Foundation of Risk-Based Security Consulting #
The Security Consulting function’s most fundamental governance principle is the proportionality between the security investment the organisation makes in protecting a specific asset and the value that asset represents to the business. This principle is both intuitively obvious and consistently violated in practice, because the pressure to achieve comprehensive security coverage, the compliance orientation that applies uniform standards regardless of asset significance, and the technical assessment’s tendency to prioritise the most visible vulnerabilities rather than the most consequential assets together create the security investment allocation that does not reflect the business’s own assessment of what matters most.
The Security Consulting function’s advisory on asset-based security proportionality provides the governance intelligence that corrects this misalignment, ensuring that the organisation’s security investment is concentrated on the assets whose value and criticality justify the most rigorous protection rather than distributed uniformly across the full asset estate regardless of the asset significance variation that the risk-based approach requires to be reflected in the security architecture’s calibration.
Understanding Asset Value in the Security Consulting Context #
The asset value assessment that drives the security proportionality principle must encompass both the tangible and intangible dimensions of value that the organisation’s assets represent, because the exclusive focus on the tangible replacement cost that the technical asset inventory most readily captures consistently undervalues the intangible assets whose business significance the executive considers most strategically important.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
