Importance of IS/IT Risk Management Practices for Cyber-Resilience

This report discusses the importance of IS/IT risk management practices for improving cyber-resilience in organizations. It covers the key practices and steps involved in IT risk management, including assessment, mitigation, and evaluation. The report emphasizes the need for formalization of IT risk management and appropriate analysis of risk to prioritize IT risk assessments and execution of business process improvement. The report concludes that IT risk management practices are crucial for high-level risk mitigation.

IT Risk Management 1
Importance of IS/IT Risk Management Practices
10 May 2018

IT Risk Management 2
Table of Contents
Introduction......................................................................................................................................3
IS/IT Risk Management Practices to improve Cyber-Resilience....................................................3
Importance of Practices of IT Risk Management........................................................................4
Conclusion.......................................................................................................................................6
References........................................................................................................................................8

IT Risk Management 3
Introduction
This report is based on the concept of information technology risk management practices that are
important to improve organization’s cyber-resilience. For every small and large business
organization cyber-resilience plays a vital role. Resilience is defined as the toughness and
capacity to willingly recover the shocks and assaults. Therefore, cyber-resilience can be defined
as the capacity for an enterprise to come back to the stable and operational state and that way to
recover from the adverse effects of risks and threats of the cyber-security. Nowadays, in business
organizations online applications are used to perform different business activities. While using
these applications, an enormous amount of information is transferred from source to destination
and also stored into online databases (Vincent, Higgs and Pinsker, 2017). Today, the chances of
hacking, phishing, virus attacks and other cyber-crime issues are increasing that lead to violation
of the security and privacy of the confidential business information. In this case, cyber-resilience
is required by the business organizations to get protection against cyber-crime issues. There are
different ways in which cyber-resilience is maintained in business enterprises. But IS/IT risk
management practices can be more helpful in it. The next segment of this report emphasizes on
the key practices of IS/IT Risk Management that are helpful to improve an organization’s cyber
resilience.
IS/IT Risk Management Practices to improve Cyber-Resilience
IT risk management is a process which is implemented to manage the business risk. It is an
ongoing process and it has potential to resolve the cyber-risk factors properly. Furthermore, IT
risk management process has potential to examine the risks and security objectives that occur
within a business environment (Solutions, 2018). The process of IT risk management is
implemented by the IT managers and they maintain the balance between the economic and

IT Risk Management 4
operational costs of the preventive techniques that are implemented by the business organizations
to control the information security risks. In this way, IT risk management brings improvement in
the cyber-resilience of the organizations. The execution of this process consists of some essential
steps:
 The first step is of assessment. In this step, each risk factor is identified properly and its
vulnerability is assessed. This evaluation helps further to make decisions regarding the
execution of security tools to overcome the identified risks (Raconteur, 2018).
 Next step is of mitigation. Under this step, countermeasures are put in place for reducing
the influence of a particular risk factor (Lowers & Associates, 2018).
 Another essential step of IT risk management is evaluation and assessment. This step is
implemented at the end of IT risk management process. The main purpose of this step is
to recognize the effectiveness of selected solutions for the security issues. The overall
cost of the available solutions is also found in this step. After proper evaluation, actions
are taken to improve, change or retain the particular solution (McKinsey & Company,
2018).
Importance of Practices of IT Risk Management
IT Risk management procedure intervenes some key practices such as formalization of IT risk
management, analysis of risk, prioritize the IT risk assessments and execution of the business
process improvement. The first practice of the IT risk management is concerned with the formal
implementation of the risk management process. It is commonly seen that most of the business
organizations are using risk management techniques to perform different operations. But the
main problem is the informal structure of the risk management process that must be improved.

