- We have data.
Now, we need to use it to answer a few questions.
To recap, you're implementing
an information security program
in order to meet your four program goals
and to manage your information risks.
At this point, you've gathered data from your experts
and maybe some cybersecurity systems
to find out how well your controls are performing.
In order to wisely deploy your limited assets
against seemingly unlimited risks,
let's review some key questions you'll need to answer
by examining your data.
Previously, we explored the need
for management and leadership tools and techniques.
Let's return to that idea now,
by first exploring what the manager in you wants to know.
A top set of questions would be
how cyber-resilient am I now,
as compared to how resilient do I need to be,
and what are my top five information risks,
so I can prioritize my spending?
Now, the leader in you wants to know
where do I have strong agreement about our risk scores?
This helps you gauge how much support you'll have
to make useful changes,
which is the very definition of leadership.
Another leadership question is
where do I have diverse opinion about our risk scores?
This helps you gauge how much persuading
or selling you'll have to do to address your top five risks.
Another question you may want to answer is
what can I learn about the data
that'll help me meet my other program goals?
To find out,
look at the controls that most closely relate to
the information security requirements
in the contracts with your customers,
meeting your compliance obligations,
and meeting your standard of due care.
What other questions do you have about information risks?
Can the data you worked so hard to collect answer them
or at least point you in the right direction?