In the era of digital transformation, the threat of cyber-attacks could not be more imminent. Numerous examples of data breaches (e.g., Solarwinds, Microsoft DNS, VMWare ESXi) in the recent past demonstrate how organizations continue to be exposed to a variety of cyber risks. An effective cyber risk management is needed to understand risks and their potential impact on an organization and maintain a security program that is tailored to the risk appetite of the organization. An effective cyber risk management program involves the entire organization. Although Information Security may ultimately own cybers risk management, cyber risk is dispersed throughout the organization, requiring an integrated approach and cross-divisional collaboration to effectively manage and mitigate exposure. 

This talk provides an overview of which methodologies, frameworks and governance models are needed to establish a proper cyber risk management functionality. We will also show how to use these methodologies to systematically identify, prioritize and manage cyber risks in large, real-world organizations.