{"id":238090,"date":"2022-06-23T09:53:00","date_gmt":"2022-06-23T09:53:00","guid":{"rendered":"https:\/\/www.seekingfire.com\/?p=238090"},"modified":"2022-07-07T20:00:49","modified_gmt":"2022-07-07T20:00:49","slug":"the-four-stages-of-cybersecurity-program-development-part-three","status":"publish","type":"post","link":"https:\/\/www.seekingfire.com\/business\/the-four-stages-of-cybersecurity-program-development-part-three\/","title":{"rendered":"The four stages of cybersecurity program development \u2014 part three"},"content":{"rendered":"\n

We’ve now reached part three in our four-part series about security program development. The series aims to provide an overview of creating a cybersecurity posture for your organization’s distinct needs. If you haven’t read parts one<\/a> and two<\/a> yet, we highly recommend starting there to get the complete picture. As a general rule, there are four key phases to security program development for most organizations\u2014this post reviews phase three, or the Deploy Risk Treatments stage.<\/p>\n\n\n\n

Phase Three of Security Program Development<\/h2>\n\n\n\n

You’re now more than halfway through the process of developing a security program for your organization. Nice work! In phase two, we discussed identifying your level of ‘risk appetite’ (i.e. how much residual risk is acceptable to your corporate culture and industry). Now that you’ve done that, you’re ready to look at risk treatments.<\/p>\n\n\n\n

The first step in deciding which risk treatments to deploy is to form a team of key internal stakeholders. We recommend creating a group so that decisions can be reached collectively and, hopefully, with some consistency. Once you’ve identified your internal team, you’ll begin looking at your cybersecurity risks on a priority basis (most urgent to least urgent). From there, you will select an option (more on this below) to reduce each risk to a level in alignment with your overall risk appetite.<\/p>\n\n\n\n

Your Options for Treating Risks<\/h2>\n\n\n\n

When it comes to treating a known cyber risk, you really only have four options to consider. We’ve detailed the options below.<\/p>\n\n\n\n