How to Optimise Your GRC Tools

Improving Value, Efficiency & True Risk Management

Are your GRC tools really managing risk, or just creating noise?

Welcome to the latest episode of Razorwire, where we cut through the complexities of the cybersecurity world to deliver actionable insights. 

I'm your host, Jim, and in this episode, we're discussing the multifaceted challenges and opportunities surrounding Governance, Risk and Compliance (GRC) tools with none other than Jack Jones, creator of the FAIR risk model and a seasoned security professional with nearly 40 years’ experience.

In our conversation, Jack and I explore the intricate landscape of GRC tools, questioning their effectiveness in truly managing risk. We talk about the difference between controlling efficiencies and understanding genuine risks, shedding light on the often misleading contents of risk registers. 

In this episode, you'll learn invaluable insights that could transform how you approach risk management and compliance. From navigating price range vs efficiency, to the idea of developing a more effective and affordable GRC solution, this episode offers a treasure trove of useful takeaways for anyone in the cybersecurity field. 

Key takeaways

1. The Real Cost of GRC Tools: Jack and I discuss the hidden expenses and renewal price hikes associated with existing GRC tools. If you're feeling the financial strain of your current GRC solutions, this segment is a must-listen to understand the true cost and value proposition of these tools.
2. Redefining Risk Management: We talk about the importance of differentiating between real risks and mere efficiencies and how many organisations can get this wrong. Learn how to avoid the ‘noise’ in your risk register to focus on genuine risk scenarios that matter to your business.
3. The Path to Better GRC Solutions: Tune in to hear our thoughts on the pressing need for innovation in GRC tool design. If you're looking for practical, cost effective solutions tailored to meet your risk management needs, you'll want to hear our insights and future plans.

Don't miss this conversation that could reshape your perspective on GRC tools and risk management.

"If I thought the [GRC tool] technology is actually provided anywhere near the value of their potential… if the GRC products and their implementations were actually doing the job they're intended to do, they should cost a lot of money because they would be providing a ton of value." - Jack Jones

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

In this episode, we covered the following topics:

• Cybersecurity Responsibilities Debate: We debate whether cybersecurity should fall under IT or infosec departments.
• Penetration Testing Management: How penetration testing could be subject to a conflict of interest depending on which department manages it.
• GRC Tool Costs: Maximising GRC Tool ROI: Gain insights on how to assess and optimise your GRC tool's value proposition through regular utilisation and cost reviews.
• Identifying GRC Tool Shortcomings: Understand the common pitfalls of popular GRC tools in addressing real world risks, enabling better tool selection and implementation.
• Proper Risk Register Management: Learn to distinguish between genuine risks and audit deficiencies for more accurate and useful risk registers.
• Third-Party Risk Management: Learn strategies for effectively managing the challenges posed by third party risks in modern business environments.
• Effective Risk Communication: Master the art of framing risk discussions around loss event scenarios, for better communication with executives.
• The Potential of GRC Tools': Recognising the potential of GRC tools to manage complex IT environments and consolidate security data effectively.
• Ineffective GRC Tools: Exposing how security budgets are heavily consumed by expensive and often inefficient GRC tools, limiting additional security measures. 
• Balancing Security Budgets: Learn to critically evaluate GRC tool costs and effectiveness to ensure balanced allocation of security resources.

Resources Mentioned

• The FAIR model
• ISO 27001
• PCI compliance
• Book: "The Cyber Sentinels Handbook"
• GRC Tools

Other episodes you'll enjoy

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Connect with your host James Rees

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com.

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: https://www.razorthorn.com/

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2024