Three priorities
A program that wants to move beyond periodic questionnaires has three things to achieve: wider coverage, better visibility, and a culture in which people engage with security.
Each one answers a different weakness of the traditional approach, and none of them works alone.
Coverage
Coverage means managing risk across the whole landscape, including the systems, processes and programs that nobody has been watching.
The unwatched part is where a large share of the harm occurs. IBM's 2024 Cost of a Data Breach Report found that 35% of breaches involved shadow data, meaning information held in systems that were unidentified or unmanaged. Those breaches cost 16% more on average.
Visibility
Visibility is more than an inventory. It comes from following through: from assessing risk to analyzing it, planning a response and remediating.
When that follow-through is missing, an organization knows about its risks and does not respond to them in a coordinated way. This is often called the planning gap. NIST SP 800-39 describes how exposure grows when risks are acknowledged but never turned into plans, owners and procedures.
Culture
Coverage and visibility both depend on people. In a security-engaged culture, risk management is a commitment that people across the organization share, and security and resource teams work as partners.
In many organizations that relationship has become adversarial. Rebuilding it is part of the work.
Why all three
- Coverage without planning leaves blind spots.
- Documented risk without a way to act on it gives the illusion of security.
- Without engagement, even a well-designed process fails to take root.
The three reduce risk through different mechanisms. Coverage brings more of the organization under management. Visibility makes sure known risks lead to coordinated action. Culture improves how people report, escalate and respond.
Where the methodologies fit
Federated Cyber Risk extends coverage by placing assessment and planning with resource teams, and builds visibility by carrying each resource from assessment through to remediation. Federated Practice Monitoring gives the security office a view of the whole. The principles of participation are how the culture is built.
Sources
- IBM, Cost of a Data Breach Report 2024.
- National Institute of Standards and Technology, SP 800-39: Managing Information Security Risk, 2011.