GRC – A Performance Management Platform or A Success Management Platform?

On May 1st French Caldwell posted a blog titled GRC Will be a Performance Platform in which he references a blueprint that provides a practical approach for identifying the goals of ERM programs in terms of strategic business objectives, and linking that to an underlying GRC architecture that can drive business performance benefits. But isn’t that too limiting?

Performance Management is merely a solution category and doesn’t do GRC platforms justice! When considering how GRC platforms span across Finance, Operations, Legal and IT providing organizations ways to manage risks, demonstrate compliance and ensure governance business performance benefits is only one output and to me only represents how an organization has done historically against business objectives. This is important but not all the benefits that a GRC Platform can and should provide a company.

When organizations use GRC platforms that also includes Big Data Risk Analytics not only will they be able to report on past performance to various levels, domains and to different audiences but they will also be able to predict the future. Future performance, future risks, future efficiencies, and most important future opportunities for success. Big Data risk analytics within a GRC Platform should model out opportunities for growth that drive success within each domain. So I think that GRC platforms will not be performance management but  “Success Management Platform”. Might this be a new category?

PS – I would have really enjoyed the panel with Paul Proctor and Network Frontier’s Dorian Cougias. Not only do I find business predictive and risk management conversations interesting I also am equally if not more fascinated by conversations with “the security geeks” of the world as they save our businesses every day. We should all find them fascinating!

imagesCAH4BEPD

Advertisements

RSA Archer GRC Summit – 10th Year!!

I am happy to announce that RSA will be hosting the 10th annual RSA Archer GRC Summit in Washington D.C., June 12-14, 2013 at the Omni Shoreham Hotel.

As I have actively helped plan these events since 2006  I am humbled at the continued momentum these events have achieved and is driven by the premier GRC community with over 10,000 active members. The momentum continues this year with a record number of attendees (800+) and an agenda that includes over 35 client led presentations on GRC implementation strategies and best practices, 15 technical breakout sessions on the RSA Archer GRC Platform, over 10 birds of a feather round table discussions and executive collaboration from over 500 global organizations.

In addition to the great line up of content for both technical and business GRC practitioners within the IT, Finance, Operations and Legal domains there will be three outstanding  keynotes during the three day event. One of the keynotes that I have had the pleasure to meet and listen to is Bruce Bueno de Mesquita. Bruce is a Silver Professor of Politics, New York University; Senior Fellow, Hoover Institution, Stanford University. Coauthor of The Dictator’s Handbook and author of The Predictioneer’s Game.

Bruce has been on The Daily Show, The Cobert Report and has performed in numerous Ted Talks including a great presentation titled: Predicts Iran’s Future 

Why is Bruce Bueno de Mequita the perfect person to keynote at the 2013 RSA Archer GRC Summit? Risk Analytics of course!!

Over his long tenure as a professor and political consultant, Bruce has conferred with experts on all the world’s most pressing issues and fed their knowledge into a vast and highly sophisticated computer model of global affairs.

This combination of wide-ranging expertise and high-power analytics allows him to make strikingly accurate predictions of world events and speak with authority on the
power dynamics of everything from office politics to international summits.

I will continue to provide updates on the most valuable, highly anticipated and attended GRC event in the industry.

Until then…..keep thinking GRC.

There’s rapid payback for organizations that automate GRC

It never ceases to surprise me how many organizations still use manual processes and unstructured documents to handle their GRC activities. Relying on spreadsheets, presentations and other documents to manage all that information takes a huge amount of time and effort, but delivers very little in the way of consistency or scalability.

On top of that, there’s no ability to aggregate risks organization-wide. This makes it practically impossible to present risk in meaningful ways, and to respond effectively to audit findings and compliance requirements.

Automation changes everything

Organizations that use a software solution, such as RSA Archer, to automate GRC processes tend to see a very rapid payback. Typically, IT is the first user group, the initial aims often being to improve the rate at which secure IT projects are delivered, and to support policy management processes for information risk management.

Because IT provides the underlying infrastructure for other domains, the initial investment in the software will often provide a strong foundation for adoption by other functions, such as finance, operations, legal and HR.

Everyone starts using a common GRC vocabulary. And you get visibility of collective issues, so groups can collaborate on understanding the aggregate issue, rather than fragmenting their efforts across two or more overlapping issues.

What’s the ROI?

Information risk management staff can be more productive and do more analysis work. IT security expenditure will be better directed. The organization will be able to lower its risk exposure and reduce incidents. And ensuring regulator-ready, accurate and timely output becomes a piece of cake.

A recent Forrester Consulting report, The Total Economic Impact of RSA Archer IT-GRC, indicates a 572% return on investment within a three-year period. One company interviewed said that 97% of the ROI they calculated was based on the reporting tool alone.

RSA is hosting a webcast with Forrester on May 22nd, 2012. The webcast will feature Jeff North, Principal Consultant, from Forrester who will discuss the report findings. Also featured during this discussion will be the VP of Security and Privacy from a F500 Media and Entertainment company who will provide insight into real-world benefits they have been able to achieve using a GRC Platform. Sign up for the webcast.

If you’ve already automated your GRC processes, what have been the payback and benefits of doing so? If you’re ready to automate, where do expect to see the greatest efficiency gains, and what ROI are you counting on?

New RSA Archer Community and Exchange are live

 
At EMC we want to empower you to grow your GRC program according to your organization’s unique governance, risk and compliance processes—and of course, help you get the best out of the RSA Archer Suite.

So we’ve injected fresh energy into our online forums, the RSA Archer Community and Exchange, and moved them onto a new platform. You’ll find they offer more intuitive navigation that makes participation more straightforward, and powerful new features that make collaboration even easier.

