1. GRC, A holistic Road Map for Information Security Transformation
Eng. Mohamed Saad Mousa
Head of information Security
IKEA Saudi and Bahrain

2. Digital Transformation Era
Future Driven Technologies
Robotics
Very Cheap Labour
Block chain
create internet of money
Virtual Reality
Reality As you imagine
Clouded computing
ICT department in no where
Big Data Analysis
Determine business mean stream
Artificial Intelligence
take a decision instead of human
Internet of things
IOT will be Sensing every thing
Agile Software development
development of software is not a big deal
Cyber Security Program

3. Cyber resilience statistics (EY 20th Global Information Security Survey 2017-18 )

4. 2019 Will Be The Year Of Cyber War ?
2018 will see the arms race between organisations and hackers continue to intensify. As well as this, 2018 could see a full-scale cyber war break out between countries. 
Growth in number of attacks 2017 saw a significant escalation in the number of cyber-attacks levied against nation states, and Ward Solutions believes that 2018 will see similar growth in the number of attacks. 

5. CISO Challenges business reliability on ICT Culture change resistance
business relay more on ICT day after day. We live in digital business era with increasing expectation of Confidentiality, Integrity , availability and privacy
Changing culture for more security environment is always a challnge
New emerging technology
Resources
And all of these new technologies introduce new risks to business environment
Still we have a very limited number of resources in information security field
Budget constrains
Most of business environments is struggling to reduce their expenses

6. Governance , Risk and Compliance
GRC is a system of people, processes and technology that enables an organization to understand and prioritize stakeholder expectations; set business objectives congruent with values and risks; achieve objectives while optimizing risk profile and protecting value; operate within legal, contractual, internal, social and ethical boundaries; provide relevant, reliable and timely information to appropriate stakeholders; and enable the measurement of the performance and effectiveness of the system.
The sheer quantity of GRC definitions makes it hard to realize an agreement on a definition, as many definitions do overlap .The ‘Open Compliance and Ethics Group’ (OCEG) has published a more comprehensive definition, which was revised by experts from a diversity of organizations.
Integrated
GRC is about principal and harmony performance when perusing goals and objectives while facing uncertainty

7. GRC is a vision of Principled Performance
To address this growing web of issues, threats and challenges forward-thinking CISOs have adopted a vision of Principled Performance — a point of view and approach to business that helps organizations reliably achieve objectives while addressing uncertainty and acting with integrity. This enables.
performance while considering both threats and opportunities, while honoring mandatory commitments including legal compliance and voluntary promises found in statements of mission, vision and values, contracts, and employee agreements.
Principled Performance is reliable achievement of objectives while addressing uncertainty(RISK) and acting with integrity.

8. Learn Your Business Context for Principled Performance

9. GRC Road Map (Strategic insight)

10. GRC 5 integration points, IT and Information Security

16. 01 03 05 5 Success Driving Gears 02 04 Standards and frameworks
Never relay on the standard or framework reputation. There is no best standard and every business has its own character. Chose suitable Framework that present your business objective
Risk Management 02
Chose the right risk management methodology. After that Link the risk management with other Information security department activity such incident handling , vulnerability management , compliance …etc
control library 03
Chose the control library that achieve your business objective not that has much more controls again there is no best standard 04
Culture change
Culture resistance is most Show stopper of GRC programme. Awareness programme is most effective tool to culture change
Measuring principle performance 05
The program can not be measured can not managed. : e-GRC platform will help you to have a complete vision of GRC program with holistic program KPIs.

17. GRC : Measure people security to manage information security
The GRC program is about business enablement for principal performance. The program can not be measured can not managed.
People performance
Processes maturity
Technology benchmarking
CISO should design clear KPIs that related to Program Effectiveness, Responsive , compliance ,…etc.
Use standards to design your own measuring tool such as COBIT 5 PAM tool, OCEG (Burgundy Book), ISF benchmarking tool , …..

18. Questions

19. Presentation title
Thank you
Copyright Insight Consulting Ltd