Vodafone Cyber Risk Analysis: CSGM Model, ERM Framework & COBIT 5

This report provides a comprehensive analysis of cyber risk governance and management within Vodafone, assessing its suitability within the Brazilian industry sector and industry in general. It overviews various standards and frameworks, including COSO, COBIT5, ISO31000, and the CSGM model, streamlining these with business IT governance and management. The suitability of the CSGM model for Vodafone is discussed, considering variables like stakeholders, cybersecurity governance, cybersecurity management, the cyber environment, and critical infrastructure. The report recommends an ERM framework for Vodafone, establishing context with respect to risk assessment, risk response, monitoring and review, communication, and consultation. A critical review of different cyber models is presented, highlighting their policy and process implications and their consistency with COSO, ISO3, and COBIT 5, concluding with an overview of corporate management and governance.

The Analysis of Cyber Risk: Vodafone 0
Title: The Analysis of Cyber Risk: Vodafone
Assignment Name:
Student Name:
Professor:
Date:

The Analysis of Cyber Risk: Vodafone 1
Executive Summary
This report summarizes the governance and management with context to Vodafone Company.
The suitability for industry- Brazilian Industry sector and suitability for industry in general have
been summarized. An overview has been provided for the different standards and frameworks.
These are COSO, COBIT5, ISO31000, CSGM model and this is streamlined with governance
and management of business IT. A brief description has been provided on the Suitability of
CSGM model for Vodafone Company. Different variables like-shareholders, Cyber security
governance and cyber security management, Cyber environment and critical infrastructure has
been proposed. Recommendation of ERM framework for Vodafone has been given.
Establishment of context with respect to risk assessment, risk response, monitoring and review,
communication and consultation has been given.
A critical review has been presented of different cyber models that are streamlined with business
processes. The policy and process implication for the different cyber models have been provided.
The consistency of cyber models with COSO, ISO3 and COBIT 5 has been given. An overview
of corporate management and governance has also been given, followed by a conclusion.

The Analysis of Cyber Risk: Vodafone 2
Contents
Academic Journal Article Summary................................................................................................4
Governance.............................................................................................................................................4
Management...........................................................................................................................................4
Suitability for Industry.....................................................................................................................5
Brazilian Energy Sector............................................................................................................................5
Suitability for Industry in General............................................................................................................6
Standard and Frameworks...............................................................................................................6
ISO31000:2018 Guidelines written..........................................................................................................7
CSGM Model and ISO 31000....................................................................................................................7
COSO Enterprise Risk Management (ERM) Framework 2017..................................................................8
CSGM Model and COSO ERM Framework...............................................................................................8
COBIT 5- A Business Framework for the Governance and Management of Enterprise IT.......................9
CSGM Model and COBIT 5.......................................................................................................................9
Vodafone........................................................................................................................................10
Suitability of the CSGM Model for Vodafone.........................................................................................10
Stakeholders......................................................................................................................................11
Cyber Security Governance...............................................................................................................11
Cyber Security Management.............................................................................................................12

The Analysis of Cyber Risk: Vodafone 3
Cyber Environment and Critical Infrastructure..................................................................................12
Recommendation of ERM Framework for Vodafone...................................................................13
Establishing the Context........................................................................................................................13
Risk Assessment....................................................................................................................................14
Risk Response........................................................................................................................................14
Monitoring and Review.........................................................................................................................15
Communication and Consultation.........................................................................................................15
References......................................................................................................................................16

The Analysis of Cyber Risk: Vodafone 4
Academic Journal Article Summary
Cyber security is essential for corporate bodies and it is interlinked with decision making.
The companies need to understand the business strategy model along with cyber. The success of
an organization not only lies in its innovation, but also with the strategic importance of cyber
Security. Vodafone is a multinational conglomerate, based out of London. It has centers in
Africa, Asia and Europe. It is a mobile operating company and has been ranked second because
of its high number of the customers.
Governance
According to the recent reports of 2018, there are 535 million customers (Tsoumas and
Gritzalis, 2012). Vodafone has been operating in more than 25 countries and has partnerships
with more than 45 countries. Its global enterprise corporate body arranges IT and
telecommunication services for more than 150 countries. Vodafone is the largest company listed
on the London Stock Exchange and comprises of market capitalization which is approximately
52 billion Euros (Horowitz and Lucero, 2016).
Management
The management team of Vodafone Company is making huge investments in Cyber
Security. The company is confident to strive growth in the business and create differentiation in
the market. Vodafone is acquiring new customers and prioritizing cyber security to a large
extent. Businesses need to focus on the transformation and improvement initiatives. This not
only includes digitalization, but also cyber security. The decision making body is significant for
the individual projects and must not be neglected at large. The companies need to emphasize on