IT Risk Management 5
Here the importance of formalization of IT risk management practice is that it can reduce the
business security risks by 30-60% (PwC, 2018).
Next practice of IT risk management is related to an appropriate analysis of risk. The first step of
every IT project is the identification of main risk factor. After that, an evaluation of risk should
be done appropriately. Most of the projects fail because risk manager cannot find the main cause
of risk. In this case, with the help of IT risk management process key reason of occurring risk
can be found. In risk management process a root cause approach is used that enables managers to
understand the major source of risk and according to that risk factor appropriate techniques can
be used to mitigate business security risks and to improve cyber-resilience in an organization.
This is the main reason that this practice of IT risk management is considered important for
improving organization’s cyber-resilience. The evaluation process of risk management can be
implemented with the help of risk analysis software solution that provides a library of key causes
of occurring security risks to the manager.
After evaluating the actual cause of risk of information security threats and data breaches, next
potential practice of risk management process is prioritize the project risk evaluation. Evaluation
of each risk in a business project is a time consuming job. So it is better to control risks at the
priority basis. It means major risk factors must be evaluated first and then try to fix them as soon
as possible.
After completion of the evaluation process of a particular risk factor, next step is related to the
business process improvement. With the help of risk management structure, project managers
can make clear that who is responsible for a particular risk. Next step is related to the assessment
of each high risk and goal and it is done by risk owner. Moreover, risk owner is also responsible
to plan different activities to control the evaluated risks. But no person is selected yet who can

IT Risk Management 6
take the responsibility after occurring of security threat. This responsibility must be assigned
before the occurrence of risk in the project. This improvement is required in a business process
to sustain the cyber-resilience for a long time.
Therefore, these are some essential practices of IT risk management that are helpful for the
betterment of the cyber-resilience of an organization. Due to above discussed reasons, IT risk
management is preferred to implement by business organizations. While executing IT risk
management practices it is necessary to have knowledge about each practice properly.
Otherwise, it will become difficult to obtain appropriate outcomes. Risk management software
solution is effective and quick to identify various risk factors and it also provides help to the risk
managers to pay attention to the most vulnerable risk factors that must be resolved quickly and
they can put big influence on the business value among its competitors. Only the execution of
cyber-resilience in an organization is not enough to control the data breaches and other security
issues. Indeed, cyber-resilience must have some strategic approach that can ensure the high level
security and it can be obtained with the help of IT risk management practices. That is why, these
risk management exercises are crucial for high level risk mitigation (Minsky and Minsky, 2018).
Conclusion
To sum up, it can be said that any kind of small and large risk factor can cause big violation of
business activities and its confidential information that are used throughout the IT based business
projects. In this case, advanced level security and privacy should be maintained by the project
managers and they must be aware about the latest techniques and practices that can control the
risk of cyber-crime. IT risk management practices can be used as a powerful tool to remove the
security threats and other problems that are related to cyber-resilience (Olcott, 2018). It is the

IT Risk Management 7
vital accountability of the risk manager to monitor the execution of each risk management
practice properly.

IT Risk Management 8
References
Minsky, S. and Minsky, S. (2018). Top 5 Project Risk Management Practices | ERM Software.
[online] ERM Software. Available at:
https://www.logicmanager.com/erm-software/2012/05/08/top-5-project-risk-management-
practices/ [Accessed 11 May 2018].
PwC. (2018). IT Security and IT Risk Management. [online] Available at:
https://www.pwc.com/th/en/consulting/technology/it-security-and-it-risk-management.html
[Accessed 11 May 2018].
McKinsey & Company. (2018). Enterprise-risk-management practices: Where’s the evidence?.
[online] Available at: https://www.mckinsey.com/business-functions/risk/our-insights/enterprise-
risk-management-practices-where-is-the-evidence [Accessed 11 May 2018].
Solutions, C. (2018). Cyber Resilience | What is it and Why Is It Important to My Company?.
[online] CybeRisk. Available at: https://www.cyberisk.biz/what-is-cyber-resilience/ [Accessed
11 May 2018].
Raconteur. (2018). Cyber resilience is essential to maintaining an organisation's reputation -
Raconteur. [online] Available at: https://www.raconteur.net/business/cyber-resilience-is-
essential-to-maintaining-an-organisations-reputation [Accessed 11 May 2018].
Lowers & Associates. (2018). 3 Risk Management Practices of Industry-Leading Organizations.
[online] Available at: http://blog.lowersrisk.com/risk-management-practices/ [Accessed 11 May
2018].

IT Risk Management 9
Vincent, N., Higgs, J. and Pinsker, R. (2017). IT Governance and the Maturity of IT Risk
Management Practices. Journal of Information Systems, 31(1), pp.59-77.
Olcott, J. (2018). Cybersecurity Vs. Cyber Resilience: A Quick Comparison Of Terms. [online]
BitSight. Available at: https://www.bitsighttech.com/blog/cyber-resilience [Accessed 11 May
2018].