GRC, A holistic Road Map for Information Security Transformation Eng. Mohamed Saad Mousa Head of information Security IKEA Saudi and Bahrain 00966562539903

Digital Transformation Era Future Driven Technologies Robotics Very Cheap Labour Block chain create internet of money Virtual Reality Reality As you imagine Clouded computing ICT department in no where Big Data Analysis Determine business mean stream Artificial Intelligence take a decision instead of human Internet of things IOT will be Sensing every thing Agile Software development development of software is not a big deal Cyber Security Program

Cyber resilience statistics (EY 20th Global Information Security Survey 2017-18 )

2019 Will Be The Year Of Cyber War ? https://www.cybersecurityintelligence.com/blog/2018-predictions-full-scale-cyber-war-3051.html 2018 will see the arms race between organisations and hackers continue to intensify. As well as this, 2018 could see a full-scale cyber war break out between countries.  Growth in number of attacks 2017 saw a significant escalation in the number of cyber-attacks levied against nation states, and Ward Solutions believes that 2018 will see similar growth in the number of attacks. 

CISO Challenges business reliability on ICT Culture change resistance business relay more on ICT day after day. We live in digital business era with increasing expectation of Confidentiality, Integrity , availability and privacy Changing culture for more security environment is always a challnge New emerging technology Resources And all of these new technologies introduce new risks to business environment Still we have a very limited number of resources in information security field Budget constrains Most of business environments is struggling to reduce their expenses

Governance , Risk and Compliance GRC is a system of people, processes and technology that enables an organization to understand and prioritize stakeholder expectations; set business objectives congruent with values and risks; achieve objectives while optimizing risk profile and protecting value; operate within legal, contractual, internal, social and ethical boundaries; provide relevant, reliable and timely information to appropriate stakeholders; and enable the measurement of the performance and effectiveness of the system. The sheer quantity of GRC definitions makes it hard to realize an agreement on a definition, as many definitions do overlap .The ‘Open Compliance and Ethics Group’ (OCEG) has published a more comprehensive definition, which was revised by experts from a diversity of organizations. Integrated GRC is about principal and harmony performance when perusing goals and objectives while facing uncertainty

GRC is a vision of Principled Performance To address this growing web of issues, threats and challenges forward-thinking CISOs have adopted a vision of Principled Performance — a point of view and approach to business that helps organizations reliably achieve objectives while addressing uncertainty and acting with integrity. This enables. performance while considering both threats and opportunities, while honoring mandatory commitments including legal compliance and voluntary promises found in statements of mission, vision and values, contracts, and employee agreements. Principled Performance is reliable achievement of objectives while addressing uncertainty(RISK) and acting with integrity.

Learn Your Business Context for Principled Performance

GRC Road Map (Strategic insight)

GRC 5 integration points, IT and Information Security

01 03 05 5 Success Driving Gears 02 04 Standards and frameworks Never relay on the standard or framework reputation. There is no best standard and every business has its own character. Chose suitable Framework that present your business objective Risk Management 02 Chose the right risk management methodology. After that Link the risk management with other Information security department activity such incident handling , vulnerability management , compliance …etc control library 03 Chose the control library that achieve your business objective not that has much more controls again there is no best standard 04 Culture change Culture resistance is most Show stopper of GRC programme. Awareness programme is most effective tool to culture change Measuring principle performance 05 The program can not be measured can not managed. : e-GRC platform will help you to have a complete vision of GRC program with holistic program KPIs.

GRC : Measure people security to manage information security The GRC program is about business enablement for principal performance. The program can not be measured can not managed. People performance Processes maturity Technology benchmarking CISO should design clear KPIs that related to Program Effectiveness, Responsive , compliance ,…etc. Use standards to design your own measuring tool such as COBIT 5 PAM tool, OCEG (Burgundy Book), ISF benchmarking tool , …..

Questions

Presentation title Thank you Copyright Insight Consulting Ltd