Is Your Security Program Ready To Support Disruptive Business Trends?
The evolution of business practices is proving as big of an issue for Security and Risk professionals as the changing threat landscape. Sure, attackers exposed hundreds of millions of personal records and government information in security breaches last year, and there are examples all the time of new, sophisticated attack methods… however Security and Risk pros should also be on the lookout for technology trends that may prove just as difficult to address: Digital disruption creating shockingly more competitive marketplaces, perpetual connectivity intensifying IT user expectations, and the data economy creating incredible new possibilities to leverage the power of existing information. Of course with big business opportunities come big business risks.Read more
Implement A Successful GRC Program With Forrester's Governance, Risk, and Compliance Playbook
I'm proud to announce that this week Forrester launched our Governance, Risk, and Compliance Playbook, a collection of in-depth reports covering the critical information you need to implement a successful GRC program… one that focuses on supporting business success, not getting in its way.
First, because risk and compliance are always such quickly moving targets, we included reports to help you plan for the future of GRC and build a business case for why it's important to invest in your program now.
Next, to make sure your GRC plan is comprehensive and can achieve success, we offer guidance on creating a GRC strategy and making sense of the very complicated GRC technology landscape.
Then, we show you best practices for actually implementing GRC processes in your organization with reports on how to designate clear lines of accountability and establish effective risk management capabilities.Read more
Risk Management & Business Technology Resiliency – What’s Changed Since 2009
Guest post from Researcher Nick Hayes.
Take a second to think back to the year 2009. The US was in the thick of the financial crisis; companies were slashing budgets, and the unemployment rate was in double-digits. And do you remember a little thing called the "swine flu"? The World Health Organization (WHO) deemed the H1N1 strain of the swine flu influenza a global pandemic in June 2009. These were just some of the events top of mind for much of the nation and the broader global community three years ago.
2009 was also the year that the annual Forrester And Disaster Recovery Journal (DRJ) Survey focused on the role of risk management in business technology (BT) resiliency and crisis communications programs. Needless to say, the survey was fairly timely. Forrester found risk management was becoming a more common practice for business continuity teams, but that there was still more room for further collaboration with their risk management counterparts.
Fast forward three years, and the 2012 Forrester/DRJ survey is again focusing on the role of risk management in BT resiliency and crisis communications (you can take the 2012 survey by clicking here). A lot has changed since 2009 with a number of new events, technologies, and organizational challenges currently plaguing business continuity and risk management professionals.
More specifically, three major trends have likely affected the market since 2009:Read more
Avoid The Headlines, Focus On Corporate Culture
Guest post from Researcher Nick Hayes.
Chris and I recently published a report describing how to build risk and compliance principles into your company's corporate culture. As we worked to finalize, edit, and publish the report, a flurry of new corporate scandals emerged, all related to this topic.
Here are just a few of them:
- Wal-Mart executives accused of trying to hush up bribery cases in Mexico (article here).
- A whistleblower accuses Infosys of engaging in a systematic practice of visa fraud (article here).
- A former Goldman Sachs employee writes an op-ed for the New York Times blasting the company's ethics (article here).
- JP Morgan suffers a $2 billion trading loss due to "poorly monitored" trades (article here).
What's the common theme? The financial, reputational, regulatory, and operational risks related to poor employee behavior are massive, and often overlooked.Read more
NASDAQ OMX Acquires BWise… Where Is GRC Headed?
Last week saw news that yet another top GRC software vendor has been acquired, following in the footsteps of Paisley, Archer, OpenPages, among others. BWise has always been an impressive vendor in the GRC space, so first off I think congratulations are in order for both parties.
That said, if you didn't foresee NASDAQ getting into the GRC software space coming, don't beat yourself up… after seeing the large technology vendors and content providers enter the space over the past 3 years, this wasn't an obvious move. But looking a little deeper, NASDAQ's move makes sense for a couple reasons:
- NASDAQ's target market cares about GRC. NASDAQ lists its target roles as marketing/corporate communications, board and corporate secretary, investor relations, and corporate finance. All of these roles have a vested interest in better controls, stronger risk management practices, and improved corporate governance.
- BWise has always focused on the "G" of GRC. More than any other of the top GRC software vendors, BWise targeted governance professionals with capabilities such as entity management.
- There are immediate integration possibilities. Among NASDAQ's corporate solutions are products for board management, whistleblower reporting, and XBRL filing. BWise has a host of capabilities (issue management, process management, policy management, reporting, etc.) that could quickly add value to implementations of those products.
But, as always with a deal like this, both parties will have to show the market how they will address some key questions:Read more
Don’t Forbid Employees From Using The Escalator, Give Them Reasons To Use The Stairs
Guest post from Researcher Nick Hayes.
