Response to discussion thread

Companies run into this issue all the time. They take on more risk than they are capable of with wishful thinking that "it will not happen to them." These executives are often right, but when they are wrong, the damages are unbelievable.

Risk identification becomes critical here. Here are some of the questions you should be asking while assessing the risk:

Assets: What are you trying to protect? Threats: What are you concerned about? Vulnerabilities: How could the threats materialize? Existing controls: What processes are in place now that are helping you reduce risk?

To get additional clarity about the attributes listed above, run them through the issue of cybersecurity. Think about business and legal consequences if a cyber-attack compromises your organizational data.