The unit of a federated program
In Federated Cyber Risk, the work is done by resource teams. A resource team is the group of people responsible for managing the risk to one or more resources. A resource is often a system, and it can also be a program or a process.
Teams are drawn from across departments, functions and levels. A unit usually has more than one. One organization with 59 participating units had 178 resource teams.
Who is on one
Two roles make up a resource team:
- Resource owner. The person accountable for the resource and for the risk decisions about it.
- Risk manager. The person who does the day-to-day work of assessing risk and maintaining the security plan.
Federated Practice Monitoring adds a third role, the auditor, who reviews the health of the practice across teams.
What the team does
- Identifies and assesses the cyber risks within its area of responsibility.
- Develops and carries out plans to reduce those risks.
- Monitors and reports on how well its efforts are working.
- Shares knowledge and good practice with other teams.
- Improves its own practice as it learns.
What the team knows, and what it needs
A resource team knows the business purpose of its resource, its operational requirements and its practical constraints. A security office would spend a great deal of time trying to learn those things.
What the team usually lacks is security expertise: which threats matter, which controls are effective, what good practice looks like. Supplying that expertise at the moment it is needed is the security office's side of the partnership.
What each team can see
Shared responsibility should not mean shared access. Each team sees the resources it is responsible for and no others, so the team is also the boundary of who can see what.
The next question for a new program is which teams to begin with. Choosing Your First Teams covers it.