A familiar pattern
In many organizations, cyber risk management works like this. A central security team sends an assessment questionnaire to every unit, every one to three years, and waits for the answers.
Many are never returned. Those that come back often give general answers that say little about any particular system. The team has too few people to follow up, so the cycle repeats.
The people involved are rarely the cause. The central model has four limits built into it.
It does not scale
A central team has a fixed number of people. As the organization grows and its technology becomes more complex, the volume and variety of risk outgrow them. Threats are found late and answered slowly.
The threat landscape also keeps changing. A team already at capacity struggles to adjust its approach each time it does.
It lacks context
A central team cannot know every unit's processes, technology and working conditions. Without that knowledge it is hard to give advice a unit can act on.
The usual result is one set of guidance for everyone. It fits few units well, and in some it gets in the way of the work.
It depends on too few people
When one team is responsible for identifying, assessing and mitigating every risk, the whole program is limited by that team's capacity. It becomes a bottleneck and a single point of failure.
It also limits what can be discovered. A central team concentrates on the risks it already knows about, and may never learn of the ones it doesn't.
It leaves everyone else out
When risk management belongs to a central team, the people who run the systems feel disconnected from it. Security becomes someone else's problem.
This is the common failure when responsibility is shared in practice but is not managed that way.
The slide into compliance
Under these limits, a central team narrows its attention to the risks that are already known or obvious. Success comes to mean meeting the minimum scope that governance bodies require.
That work has value, since the known risks do get addressed. It also creates the impression that risk is being managed across the organization, when most of it has not been examined.
A forced choice
Underneath all of this is a choice between two things that both take time: analyzing risk in depth, and extending coverage to more of the organization. A central team can go deep on a few resources or shallow on many.
A program needs both. What Federated Cyber Risk Is describes an approach designed to provide them, by placing each risk decision with the people best suited to make it.