The financial consequences of security incidents represent the most immediately quantifiable dimension of the security risk that the Security Consulting function must govern in its advisory engagements, because the financial impact is the language in which the board and executive management most directly engage with the security risk conversation and the terms in which the security investment decision is most credibly justified. The Security Consulting function that can articulate the financial risk that the organisation’s security posture creates, the financial consequence that specific incidents would produce, and the financial return that the security investment delivers against the quantified risk exposure will consistently achieve the governance engagement and the investment support that the security programme requires to be effective.
The financial risk perspective that the Security Consulting function brings to the advisory engagement must extend beyond the direct financial impact of the security incident’s immediate consequences to the full financial consequence picture that the complete incident lifecycle creates. The ransomware attack whose immediate financial impact is the ransom demand that the incident response team is considering creates the full financial consequence that encompasses the ransom payment or the recovery cost, the forensic investigation expense, the legal and regulatory advisory cost, the business interruption loss during the recovery period, the regulatory notification and potential penalty, the customer notification and credit monitoring provision, the litigation defence cost from the class action that the affected individuals’ data exposure creates, and the ongoing revenue loss from the customer attrition and the brand devaluation that the incident’s reputational impact produces. The Security Consulting function that presents only the ransom demand as the financial risk is presenting a fraction of the genuine financial exposure whose complete picture the board requires to make the security investment decision that the full financial risk justifies.
The Financial Risk Taxonomy #
The Security Consulting function must advise on the financial risk assessment using the comprehensive taxonomy that captures the full range of financial consequences that security incidents create across the direct, the indirect, and the litigation dimensions whose combined impact the organisation’s financial exposure assessment must reflect:
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
