The big debate: control compliance vs. risk management

Description

Summary

• control compliance vs. risk management Industry-standard security frameworks are important, but they also need to align with the rest of your organization's risk management practices.
• By using an industry best-practice framework to assess controls, there is at least the comfort of knowing that the controls assessed are those broadly required to protect certain security domains.
• The technology risks are articulated in the same manner as every other department within the firm, and most importantly.
• While the information security governance manager is running a robust program to ensure appropriate application of controls within information security, the technology risk manager sits across the entire technology department, always asking the question, “What does this mean for the business?”