Two activities, one order
In Federated Cyber Risk (FCR), a resource team does two things for each resource: it manages the risk, and it plans the security. Risk management comes first.
The two are done together, by the same people, as one piece of work. That pairing is what makes the planning risk-informed.
When the plan comes first
A security plan written without a risk assessment is written against a framework. Every control looks as important as every other, and effort is spread evenly across them.
The result may satisfy a checklist. It says little about whether this resource is protected against the things most likely to harm it.
What risk management contributes
- What could go wrong for this resource, and what the consequences would be.
- How likely each of those outcomes is, given the current threats and the controls already in place.
- Which risks the team will manage, and how it will handle each one: mitigate, accept, avoid or transfer.
What planning does with it
The security plan records the controls the team has in place and the ones it intends to add. With the risk assessment behind it, the plan can say which of those matter most and why.
It becomes a roadmap: what to do next, in what order, and for which reason.
Closing the planning gap
Many organizations know about their risks and do not act on them in a coordinated way. Doing risk management and planning as one activity closes that gap, because every risk the team chooses to manage arrives in the plan with a decision attached.
The minimum still applies
Risk-informed planning does not replace the organization's minimum security requirements. The minimum is the floor every resource meets. The risk assessment shows where a particular resource needs more. Defining the Operating Model describes how the two are set up.
With the right starting point, the whole exercise takes about an hour. A Security Plan in an Hour explains how.