Key Solution Advisory New! Understand the key steps you can take to start implementing a risk-oriented approach to security. View Advisory

Vantage Magazine Article RSA's Strategy for Information Risk Management: Taking a holistic, risk-based approach to IT Security View Article

Three Pillars to an Information Risk Strategy

1) Information-centric approach: Begin by understanding what information is critical to key business initiatives, such as growth through acquisitions or expanding partnerships. Then diligently ‘follow the data’ to gain a more holistic view of all the places where it exists across the organization, where the points of vulnerability are, and what events could put your business at risk.”

2) Risk/Reward analysis: Security investments should be prioritized, based on the amount of risk a given activity entails relative to the potential business reward, and in keeping with the organization’s appetite for risk.

3) Ensuring repeatability: Once enterprise information has been located and a risk assessment performed, the next step is to implement controls — including policies, technologies, and tools — to mitigate that risk. Here, organizations often turn to frameworks like ISO 27002 and the PCI Data Security Standard.