Governance, Risk, Compliance and Beyond: The Emergence of Strategic IT Risk Management

Transcription

1 Brochure More information from Governance, Risk, Compliance and Beyond: The Emergence of Strategic IT Risk Management Description: In recent years, the number and range risks facing IT have exploded. From business malfeasance and insider risks, to new and more malicious classes of security attacks, enterprises are challenged as never before to contain threats to critical information resources. The introduction of numerous regulatory and industry compliance measures have raised the challenge to the level of mandate: businesses must adopt a more consistent and comprehensive approach to IT governance. In each of these demands, a consistent theme is heard with increasing urgency: the enterprise must take a more strategic approach to IT risk management. In today s technology-dependent enterprise, business risk managers increasingly recognize that IT controls are often the key to the management of a wide range of operational risks. Conversely, information technologists are embracing risk management practices in the management of business-critical information resources by: - Taking a disciplined approach to IT control objectives in domains from performance, availability, configuration, and change management, to business risk, trust and security controls. - Applying objective metrics for the measurement of IT risk control effectiveness. - Merging workflow and content management with frameworks of policy and best practices standards to help develop the consensus needed to establish governance and risk management policies and priorities. Effective risk management must rationalize different views of criticality, business impact, and policy across the enterprise. Professionals throughout the business are becoming increasingly aware that IT and enterprise risk management are interrelated, and that, in some cases, the effective management of risk in one technology silo may be directly dependent on other domains. The challenge to the enterprise today is achieving the coherence and consistency essential to the management of risk in, of, and by IT - across domains and throughout the enterprise. In this report, EMA defines a new initiative arising to address this challenge: Strategic IT Risk Management. Strategic IT Risk Management seeks to unify siloed approaches to managing security, business, technology, and trust risks in IT and to align them with strategic business objectives in ways that enable the enterprise to consistently manage and measure their control. This report takes a look at the evolution of Strategic IT Risk Management and how it seeks to transcend silos of technology, process and culture to provide the insight and control essential to managing risk strategy. The convergence of key technologies in multiple market segments is examined, with a look at how they are building increasing maturity in layers of more comprehensive scope and capability: - The need to integrate the management of policy and process, coupled with the monitoring and validation of control throughout the environment, means that Strategic IT Risk Management is giving rise to new classes of technologies and tools. These include not only business and financial risk management tools, but also IT Governance, Risk and Compliance Management (IT GRC) solutions and other tools that bring coherence to strategy, policy, and process definition, combining it with the monitoring and validation of controls specific to IT governance, risk, and compliance management priorities. - In order to contribute significantly to improving business agility, Strategic IT Risk Management solutions must be geared toward flexibility in adapting to changing risk management priorities. Integration and interoperability with IT Service, Operations, and Security Management technologies and processes are therefore essential aspects of this emerging domain. Enterprise application platforms offer a focus for many efforts. These all contribute to Strategic IT Risk Management and in fact, initiatives such as the Configuration Management Database (CMDB) and next generation asset management systems may considered primary enablers, as they build inventories of assets, management tools, and processes essential to correlating risk and control. EMA believes that enterprise efforts to implement Strategic IT Risk Management tools and techniques are becoming a key measure of how effectively IT ultimately serves the enterprise. Putting a Strategic IT Risk Management program into place program is complex and requires the collaboration of virtual teams from the business, IT, security, compliance, and auditing in order to be truly effective. However, it can provide substantial benefits for the enterprise, not only in controlling threats to critical IT services, but also in giving

2 the business a stronger competitive edge through more effective technology discipline. Contents: Executive Summary Background and Context: The Evolution of IT Risk Management IT Management Is Risk Management Driving the Trend: Security and Regulatory Compliance Converging on Goals: Risk Management as the Objective with IT Governance as the Means of Control The Rise of GRC Platforms What Does Strategic Risk Management Mean in IT? Strategic Management vs. Strategic Risk Strategic IT Risk Management and the Scope of This Report What are the Challenges that Strategic IT Risk Management is arising to Address? Senior Management Risk Visibility Is Often Blurred Across Silos and Through Layers IT Operations Struggles to Rationalize Multiple Views of Criticality Complexity and Proliferation of Technology Point Solutions Three P s Are Key: Policy, Process and Procedure Strategic IT Risk Management Lifecycle Strategic IT Risk Management Scope and Functionality Qualifying the Landscape: Layers and Segments The Four Layers of Strategic IT Risk Management Layer 1 Layer 2 Layer 3 Layer 4 Strategic IT Risk Management Market Segmentation IT Service, Operations and Security Management Security Management IT Service Management and Business Service Management Information Management The CMDB Next-Generation Asset Management Data Protection, Disaster Recovery and Business Continuity Project Portfolio Management Identity and Access Management Configuration Audit and Control Security Information and Event Management (SIEM) Content Risk Management Database Governance and Risk Management IT Security Risk Management Further Consolidation Likely Policy Compliance and IT GRC Systems Business and Financial GRC with IT Governance or IT GRC Modules Enterprise Application Platforms and Integrators Looking Forward: The Future of Strategic IT Risk Management Advances in the Automation of IT Management The Evolution of IT Risk Metrics Increasing Relationships between IT, Business and Financial Risk Management Business Intelligence (BI) and Enterprise Decision Management (EDM) Modeling and Enterprise Architecture EMA s Perspective Challenges Facing Strategic IT Risk Management Lack of Maturity in IT Management Lack of Consensus Among Stakeholders Lack of Consensus on Acceptable IT Risk Recommendations Make the Most of Shared Opportunities More Than Cooperation, Active Participation among Stakeholders Is Vital Consensus Must Be Grounded in Reality Make Room for Agility in Responding to Rapidly Changing Perceptions of Risk Toward IT Risk Management Maturity Related and Upcoming EMA Research

3 Appendix A: Indicators of Maturity in Strategic IT Risk Management Appendix B: Definitions Ordering: Order Online - Order by Fax - using the form below Order by Post - print the order form below and send to Research and Markets, Guinness Centre, Taylors Lane, Dublin 8,

4 Page 1 of 2 Fax Order Form To place an order via fax simply print this form, fill in the information below and fax the completed form to (from USA) or (from Rest of World). If you have any questions please visit Order Information Please verify that the product information is correct. Product Name: Web Address: Office Code: Governance, Risk, Compliance and Beyond: The Emergence of Strategic IT Risk Management SC Product Format Please select the product format and quantity you require: Electronic (PDF) - Single User: Quantity USD 795 Contact Information Please enter all the information below in BLOCK CAPITALS Title: Mr Mrs Dr Miss Ms Prof First Name: Last Name: Address: * Job Title: Organisation: Address: City: Postal / Zip Code: Country: Phone Number: Fax Number: * Please refrain from using free accounts when ordering (e.g. Yahoo, Hotmail, AOL)

5 Page 2 of 2 Payment Information Please indicate the payment method you would like to use by selecting the appropriate box. Pay by credit card: You will receive an with a link to a secure webpage to enter your credit card details. Pay by check: Please post the check, accompanied by this form, to: Research and Markets, Guinness Center, Taylors Lane, Dublin 8, Pay by wire transfer: Please transfer funds to: Account number Sort code Swift code IBAN number Bank Address ULSBIE2D IE78ULSB Ulster Bank, Main Street, Blackrock, Co. Dublin, If you have a Marketing Code please enter it below: Marketing Code: Please note that by ordering from Research and Markets you are agreeing to our Terms and Conditions at Please fax this form to: (646) or (646) From USA or From Rest of World