Between them, the Community and Exchange provide an active user community and an online exchange of applications, content, services, and integrations. They sit under the umbrella of the new EMC GRC Ecosystem that addresses your broader GRC issues and offers more strategic-level discussions around GRC as a practice.

As a member of the RSA Archer Community, you can achieve value sooner by taking a more direct role in the direction of the RSA Archer product roadmap, and using a platform that’s continually being improved by its most innovative users. You’ll significantly reduce your learning curve by sharing ideas with your peers, as well as getting advice from GRC specialists about strategies and best practice around Archer product use and configuration.

The RSA Archer Community and Exchange are not just places you go, but things you do; participation in them becomes a way of life for GRC professionals.

Discover the RSA Archer Community now >>>

Discover the RSA Archer Exchange now >>>

Your business. Your solution. Your community.

RSA Archer Community

eGRC Summit – June 5-7 in Chicago!

Archer GRC Summit

I have participated in the the RSA Archer eGRC Summit in the past and have seen first hand the value of bringing over 600 GRC professionals together under one roof to discuss best practices, learn from each other and also have a great time. I have just submitted to speak at the conference and hope to see all of you do the same.

You can submit your presentation idea here.

Hope to see all of you there this year.

‘I don’t understand what you’re trying to tell me’: Why taxonomy is so important to eGRC

Taxonomy, the science or practice of classification, is all about specifying the relationships between entities and giving them agreed names.

I can’t count the number of times that clashing taxonomies have caused me difficulties: mis-interpreting what a friend is telling me, a boss not being on the same page, my direct reports looking at me like I’m from Mars. I remember a time when I was four years old, around the holidays, asking over and over again for ‘milk yolk’ while my mom tried desperately to figure out what I wanted. After 10 minutes of trying everything, she finally got it when I described what the drink looked and tasted like. I was after eggnog, of course.

As I explained in my last blog, when it comes to eGRC it’s critical to create common processes. A big part of this is providing consistent naming conventions so that everyone is talking the same language and there’s less chance of miscommunication. I gave the simple example of an ‘incident’ management process and an ‘issues’ management process that were identical except for what the stages in the process were called (largely just a difference in using ‘issue’ vs ‘incident’). But of course many taxonomy differences won’t be as obvious or straightforward as that example.

Naming conventions are important because they frame people’s understandings of what’s happening and what they need to do. They let people identify the context quickly and hand off information and activities without going through the palaver that my mom and I went through.

The issue of taxonomy often comes to the fore when you’re assigning labels to elements and workflow activities within software applications that are part of your eGRC strategy. People need to be comfortable with what things are called if they’re to use technology effectively; and it can take months to negotiate these naming conventions. Make sure you allow for this in your planning. Dealing with taxonomies effectively is a critical success factor for eGRC.

Good GRC taxonomy website:
Open Compliance & Ethics Group

Why GRC matters to IT security teams

 

 

 

 

 

Expectations of IT security have never been higher. I talked about this a bit in my last blog . But if you don’t believe me there’s a great paper by Enterprise Strategy Group (ESG) that nicely sums up why businesses are calling for much more sophisticated, business-oriented approaches to IT security. You can find it here (look under ‘white papers’ in the right-hand navigation area)

So if you’re in charge of IT security in your organization, what do you do to meet these expectations?

If you said ‘convince the business to invest in eGRC’ then you’re ahead of the innovation curve and are taking your program to the next level.

What happens without eGRC?

Organizations that haven’t invested in eGRC are typically mired in manual processes, trying to manage security using Word documents, spreadsheets and email. They can’t connect anything to anything and have to duplicate work all the time. One IT security manager told me that his team asks the operations team to answer questions specific to FFIEC regulations in January; and then in February asks the same questions of the same people for the purposes of SOX compliance.

This kind of thing is happening in a million different ways all the time. A recent article from Computerworld, titled “Feds want uber cybersecurity compliance standard”, illustrates this as well.

It quotes Jerry Archer, CISO at Sallie Mae, who is presenting his IT-GRC strategy at the RSA Archer eGRC Roadshow in Indianapolis tomorrow (October 13). Speaking at the SINET Innovation Summit in Boston, Jerry said his agency spent 40% of its budget on complying with regulations. “What is needed is automating compliance to reduce the bite it takes from the budget,” he said.

The kicker is the response that Jerry’s remark got from Josh Corman, director of security intelligence at Akamai. He congratulated Jerry on the 40% figure, saying: “For some it’s 100%.”

The article goes on to note that “the trouble with regulations is that they drive security architectures and prevent data loss that may have little real impact, while ignoring thefts that could be devastating.”

What happens with eGRC?

So how does GRC help? For one thing, it helps you automate compliance processes and efforts so security teams can focus attention, budget and strategy on the threats that truly matter to their business.

Organizations that have invested in eGRC (assuming they’ve adopted best practices and made careful strategy and technology choices) can:

  • Automatically map policies, control standards, control procedures, authoritative sources and assessment questions to one another and see the relations between any and all
  • Track the whole life-cycle of security incidents, reliably prioritize incidents in line with business impact and objectives, automatically assign actions to respond to incidents, and report on incidents in a way that provides meaningful business context to senior management
  • Identify gaps in compliance and satisfy common compliance requirements with a ‘one-to-many’ approach

I’ve said it before and I’ll say it again: eGRC is about enterprise-wide collaboration, visibility and control. It’s time for IT security functions to lead the charge to achieve these things. Not only is it the only way to deliver value to the business, but it will make life so much easier for you!

Recommended Reading:

The ESG Information Security Management Maturity Model, a paper by Jon Oltsik, Senior Principal Analyst, ESG (July 2011)