RiskUKJune2017

Enterprise Security Risk Management
safer enterprises, a more strategic approach
towards risk and a far more cost-effective
security function.”
Serving alongside Tyson on the Commission
are Brian Allen CPP, Raymond O’Hara CPP
(executive vice-president at AS Solutions),
John Turey CPP (senior director at TE
Connectivity), John Petruzzi Junior CPP (vicepresident
of integrated security solutions at
G4S in North America) and Volker Wagner
(senior vice-president for Deutsche Telekom).
The Commission quickly received substantial
input and feedback and is already laying out its
strategy. One of its first steps was to create a
dedicated committee focused on research. This
team has begun work on a maturity model
which will help security professionals evaluate
their programmes on the ESRM spectrum.
The maturity model adapts the Capability
Maturity Model Integration process, identifying
five levels of ESRM maturity within a given
organisation. Security professionals will be able
to ask a series of questions regarding ESRM
principles and practices and then rate their
responses. These ratings are key when it comes
to documenting the present state of ESRM
within an organisation, and offer insight into
activities that security professionals can
observe in a bid to improve the state of ESRM.
The Research Committee is working to
develop the first set of ESRM tools before ASIS
International’s Annual Seminar and Exhibits,
which takes place between 25-28 September in
Dallas. The timeline is what might be termed
‘aggressive’, but the Commission believes
developing this type of material for the annual
seminar is vitally important for members.
The working team progressing this material
includes Rachelle Loyear and Tim McCreight
CPP (director of strategic alliances at Above
Security – A Hitachi Group Company), who’s a
member of ASIS International’s Board of
Directors. The small working team will be
augmented by additional members as the
workload increases with time.
Strategic mindset
Future projects will focus on creating material
that security professionals can use in their
organisations to develop a more strategic
mindset for identifying and assessing risks
right across the enterprise. This material will
link to the education and awareness activities
already underway.
ASIS International has begun infusing ESRM
into its programmes. Back in March, ASIS held
‘ASIS Europe 2017 – From Risk to Resilience’ in
Milan. ‘Securing Today’s Connected Enterprise’
was the event’s theme and the two-day
“Working through the phases of an Enterprise Security Risk
Management programme requires greater collaboration
across an organisation. The process also relies on the
security professional ‘learning their business’”
programme brought together CSOs, CISOs and
their team members to assess and address
complex cyber-physical risks. No less than 700
registrants from 48 countries made for an
impressive crowd of both established and
aspiring security leaders with many global
enterprises represented.
Axel Petri (senior vice-president of group
security governance at Deutsche Telekom), who
gave a detailed presentation at ASIS Europe
2017, noted: “With the boundaries between the
physical and the virtual worlds now rapidly
disappearing, how threats are labelled is no
longer relevant (if it was relevant at all). You
just need to know how to stop them.”
Discussions on cyber-physical risks drew
attention to the need for ESRM’s holistic
approach. As Eduard Emde CPP (who has been
named conference chairman for ASIS Europe
2018, which runs in The Hague from 18-20 April)
duly reflected in the closing session: “We find
ourselves faced with questions of ownership,
responsibility and liability. While much debate
has centred on technology risk, we’ve also been
reminded that we cannot forget much more
familiar foes. We were reminded how much risk
stems from the human factor, whether through
ignorance or by malicious intent.”
Additional ESRM-related work by ASIS
International includes offering nearly half a
dozen ESRM sessions as part of the education
line-up at the aforementioned ASIS
International 63rd Annual Seminar and Exhibits.
The first session, entitled ‘IT Security for
Physical Security Professionals in Plain
English’, will be delivered by members of the
ESRM Commission as a pre-seminar session.
It’s designed to enable non-IT security
professionals to understand the challenges and
language of IT security and then be able to go
back to their organisations with the confidence
needed to understand information security
issues and threats and apply their learning.
There have also been multiple articles in the
ASIS journal Security Management, including
the December 2016 front cover story ‘Metrics
and the Maturity Mindset’, in addition to
several well-attended webinars to help explain
the concepts and lay the foundations for the
work to come. Aside from this, the White Paper
‘ESRM: An Holistic Approach to Security’ is the
very heart of the Society’s ESRM initiative.
Godfried Hendriks BSc MBA
CPP RSE: Global Management
and Security Consultant and a
Member of ASIS
International’s Global Board of
Directors
25
www.risk-uk.com