Understanding risk tracking
It is important for enterprise risk to be understood and managed by the appropriate stakeholders within the organization. All risks should be documented, along with actions taken and the business owner impacted by the risk. This should be documented in a risk register. Figure 13.13 shows a typical risk register:
Figure 13.13 – Sample risk register
To ensure the organization is able to comply with regulatory requirements, we must have an effective method to monitor risk. By monitoring risk, we can see reports on potential risks and understand where the business may be unduly exposed.
In order to monitor and respond to risks, we must have effective metrics that allow an enterprise to track performance regarding risk.
Key performance indicators
A key performance indicator (KPI) is a measurable value, allowing the business to identify important activities in the company that contribute to a positive security posture...
