Two sets of five
Federated Cybersecurity (FC) rests on two sets of principles. The five core principles describe what a federated approach is. The five principles of participation describe how to design one so that people take part.
This article covers the core principles. The Five Principles of Participation covers the others. Most of the examples here come from Federated Cyber Risk (FCR).
Shared responsibility
Everyone in the organization has a part in identifying and managing cyber risk. Security stops being one team's job, and the walls between the security office and everyone else start to come down.
In most organizations, responsibility is already shared in fact. The people who run a system make the choices that determine how secure it is. The principle is to recognize that openly and to manage it through processes built for it.
Collaboration
People share what they know: practices that worked, lessons learned, and context the other side lacks.
Resource teams know the business purpose, the operational requirements and the practical constraints of what they run. The security office knows the threat landscape, which controls are effective, and what good practice looks like. Neither can manage the risk well without the other.
Empowerment
People are given the tools, the resources and the authority to assess and reduce risk in their own area. The authority matters as much as the tools. Asking a team to own a risk it has no power to act on recreates the problem a federated approach is meant to solve.
Empowerment also multiplies capacity. The work is spread across the people closest to it, so the organization can manage far more than a central team could alone.
Context-specific insight
Risk differs from one part of an organization to another. Business processes, technology and regulatory requirements all vary, and guidance that ignores those differences is often ineffective and sometimes gets in the way of the work.
The people closest to a resource supply the context. With it, risk management can be targeted to what that resource needs.
Continuous improvement
Risk management is never finished. Teams reassess and refine their practices as they learn more, as circumstances change, and as new threats appear.
The same applies to the program itself. Its processes, guidance and tools are reviewed and improved on the strength of what participants report.
How the two sets work together
The core principles set the destination, and the principles of participation are how an organization gets there.
Shared responsibility depends on psychological safety, because people only accept responsibility for gaps they can report without blame. Empowerment depends on knowledge at the point of decision, because authority is of little use without the information to exercise it.
A program built on the core principles alone tends to stay on paper. The principles of participation are what bring people into it.