Risk management strategy for an information technology solution provider

Risk management strategy for an information technology solution provider

My company is an IT solution provider with 70 IT people worldwide. What best practices should I be aware of as I define a security and risk management strategy for my organization?

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Without knowing how mature your organization is with respect to IT in general and information security in specific, it is impossible to give a list of best practices for risk management with any confidence whatsoever that they will be useful to you.

So while I can't give you a list of best practices, I can give a basic outline of what your security and risk management program should look like. Essentially, all you need is appropriate policies, procedures and technologies to allow you to provide a sufficient amount of security while enabling the business to achieve its goals. Pretty simple, but in no way does that imply it's easy.

Before starting, you need to understand the business that your company is engaged in. To break it down further, you need to understand the business sufficiently so you can speak intelligently with the executives and other employees about what and how they do things on a day-to-day basis. This will enable you to identify which assets, be they physical or electronic, are important to the company and need the most protection. Similarly, this will enable you to determine which assets are at the highest risk. Note that these are not necessarily the same ones.

It's also essential to understand what environment the business performs in. By that, I mean you need to understand what external considerations are affecting your organization. These may include compliance requirements such as PCI DSS, SOX or HIPAA/HITECH, other legislative requirements such as TARP, or special requirements due to lawsuits or other governmental mandates to name but a few.

Once you've figured out the above, the rest is pretty straightforward. You'll need to work with the heads of the various business units to iron out details of the policies, but essentially what you want is a comprehensive set of policies, procedures and technologies to support the aforementioned business requirements.

For more information:

This was first published in July 2009