The problem, 2018
The work began in 2018, in the information security office of a large public research university. Its cyber risk program sent assessment questionnaires to units every one to three years. Participation was low, the answers were hard to act on, and the office had too few people to follow up.
Analysis showed a forced choice between two time-consuming things: analyzing risk in depth, or extending coverage. A new approach was needed that allowed both. The encouraging sign was that IT directors in the units said they were willing to help.
The foundation of what became Federated Cyber Risk was developed over that year.
Early adopters, 2019
In early 2019 a first group of units began using the approach for cyber risk management and security planning. They were trained first in traditional, qualitative risk management, using the commercial tools available.
That experience showed two things. Traditional methods overwhelmed people who were not specialists. And the commercial tools were built for a central security team, with per-seat pricing that made broad participation unaffordable.
So the method and a tool to support it were built together, and refined with the early adopters for a little over a year. Word of their success spread, and other units asked to join.
A timeline
| Year | What happened |
|---|---|
| 2018 | The problem is defined and the foundation of the methodology is developed. |
| 2019 | The first early adopters use the approach for risk management and security planning. |
| 2021 | The first commercial product built to enable the methodology is released. |
| 2023 | QuickPlans are added: a resource team can build a high-fidelity security plan in under an hour. |
| 2024 | The first organization reaches full participation: all 59 qualifying units, with 178 resource teams. Compliance Checkups and dependency tracking with Cheese Flags are added. |
| 2025 | Practice monitoring is added, giving the security office a view of process health and security posture across the organization. |
| 2026 | Monitoring extends to remediation tracking, and third-party risk joins dependency and drift management. |
What was learned along the way
- Guidance built into the process replaces training. As the tools gained built-in help, the need for formal training fell away.
- Recognition sustains participation. Points, friendly competition and leaderboards were added to keep teams engaged.
- Plans are not only for systems. Teams began writing plans for programs and processes, which brought human-centered risks into scope.
- The security office gets its time back. With routine work handled by resource teams, the office was able to start new programs that help teams with mitigation.
From one methodology to a family
The approach began with risk management and security planning. Over time it took in remediation and compliance tracking as well, with the aim of making every administrative control collaborative and coordinated in a federated way.
That is why the work is now presented as a family. Federated Cyber Risk came first. Federated Third-Party Risk and Federated Practice Monitoring grew out of it and are described as methodologies in their own right. Together they are Federated Cybersecurity.