The belief that gets in the way
In many organizations, people outside the security team assume that the security team owns cyber risk. The assumption is rarely written down, and it shapes behavior all the same.
It comes from misaligned incentives. A unit that runs a system gets the benefit of running it. If someone else is believed to carry the risk, the unit has little reason to spend its own time managing that risk. Misaligned Incentives covers the background.
The security team, meanwhile, is treated as the owner of resources it does not run and cannot control.
Federated Cyber Risk (FCR) places each risk decision with the people best suited to make it. That only works if those people agree the decision is theirs. So the first step in starting a program is to find out what they believe now.
Discovery before design
Discovery means gathering current sentiment about ownership across the organization, before a program is designed around a guess.
It has three aims: to measure how well people understand who owns risk, to identify resources that current practice does not cover, and to learn how people feel about risk management as it is done today.
Together these show the depth of the challenge. An organization where most units already see the risk to their systems as their own needs a different start from one where nearly everyone points to the security office.
Ways to gather sentiment
Use more than one method, because each shows something the others miss.
- Surveys. A short survey reaches the most people and gives a picture that can be compared across units and repeated later.
- Interviews. Conversations with unit leaders, system owners and IT staff show the reasoning behind the survey answers.
- Existing documents. Policies, procedures and incident response plans show where the current approach has gaps or contradicts itself.
- Recent decisions. Look at how a risk decision was made in the last year: who made it, who was consulted, and who was told afterward.
Questions worth asking
These seven questions work in both surveys and interviews:
- How well do you understand your role in managing cyber risks within your area of responsibility?
- Are there any critical assets, systems or processes that you believe may not be adequately protected under current risk management practices?
- How confident are you in the organization's ability to manage cyber risks effectively?
- Do you feel that you have sufficient visibility into cyber risks that could affect your area of responsibility?
- How worried are you about the potential impact of cyber incidents on your work and on the organization as a whole?
- Do you believe that the current risk management approach effectively engages all relevant stakeholders?
- What improvements would you suggest to the organization's cyber risk management practices?
Add questions about specific situations. A question about "ownership" in the abstract gets the policy answer. A question such as "who decides whether this system can keep running with a known gap?" gets the working answer.
Reading what comes back
The overall result matters less than where the answers differ.
| What you find | What it suggests |
|---|---|
| Most units see the risk to their systems as their own | Incentives are close to aligned. The program can start with tools and support. |
| Most units see the risk as the security team's | Incentives are misaligned. Plan for more education before and during the rollout. |
| Leaders and staff give different answers | The expectation has not traveled. Leadership needs to state it plainly before teams are asked to act on it. |
| Policy says one thing and practice shows another | The written rule is not what drives behavior. Changing the document will not be enough. |
Look for variation between units too. A few units that already own their risk are the natural place to begin, and their experience is useful evidence for the rest.
When the answer is "security owns it"
A strong sentiment toward central ownership does not mean a federated program should be set aside.
It is a signal of increased risk. The people in a position to reduce risk do not believe it is theirs to reduce, so less is being done than the organization assumes.
What changes is the preparation. The stronger the sentiment, the greater the need for education: units need to hear what they own, why they are the right people to own it, and what support they will receive. They need to hear it from leadership, and more than once.
It also sets expectations. Participation will take longer to build, and the choice of first teams matters more.
What the conversation settles
The outcome of discovery is a shared, stated answer to three questions: who owns each resource, who makes its risk decisions, and what the security office provides in support.
Keep the results as a baseline. Repeating the survey after the program has been running shows whether sentiment is moving, which is an early sign of whether the program is working.
The findings are also the evidence for the next step, which is asking leadership to back the program. Making the Case to Leadership covers that.