Welcome to our comprehensive guide on ‘Conducting an ISO 27001 Risk Assessment’. This blog is designed to equip you with effective strategies for a successful risk assessment, incorporating the principles of ISO 31000 risk management. Risk assessment is a vital component of a robust information security framework and is in alignment with ISO 31000.

Working with third-party service providers is part of doing business. Even before the digital revolution, entrepreneurs enlisted logistics and shipping providers, payment processing services, and other outsourced companies to help them streamline operations and reduce costs. ‍ Today's marketplace is no different, although the available third parties have evolved to fit organizations' growing digital needs.

The traditional enterprise risk model is a thing of the past. Cybersecurity risk cascades into almost every part of an organization, triggering legal fallout, technology risk, compliance issues, and more. Bottom line, third-party cyber risk is a material business risk. A recent report found that 80% of organizations experienced at least one data breach caused by a third party last year.

SecurityScorecard is proud to announce that it has achieved the Ready Designation under the Federal Risk and Authorization Management Program (FedRAMP). This designation demonstrates SecurityScorecard’s commitment to the rigorous security standards required by the U.S. government for cloud service providers, and it will enable the company to meet growing demand from U.S. federal agencies for its Third-Party Cyber Risk Management Platform. U.S.

In late August, Microsoft published its analysis of espionage activity tied to a new threat actor group called Flax Typhoon, which is believed to operate on behalf of the People’s Republic of China (PRC). The group mainly targets Taiwanese critical infrastructure, including: government, education, manufacturing, and information technology sectors.

When organizations hear “third-party risk management,” they often consider the processes needed to mitigate risks when working with a third-party vendor. These can include procurement risks and risks associated with starting new vendor relationships, often referred to as "onboarding,”—but what about when a working relationship ends?

With the average cost of a data breach now at $4.35 million, it’s time for organizations to take proactive measures to protect themselves against cyber threats. By conducting thorough security testing, organizations can gain a deeper understanding of their security posture and make informed decisions about where to allocate their resources to improve their overall cybersecurity readiness.

In merely a few decades, technological pioneers developed an unprecedented ability for society to access and store data in immeasurable quantities. This newfound power transformed many aspects of the physical world into a digital one, taking everyday activities such as banking, gaming, shopping, and socializing online.

Last week, I had the opportunity to moderate a panel at the NACD Summit, where I was joined by: Deven Sharma, Former President at S&P; John Katko, Former Member of U.S. House of Representatives; and Aaron Hughes, CISO at Albertsons. The National Association of Corporate Directors (NACD) holds its summit annually to empower directors and transform boards to be future ready. Our panel discussion focused on how board members can strategically oversee their organizations’ cybersecurity resilience.