A security strategy that does not explicitly address its relationship to the organisation’s technology risk management programme is structurally incomplete. Technology risk is not a subset of information security risk that the security function can manage in isolation, nor is it a category of business risk that the broader enterprise risk management framework can assess effectively without the security function’s active contribution. It sits at the intersection of both, and the quality of its management depends on the coherence and deliberateness with which the security strategy defines how information security and technology risk management will operate as aligned and mutually reinforcing disciplines rather than parallel programmes that occasionally intersect.
The security strategy should therefore include an explicit plan for technology risk management that defines the principles, processes, governance structures, and communication standards through which information security and technology risk management will be integrated within the context of the organisation’s broader business risk programme. Without this plan, the gaps and misalignments that consistently undermine technology risk governance will persist: inconsistent risk terminology that produces miscommunication between security and technology teams, divergent impact and likelihood assessments that generate conflicting risk pictures for executive management, and technology risk management activities that reflect neither the security function’s threat intelligence nor the business risk programme’s strategic priorities.
Aligning Technology Risk Management with the Business Risk Programme #
The foundation of the technology risk management plan is the explicit alignment of information security risk management with the organisation’s enterprise risk management framework. Technology risk must be analysed, categorised, and communicated as a component of business risk rather than as a separate technical discipline, ensuring that the board and executive management can assess technology risk within the same governance framework they use to oversee financial, operational, legal, and reputational risk.
Organisations should consider the following as foundational commitments of this alignment:
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
