Cyber risk management is an ongoing challenge. Complex technology environments, technical debt, digital transformation, and confusing regulations represent some of the contributors to the cyber risk conundrum. DivIHN’s Cyber Risk Governance service provides a holistic approach to tackle this challenge. Our cyber risk governance services includes: Cyber Risk Assessment, Cybersecurity Governance, Compliance Management, Third Party Management, and Virtual CISO Services.
Cyber Risk Assessment
We have a proven cyber risk assessment methodology to determine what’s important to your business and identify gaps in talent, practices, and technologies that contribute to elevated risk. The process includes:
- Initiation – Establish the core team and structure for the assessment and finalize.
- Discovery – Collect the data needed to understand business environment, regulatory and contractual constraints, data collected and processed, and technology environment.
- Assessment – Conduct a detailed review of policies, processes, and technologies included in the scope of the assessment.
- Analysis – Determine gaps in controls using business risk tolerance, regulatory and contractual constraints, and relevant industry certifications as a reference for level of controls required.
- Recommendation – Develop detailed recommendations to close gaps using leading practices and define the roadmap needed to guide execution. Conduct reviews with core team prior to presenting findings to leadership.
The outcome of your cybersecurity engagement is a holistic, clear, and actionable cybersecurity strategy and roadmap needed to close gaps and manage risk.
Cybersecurity Governance
Cyber risk management is a journey not a destination. Your ability to maintain alignment with business risk tolerance and technology vision and adapt to changing cyber threats is critical. DivIHN’s Cybersecurity Governance service is intended to enable the culture needed to accomplish this goal. We collaborate with you to ensure the right talent is in place, effective decision-making structures are available, relevant metrics are available to inform decisions, and policies guide the application of cybersecurity controls.
- Security Principles – Establishment of security principles needed to promote a culture of risk management
- Metrics & Reporting – Implementation of metrics tracking and reporting to inform risk management decision-making
- Committee/Workgroup Structure – Definition and implementation of security decision-making process
- Security Organization – Definition of the security organization including roles and responsibilities
- Security Policies – Development of security policies and processes (ISO 27002 aligned)
Our experience and intellectual property greatly decreases the time to implement cybersecurity governance and increases effectiveness of the process.
Third Party Risk Management
Third party relationships are unavoidable in today’s business environment. These relationships pose risks to your business that are often challenging to manage. DivIHN’s Third Party Risk Management service takes a strategic approach to providing you visibility to third party risk before contracting and throughout the term of the relationship. We perform the due diligence to determine third party compliance with your policies as well as applicable regulations and industry requirements. The outcome is a clear understanding of risk to your business that enables informed decision making.
Compliance Management
Regulatory compliance and industry mandates has become a challenge to navigate. Failure to comply can result in costly fines, loss of business, and other punitive actions. DivIHN helps you resolve this dilemma by preparing you for the audit process. We collaborate with you to understand applicability to your business, define the scope, assess controls, and provide recommendations to close gaps. The outcome is a readiness to achieve certification with limited friction.
DivIHN compliance management services include:
- ISO 27001 Certification (ISO 27002, ISO 27017, and ISO 27018)
- HITRUST CSF Certification
- GDPR Compliance
- CCPA Compliance
Virtual CISO Services
DivIHN’s Virtual CISO service provides you a clear understanding of cybersecurity risks associated with your business and the actions needed to reduce it to an acceptable level. We provide the governance leadership needed to design the right controls and lead internal personnel and providers to ensure effective implementation. The services include initial onboarding to align cybersecurity with your business and technology environment and ongoing services to address strategic and tactical needs.
Onboarding Service
- Establish Inventory of Data and Technology Assets
- Perform Risk assessment
- Identify Gaps and Provide Recommendations
Ongoing Service Strategic
- Semi-annual cybersecurity review
- Cybersecurity and Awareness Training
- Establish Policies and Processes
- Establish Cybersecurity Statement
Tactical
- Cybersecurity Supplier/Provider Management
- Product and Service Recommendations
- Ongoing Cybersecurity Awareness
- On-demand Requests
DivIHN’s Virtual CISO service provides you many benefits. Our service is value-based as it provides industry leading cybersecurity expertise without the fully burdened cost. The CISO has access to a broader DivIHN team that can quickly bring thought leadership to protect your assets. Our service allows you to focus on your business and servicing your customers.
