Cyber Security and Governance Risk and Compliance!

In this blog, we're gonna discuss cybersecurity risk governance, and compliance, otherwise known as GRC. in this blog I'm going to explain few things about how to keep your business secure, reduce the risk within the business and make the information security program a bit more robust if you haven't already got one. The GRC topic can be massive and we're only gonna touch the sides of it. So if you wanna know a bit more about it, feel free to drop a comment below the blog. and let us know that you wanna know a bit more about it. And then we can actually make a couple more blogs about it and just expand upon the topic, whether or not it's governance, if it's a risk, if it's compliance, if it's cybersecurity, anything like that. Just drop a note in and we'll go from there. So let's get under there. Now, again, in GRC and cybersecurity within the business. If you didn't already know both topics pretty much go hand in hand together with each other. It makes a nice mature information security program, if you didn't already have one, it can help you work towards building one up and going from then moving on. But what exactly are cybersecurity and GRC? Well, cybersecurity is a term that's primarily used to define the protection of smart-based devices in your mobile phones, devices, tablets, computers pretty much anything that's online. 

Cybersecurity in itself can be a massive topic. We won't really be touching on that but it's pretty much going against anything that is online is the security of the cyber. (laughs) pretty much. Cybersecurity is a vast topic, however, it's all about ensuring that the(indistinct) is protecting against unauthorized access to any type of information within your business. Whether it's personal information, it's IP information, anything like that. So there are a few steps that we're gonna do for businesses to ensure that(indistinct)has put in place to protect it. One of them is firewalls. Ensuring that your firewalls are in place, turned on both at the border, where the internet is, and on each device within the company. So on your computers, on your smart devices and things like that. If it's got support for firewalls, stick it on. The next one is a good debate firewall. Once that's done, you've got antivirus and antimalware. This has a massive debate. Some people say, "Yeah, put antivirus and antimalware on." Some people say, don't use it if you don't need it. My personal experience is, put it on, if you've got to put it on, it's better than nothing. Even with a windows defender these days and windows 10, it will protect you against stuff. And if you do get infected, if you do get a breach inside your network, it can actually reduce the lateral movement between attacks and stuff like that.

 So I'll let you make it harder for anyone who actually gets into your environment. Another one, you could do as well as keeping your computers and systems up to date, ensuring that thermos installed and everything's patched up to date, operating systems are up to date, your mobile operating systems are up to date, third party apps are up to date. Just making sure everything's kept up to date and make it nice and easy for you. And then obviously, depending upon what your business is, you might even look at penetration testing or anything like that as well. Now, this hasn't covered all aspects of cybersecurity because as I said, it's absolutely massive but it gives you a little bit of a view of how to protect your business, moving on from there. So with that done, let's move on at GRC, and let's talk about it and find out what actually it is. What's it made up of and going from there. GRC, which is pretty much, governance, risk, and compliance is referred to as a strategy that is pretty much used within businesses, for managing business overall risk management and compliance against various regulations, which need to be performed. I'd hear too if you're in healthcare if you're in legal if you're in finance, stuff like that you have to adhere to various regulations. GRC helps that your business comply with that and move forward. Now your business doesn't have to be in these areas to comply with GRC, but it fits every business. But obviously, it depends upon the size of the business, depends upon the size or the complexity of your GRC program. But hopefully, this blog will give you some food for thought, work through it, understand what it is and how you can tailor it for your own business itself. 

GRC is a sort of standardized approach for helping businesses design and aligns their IT business objectives, thereby effectively managing your risk and helping you meet those necessarily compliant requirements if you've got them. GRC forms a framework or can form a framework within the business, such as standards like ISO 27,001 9,001 and things like that. But GRC pretty much ensures that the processes are implicit in your business and that you've got your processes your policies, your standards, and everything put in place that everyone follows and works from there. And you've got that underlying framework that just hopefully bonds and makes the business work. Now by now, implement GRC within the business. It can help your business identify it and reduce the risk within the business. It can help to control the effectiveness of your security and compliance. And it also helps you to remove those siloed departments by bringing in the tip of a team of people who can actually workaround within the business identify all those risks, within the business, and look at adhering to all the policies and procedures and things like that. And actually working throughout the business itself. You no longer have to have those siloed businesses or departments that everyone just looks after. For example, your QA environment maybe only have certain dedicated people who work in QA. You might have your development team that only looks after their own side. You might have the HR that only looks after them. If you've got a nice GRC framework put in place and you've got those dedicated people that actually work for it, they have overall visibility within the entire business and they can go around and actually talk to the whole business. And there's not actual isolation between departments or departments. They cannot sit right at the top of the business and then naturally look over it, look down and work with all the other teams within the business. Now that we have...I guess a brief understanding of what GRC is, it's tempted actually break down what GRC is, what the components are And we'll just discuss what governance is, the risk is, compliance is, and how they all work for your business and how it all, I guess, gels informs GRC. So the first component of GRC is governance, governance defines the way that your business is managed and controlled within the environment within GRC terms. It's weird that allows the business to set that stage direction. Now, this is usually based upon implementing strategies policies, procedures within the business and adhering to a standardized framework. 

