Cyber Security Governance and Risk Management

to the whole organisation or to particular systems; and frequent updates to specific risk assessments as the nature and scale of threats and vulnerabilities change.

​

When you identify potential risks, you need to understand the organisation’s assets and their value, so you need to have regular conversations with general managers and other relevant stakeholders across the organisation. You know how the organisation’s data is stored and how it flows between systems. Likewise, when you assess the likelihood and impact of a risk affecting a system or a set of information you work closely with colleagues with other types of cyber security responsibilities, particularly in Vulnerability Management and Cyber Threat Intelligence. 

​

Much of the work requires you to work very methodically on interpreting and applying standards and legislation, whether you're working on policies or monitoring compliance or using standard tools and techniques to assess risks. You write a fair amount, such as when maintaining a risk register or drafting policies.

If your responsibilities extend beyond identifying and assessing risks to determining the most appropriate approaches to managing them, you will be creative in using your understanding of the organisation’s business and values, the scale of the risks and the effectiveness of the available risk control options.