The Analysis of Cyber Risk: Vodafone 5
the robust cyber security issues and this must be streamlined with networks. Another key aspect
which cannot be ignored is security budget.
Suitability for Industry
The energy sector is diverse and complicated. There is existing energy sources which are
using the ERP technology to be more effective and cost-efficient and all the new energy sources
must provide the energy customers with power choices. The innovation impact is bigger than the
choice as it brings changes in the economies of scale. Suppliers of the energy sector will be
required to meet with the different criteria’s to provide right supply to energy equipment owners.
The supplier must have these product characteristics-
1. High Quality
2. Compliance with the engineering specifications
3. Product documentation must be correct and implementing of instructions.
4. History of order requests and rapid availability.
5. Service maintenance record of vital equipment’s and machinery.
Brazilian Energy Sector
Brazilian Energy Sector is based on the renewable energy resources, this account for 80
percent of electricity generation. Brazil is dependent on the hydro generation of power; Energy
sources in Brazil include oil, minerals, hydropower and biofuels. The development of economic
activities, similarly, account energy issues are under the competitive and environmentally
sustainable conditions. Brazil has done its homework and has been frequently mentioned in the
oil production and hydroelectricity power generation. The massive use of wind energy and
interconnected transmission system and especially, the energy renewability and power mix.

The Analysis of Cyber Risk: Vodafone 6
The achievement of Brazilian industry is essentially through the institutional and
regulatory framework that ensures favorable conditions for the investments. Energy is one of the
sectors where in countries will have more significantly restoring the capabilities of decision
making and policy making and planned actions must be executed through integrated public-
private associations.
Suitability for Industry in General
The organizations need to have an awareness of the fact that there is no robust technology
available that can provide well-tested technical backup. The scheduling of a backup plan is
required and rapid recovery can ensure the decrease of cyber security crimes. There are different
principles applicable to the wide variety of operations. For instance- The sound and encyclopedic
governance must be in place to enjoy the privileges given to different users to perform the
necessitated jobs. An important key concern for CEOs and managing directors is the level of
compromise being made at the enterprise level to ensure protection to malicious systems or
inside actions. Here, the organizations need to adopt the unified corporate and risk governance.
Standard and Frameworks
Enterprise Resource Planning models have been evolved from integral business systems
towards large and medium organizations. The ERP strength is a computerized information
transactional system which is data repository. This allows the data availability and collaboration
among the different business functions. Realizing the associations of an ERP implementation is
challenging. The establishment of ERP system has forced the organization to critically review its
position. This study has identified some shortfalls in initial implementation of ERP and
introduces the ERP framework named COSO, COBIT 5, CSGM and ISO 31000. These will
assist in evaluating the ERP system evaluation results and support the organization with

The Analysis of Cyber Risk: Vodafone 7
evaluation results. These are based on the organizational fit. These models and frameworks can
effectively decrease the product cost, enhance customer satisfaction and increase the
competitiveness for most of the enterprises. The successful implementation of ERP system
requires initial planning and achievement of intended goals is possible. Aiming at the different
issues, the IT governance ERP framework has been prepared and this is based on IT governance
methodology which includes strategy and enterprise organization, governance arrangements,
ERP related performance goals, related accountabilities and metrics.
Image Source: - www.coolblue.com

