The moment that decides the program
Sooner or later a resource team reports that something important is not in place. How the security office reacts will be noticed, and other teams will adjust their own answers to match.
What to avoid
Treating the report as a compliance failure is the natural reflex, and it is the wrong one. A team that is escalated or criticized for an honest answer learns to give optimistic ones, and so does every team that hears about it.
The organization then manages risk it cannot see.
What to do
- Acknowledge the report. It is information the organization did not have.
- Help judge the risk. Work out with the team how much this gap matters for this resource, compared with its other risks.
- Choose how to handle it. The team can mitigate the risk, accept it, avoid it or transfer it.
- Record the decision. Whatever is chosen, it is written down where it can be reviewed.
- Follow it through. A decision to mitigate becomes work that is tracked until the control is in place.
Accepting a risk is a legitimate answer
Some gaps cannot be closed right away, and some are not worth closing. A clear process for documenting, reviewing and accepting a risk keeps it visible without blaming anyone for it.
Acceptance should follow consistent, documented criteria, so that similar risks are treated alike across the organization.
When many teams report the same gap
A gap that appears in one resource is that team's to work on. The same gap across many resources is a pattern, and it usually points to something the security office can provide: a shared service, clearer guidance or a standard way of responding.
Following a Gap to Its Fix covers what happens after the decision. What Safety Culture Teaches Security covers the thinking behind this approach.