The arithmetic that doesn't work
In most organizations, cyber risk management is done by a central team, one system at a time. The team assesses a system, writes or reviews its security plan, and moves on to the next.
In a decentralized organization the arithmetic fails. A university, a state government or a health system can have thousands of systems, programs and vendors, run by hundreds of teams the security office does not manage.
A central team that works carefully might cover a few hundred of them. The rest carry risk that nobody has assessed.
The definition
Federated Cyber Risk (FCR) is one of the Federated Cybersecurity methodologies. It places each risk decision with the people best suited to make it, and gives them a structured way to decide well.
A resource team assesses the risk to its own system, builds a security plan informed by that risk, and decides whether what remains is acceptable. That includes the decision to operate.
FCR is not limited to risk assessment. It also covers security planning, remediation and compliance tracking for the same resource.
The security office stops being the place where every decision queues up. Its job becomes building the programs, standards and shared evidence that make those decisions sound, and watching the results across the whole organization.
Three roles
FCR divides the work among three kinds of participant.
| Role | What it owns |
|---|---|
| Resource teams | Their own assessments, security plans and risk decisions, including the decision to operate |
| Common control service providers | An inventory of the controls their service delivers to its customers, kept current under change control |
| The security office | The method, the baselines that plans are measured against, verification of common control services, and the organization-wide view |
The work itself is familiar. What changes is who does each part and how.
Why participation is the hard part
A federated model only works if people who are not security professionals take part, and keep taking part. That makes participation a design problem before it is a policy problem.
FCR shares the five principles of participation that run through all the Federated Cybersecurity methodologies: agile and lean design, automating the tedious, knowledge at the point of decision, psychological safety, and gamification. Each one removes a reason a busy team would stay away. The Five Principles of Participation covers them in turn.
What stays central
Federating decisions does not remove the security office. It changes what the office spends its time on.
The office verifies the common controls that everyone inherits. It supports the cases that need an expert. And it reads the aggregate picture to see where risk is concentrating, which no single team can see from where it sits. From Doctor to Public Health Official describes that shift.
Where it fits
FCR is meant for organizations responsible for cyber risk across a population they can't directly control. Universities and university systems, state governments and their agencies, school districts, health systems and distributed enterprises all have that shape.
In each of them, the people who know a resource best are not on the security team. FCR gives those people a structured way to manage its risk, and gives the security office a way to support and see all of it.
The measure of a security program then becomes how well the whole organization manages its risk, including the parts the security office never reviews directly. The other articles in this series describe how that works in practice.