The governance is designed and signed off by someone more senior within the business 'cause without your care or the CSO, senior management then if any issues occur within the business the people manager that compliance or the risk of the business itself will have no backing. So if there are any issues, any incidents, or anything like that, if you don't have the CSO from the senior management, then nothing's gonna be done. And then you haven't got the backing and the CSO of saying, look, we need to do this. We need to manage this risk. We need to meet these compliances. If you don't have that, then there's no system in place there for you. So as part of the GRC and getting the governance sorted, make sure you've got the senior management on board, you've got the board level, or anyone like that on board like that, moving forward. Now, additionally, without having the governance part of the framework in place there's no certainly control there and measure your risk and compliance within the business. And therefore it feels like I've just mentioned everything that kind of all just falls apart. If there's no bonding or there's no membership like that. Moving onto a risk, the risk is identified as anything that could cause harm or loss to your business. A good example of risk is this pandemic, how many people didn't actually identify that might be a pandemic in the next couple of years. Everyone was pretty much taken by surprise the way Covid hit. And everyone's just had to adapt and move forward straight away. You know, everyone's pretty much working from home now or the, where are they gonna be. So how does that risk affect your business? Did you work for it? Did you plan for it? Did you have supplies in place for it? Could everyone VPN into the machines, into the office? Did everyone have laptops? Could they actually work from home? Is everything in the cloud as everything just locally installed on the machines, in the business. And then they've had to adapt, rush in, and get that sorted. So those are the kind of the areas of the risks you've got to look at. Although it doesn't have to end at that. You could look at your supply chain just this week alone, looking at solar winds and stuff like that and all those incidents. And that was my phone. Apologies for that. So yeah. Now once you've identified your risks you've got to keep them in-store, keep them in an asset register and keep them up to date, continuously assess them, and look at them. Now we've discussed risks and risk creditors before, I'll stick a link into it up here somewhere. And then you're gonna have a look at that. If you don't know what it is, but identifying your risks no matter how small it is, will improve your business, moving forward. Now in GRC terms, risk management ensures that your business identifies analyses, and coordinates any risks that have been found that could cause harm, or possibly do real the achievement of your overall objectives within the business that you've already defined. Now with all that with risk, yes, it's a bit of a rant but I will move on to compliance, which is next. Now compliance in GRC terms. And for the most part of the business is ensuring that your business follows and adheres to a strict set of guidelines that you've implemented or you've defined within your business. Now, this usually forms around your policies and procedures that you've got within the business itself. Complaints ensures that you are achieving and implementing the measures and controls that you've you've set out for any requirements. Compliance is a kind of a living thing within the business like ISO 27,001 you need to mark it on homework and tourney. So what you should be doing is performing internal orders regularly, or at least reviewing your risks your business, your supply chain what accreditation you need, what compliance do you need? Do you have to sign up for third-party services or anything like that? And go from there, especially with Brexit and stuff like that for the UK there's a lot going on in a coming couple of months with us leaving the EU, have you defined, what compliance procedures you need to do adhere to supplying people outside into the EU or anything coming in from the EU to the UK. Have you identified all that sort of thing? Now, this might sound like a lot of work and a lot of ranting. And in theory, it can be at the start, especially if you don't have any type of framework and player. So you're not aware of ISO standards and things like that. But once you actually started after or do you need to do is kind of piecemeal it out identify your risks, identify what assets you have like pit works, assets, computers, things like that. And then just identify those, write them down, look at them build them all up, build the team that we're gonna look after this. If you're a small person, it might just be one member team. If you're a larger company, it might have two, three four people all working as part of a team and also get the backing of the management and go from there. So now that we've covered all the boring stuff why is GRC important in the business? Well, basically it comes down to the streamlining organization of the business. Yes, I've said business quite a lot in this video but it helps you to implement the framework and get the reassurance and get the standardization of the business. You have everything covered. Everything's running smoothly. You've identified all the risks. You've identified that the compliances to all the compliances externally to the business as well as in the business, you're identifying that people are following your procedures, your policies everyone knows what's going on. What you might be thinking is, How do I actually do this? How do I piece it out? Well, you can be productive, you can plan, you can design your framework piece at work, build upon it. As I've said before, you're not looking at it. There is the business, identify the risks within the business. What can be resolved? What have you changed? Is there a change control program in place? If there's not build one, put it all. So, yes, we're going to put this change in. Who's gonna be in charge of this. Who's gonna build this. Who's gonna do that. What are the risks? What happens if X, Y, and Z happen? How can I resolve this and go from there?

 But GRC is all about risks, identification of management auditing, having a look checking every single note to make sure everything's fine. And going from there. Yes. This blog has been a lot of talking and yes I'm aware that we haven't covered an awful lot of it because there's an awful lot to it. But if people are interested in this and want to know a bit more about it, put some content below the video, we can break it out a lot more. We can have dedicated blogs on the governance aspect a lot more on the risk and a lot more on the compliance and just work into it a little bit more and delve into it a bit more.  Find out a bit more information about what we're going to push out in the coming months. We've got a lot of blogs in the pipeline. So hopefully this is gonna help you understand and build the frameworks and that for your business and just help you secure your business in the future. Thanks a lot.