The Cybersecurity Canon: World Class Risk Management

We modeled the Cybersecurity Canon after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have more than 25 books on the initial candidate list, but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite. 

The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!

Executive Summary

“World Class Risk Management,” by Norman Marks, is a comprehensive look at enterprise risk management, or ERM. It explores some common standards, such as COSO, FAIR, and ISO 31000, as benchmark standards for adopting ERM. ERM is done in our daily lives, its role being to document and manage risks, as opposed to make decisions about them. Risk acceptance belongs within top management of the company.

Review

This book spends half its pages providing great insight into the most popular ERM standards. It also provides excellent examples of how ERM is playing out in our daily lives. Where it is lacking in meeting the nomination criteria, from my point of view, is in presenting any tangible ways ERM is being used within enterprises. I would suggest this book for those who want a deeper understanding of ERM and an introduction to the standards. It does not provide meaningful ways to apply ERM, however, which would have made it an especially critical book for readers to be aware of.

Conclusion

This book is a great educational read for developing an understanding of the ERM standards, and it provides good examples from our daily lives to support the concepts of risk management and ways to accept risk in an enterprise. Where I feel it falls short of a recommendation for nomination is in the application of these standards.