The Analysis of Cyber Risk: Vodafone 8
ISO31000:2018 Guidelines written
The consistency of a strategic road map and cyber security plan must take into the legal
framework of ISO 31000:2018 and controlling the information objectives and related
technology. The detection of fraud and internal control at the enterprise level is relevant within
the information framework of ISO 31000. The Indian Standard Organization 31000 has been
formed with the aim of protecting the frauds and effective allocation of resources and
comparison of risk practices at different levels. The expected computational loss can be
advocated through the implementation of ISO 31000 frameworks.
CSGM Model and ISO 31000
CSGM Model and ISO 31000 are intended for organizations to protect the value and risk
management in any organization which can manage the risks, decision taking management and
setting up of objectives and working on improving the performance. The CSGM model discovers
keeping the risk management simple. Risk management guidelines have moved forward and it is
now available for the public comments. This is a revision work which will follow the distinct
objective of making the riskier things clear and easy. This is achievable by simple language
techniques and expressing the risk fundamentals wich are understandable to the users. There are
certain standard policies and guidelines on the values and benefits of efficient and effective risk
management and can help the organizations to understand the uncertainties and accomplish the
objectives. The major task is finding the right balance detailed guidance and complete textbook.
The text has been shortened to the fundamental concepts and has created the clearer, concise
statement which can be read easily and remains widely applicable. In order to avoid weighing the

The Analysis of Cyber Risk: Vodafone 9
security risk standards and making the process too complex, the ISO 31000 terminologies will be
reduced. This is strengthened by generic quality and provides the renewed basis for experts and
end users. These are the users who will be facing the challenges to determine risk and
communication with different stakeholders. There must be a risk management framework which
comprises of guidance and is relevant for end users and must be augmented with different
concept. This must be in relevance with different countries and industries.
COSO Enterprise Risk Management (ERM) Framework 2017
Cyber security is gaining huge importance and business organizations must embed the
networks from the very beginning. The companies will be required to heavily focus on the
investment plans. There is a young team of decision makers that believe in the complete
automation of the IT industry. More than 70 percent of the people are of the belief that business
security is necessary due to the increase number of internet threats. The humans are not capable
alone to handle the cyber security issues (Lehto, 2013). The COSO Enterprise Risk Management
is a cross-market data format that has separate IT guidelines. The model provides a framework
for the collection of cyber exposures. The companies need to plan a detailed analysis of their
organization and note responses demographically, industrial units, revenue plans and recovery
plans. .
CSGM Model and COSO ERM Framework
The Vodafone Company assesses the nightmare occurring due to cybercrime. These are
increasingly rising in cost and numbers. The company needs to implement the CSGM Model and
COSO ERM framework. The legal protection is very costly and there is no specific software that
can perform the cyber risk governance and management. The best methodology adopted for the

The Analysis of Cyber Risk: Vodafone 10
prevention of cybercrime attacks and minimal asset losses is defining the CSGM Model and
COSO ERM framework and principles that ensure active defense (Amin, 2017). The company
needs to adhere to certain critical steps for implementing the scheduled checks. This is done in
order to reduce the number of technical errors. The exploitation of IT Systems is mainly due to
unwanted or pending alerts. The corporate governance combined with security risk management
alerts must be addressed and systems must be up-to-date. The company needs to get prepared
and active CSGM Model and COSO ERM framework against the security breaches must be
taken into account. The minimization of cyber security crimes is required in the corporate bodies,
specifically when the companies are data flooded (Malhotra, 2015).
COBIT 5- A Business Framework for the Governance and Management of
Enterprise IT
COBIT 5 is in practice from past 2 decades and IT governance frameworks on audit,
management control and information security business model has been released (Haugen, 2005).
The roadway to provide customer satisfaction and direct monitoring of stakeholder transparency
lies within the framework of COBIT 5. The changing business environment is highlighted with
the use of Cyber security models and its alignment with COSO, COBIT 5 and ISO 31000. The
performance at different enterprise levels must be improvised with an approach highlighted as an
input. The companies need to attain leadership in addressing the enterprise risk and internally
recognizing the guidance given through body of individuals (Peters, Shevchenko and Cohen,
2018).

The Analysis of Cyber Risk: Vodafone 11
CSGM Model and COBIT 5
The companies lack the all-encompassing cyber risk models that can mitigate risks and
allocate solutions for a given event. The probabilistic cyber risk model must not be seen from the
stakeholder perspective, but develop a re-assurance towards the CSGM Model and COBIT 5.
The quantification of loss and individual accounts allows the companies to implement a new
model within its framework. The different industries with relevance to marine, energy, insurance
and property must be linked with the data portfolios and incorporated COBIT 5 or CSGM
structure (Olcott and Sills, 2014).