company’s most valuable assets stay safe from attacks or breaches.
back to more articlessecurity CSRM Convergence of Risks Critical Assets Cyber Security Risk Management DevSecOps ERM ERM Component Enterprise Risk Management Financial Risk GRC Management Governance Risk & Compliance Management IRSM Information Security Risk Management Information Systems Insider Threats Internal Networks Online Threats Operational Risk Physical Assets Physical Security Risk Management Regulatory Fines Reputation Damage risk management SRM SecDevOps SecOps Security Risk Management secure engineering security architecture 2022