If you had to go up one level in a train station, would you take the stairs or use the escalator? Most people would choose the escalator. But what if the staircase played musical notes like an interactive piano? This may change things, right? A couple of years ago, Volkswagen began sponsoring an initiative called The Fun Theory that tested the degree to which they could change people's behavior for the better by introducing an element of fun. In one example, they found that by adding a unique element to the stairs - transforming it into an interactive piano - they were able to increase staircase use by 66%. You can watch the short video here.
You can apply this same principle to your training and awareness programs -- find your own piano staircase, and use it to begin guiding people to choose the right thing on their own. Chris and I have been working on a report that stresses the importance of organizational culture in the development of risk and compliance programs. Throughout the research process, we asked risk and compliance professionals and vendors in the space the same question: "How are you influencing and promoting positive behavior?"
You can create new technical controls and policies, and you can require employees to sign attestations all day, but these efforts have minimal value (or worse) when there's no positive reinforcement. When compliance and risk management are considered obligatory tasks, rather than meaningful efforts that the company values, it diminishes the perceived importance of ethical behavior.
Instead, engage employees using different multimedia channels, and maybe even add in touches of humor and fun.Read more
Announcing Two New Forrester Waves: Enterprise GRC And IT GRC
After months of diligent product and vendor evaluations, today we published The Forrester Wave: Enterprise GRC Platforms, Q4 2011. In the next few days, we will also publish The Forrester Wave: IT GRC Platforms, Q4 2011. These two reports feature a total of 20 vendors, all with proven capabilities to help customers tackle their continuously mounting regulatory challenges and manage their complicated risk profiles.
Why two Forrester Waves?
Governance, risk, and compliance functions within large and medium enterprises demonstrate tighter collaboration all the time... audit is working more closely with risk, and compliance programs are consolidating under more centralized control. However, Forrester still sees a gap between the requirements of those responsible for IT risk and compliance and the requirements of those managing risk and compliance outside of IT. No doubt, there is often substantial overlap between these groups, and many of the vendors evaluated have customers using their products to supports both IT and enterprise GRC functions. You'll notice that of the roughly 60 evaluation criteria for each Wave, there are only 3-4 that differ between them. For now though, they remain basically two distinct markets.
So, what did we learn from the countless hours of briefings, demos, customer surveys, and other research we did for this Wave?Read more
Are Your Risk Management Efforts Enabling Partnership Opportunities?
Forrester's Security and Risk Management clients often describe the frustration they feel when they are not included in important initiatives until after decisions have been made. Lately, this situation has been especially pronounced among decisions to enter partnership agreements based on service, performance, and cost considerations... with risk management only brought in later to identify and mitigate potential points of exposure.
At the same time, Forrester's Sourcing and Vendor Management professionals find themselves facing their own challenges when it comes to managing the risk of partner relationships. In a Q3, 2011 suvey of 575 Sourcing and Vendor Management professionals, top concerns related at "X-as-a-service" relationships included the lack of recourse if a vendor fails or goes out of business, the lack of a clear way to assess risk of a third party, and inability to manage how providers are handling data. ( Source: Forrsights Services Survey, Q3 2011)
In order to bridge this gap, Security and Risk Management professionals need to deliver a streamlined way to insert risk identification, analysis, and evaluation steps within their organization's existing vendor management lifecycle. Forrester customers who have taken this approach - for example, by introducing short, 10-15 question surveys to determine whether more detailed vendor risk assessments are warranted - report better oversight of vendor risk and better involvement in the decision making process. In some cases, Security and Risk Management professionals have even reported casting a decisive thumbs-down vote to block a new vendor contract because it represents unacceptable risk.Read more
IBM To Acquire Algorithmics... GRC And Financial Risk Management Get A Little Closer
Today IBM announced plans to acquire the Fitch Group's Algorithmics, a heavy-hitter in financial risk management software and services market, for $387 million.
Here are my initial thoughts about today's announcement:Read more
A Few Thoughts On Communicating Risk
In my new report, The Risk Manager's Handbook: How To Measure And Understand Risks, I present industry best practices and guidance on ways to articulate the extent or size of a risk. More than the interpersonal, political, and leadership skills required of a risk management professional, defining how risks are measured and communicated is where I believe they prove their worth. If risk measurement techniques are too complicated, they may discourage crucial input from colleagues and subject matter experts... but if they are too simple, they won't yield enough relevant information to guide important business decisions. Great communication skills can only hide irrelevant information for so long.
This report includes factors to use in the risk measurement process, ways to present risk measurement data in meaningful ways, and criteria to use when deciding which of these methods are most appropriate. As always, your feedback is welcome and appreciated.
In addition, I will be covering a related topic with our Security and Risk Council in a session called Creating A High-Impact Executive Report along with my colleague Ed Ferrara at Forrester's upcoming IT Forum: Accelerate At The Intersection Of Business And Technology, May 25-27, in Las Vegas. Please join us if you can make it. Later in the week, I will be available for 1-on-1 meetings with attendees, and I'll also present sessions on linking goverannce and risk and establishing good vendor risk management practices. I hope to see you there.