Gartner examine and evaluate solutions for cyber risk management to provide organisations with insight for how to support decision making. It’s a valuable document particularly as cyber risk is becoming an increasingly complex issue to handle.
Gartner’s Hype Cycle also focuses on “Utilizing advanced tools specifically designed for cyber-risk management. Such tools include near-real-time monitoring systems, automation for resource-heavy processes and impact-focused risk assessment methods.”
Quod Orbis has been included in the platforms that can support organisations cyber risk strategies with our Continuous Controls Monitoring platform. Gartner has recognised that CCM is a necessary tool in the armoury of organisations because of the increased attack surfaces. Cloud adoption, digital transformation and the walls of expansion to protect an organisation have been identified by Gartner as the reasons why Continuous Controls Monitoring is needed to provide the assurance that organisations have the capability to monitor and measure control effectiveness.
Gartner states: “CCM tools in cybersecurity help security and IT teams reduce the manual efforts for security control management, partially relieving staff burden and enabling them to focus on higher-value tasks and reducing costs. The tools also provide constant monitoring of security controls, allowing faster detection of potential threats and minimizing breaches and regulatory noncompliance…”
Ultimately, organisations face unprecedented times. Business no longer has “4 walls to protect” – the rise of hybrid working and the digital evolution has created a complex ecosystem that is now hard to manage. Couple that with the increase of cyber-attacks and the utilisation of AI that has exploded and accelerated the capacity for deepfake attacks, for example, and increasing regulatory demands means that there is a need to use automation to provide the evidence and assurance that organisations are secure and compliant.
As Gartner states “Many security organisations lack the capabilities to continuously monitor and measure their controls’ effectiveness. This lowers the value of those controls.”
Also, many regulatory frameworks – NIST, ISO27001, GDPR, Basel 3 (Banking), PCI DSS as well as DORA – now require continual monitoring in order for organisations to be compliant and secure. Gartner recognises that for teams to manage huge sets of data and monitor controls effectiveness, point-in-time information is completely useless in today’s current landscape.
The key drivers Garter identifies for Continuous Controls Monitoring – in short
- Increases security and IT operational teams’ productivity by testing more controls within a given time frame.
- Provides confidence that controls and gaps are being timely identified and actively managed, enhanced with real-time alerts based on specific risk thresholds.
- Streamlines control testing and reduces audit management costs because evidence of control activities is collected automatically according to the designated standards and policies.
- Helps avoid fines and boosts business reputation in the eyes of regulators, customers and auditors, as the organization has readily available evidence of risk remediations, protection of valuable assets and an ability to meet its compliance obligation.
- Enables the prioritization of risk management communication and decision by providing context and analysis metrics.
- Improves accuracy by using preconfigured dashboards and reporting to avoid human errors through ad hoc data exports, copy/paste and hunting files in dispersed locations.
The landscape will never go back to the way it was, so it’s now time for organisations to support their Cyber Security Teams to elevate their operations to be proactive in order to protect their business.
