A company-wide cybersecurity strategy is essential to combat today’s evolving risk landscape. This means breaking down silos and encouraging the engagement of security experts throughout different business units. By leveraging collective understanding to expose unknown threats, you can amplify the effectiveness of your security program and technology stack. We call this “Modern Cyber Risk Management”.
Build and Optimize Modern Cyber Risk Management Team
This article will give you what we’ve learned from the best security teams in the world and give you the five steps to build and optimize your modern cyber risk management team.
Read on this article and learn:
- The five steps to building and optimizing a modern cyber risk management team;
- How to leverage technology for effective collaboration around cybersecurity inside your organization and with third parties around the globe;
- How to implement an enterprise-wide communication strategy around cybersecurity, which is key to program success.
Table of contents
Introduction
Is Your Firm Collaborating Effectively?
Identify and Align Cybersecurity with Business Goals
Digital transformation is making firms’ risk profiles more complex
Examining your business from multiple perspectives – what to consider
Set your firm up for success
Explain Cybersecurity to Non-Technical Personnel
Why breaking down knowledge silos is a must for effective remediation
Best practices for communicating with non-security personnel
Leveraging security ratings to enhance collaboration
Work faster, smarter, and “win” together
Collaborate With Third-Party Partners and Vendors
The escalating need for more effective Third-Party Risk Management (TPRM)
Cybersecurity collaboration is key
Save time and speed up remediation efforts
Provide Actionable Insights that Your Executives and Board Can Understand
Board reporting challenges
Finding common ground
Competitive benchmarking
Operationalize your Initiatives to Maintain Visibility and Transparency
Focus on data and actionable insights that matter
How to maximize your cybersecurity ROI
Conclusion
What benefits can you expect from working collaboratively?
Introduction
Over the last decade, cybercrime has moved from being a niche crime to one of the most significant risks to businesses today. New threats are constantly emerging and the number of cyber attack victims is growing every year.
You may have read Deloitte’s 2019 survey on the future of cyber which reported that 95% of respondents experienced a wide range of cyberattacks – with 57% saying those attacks occurred within the last two years. At the same time, global spending on cybersecurity is rising. It will exceed $6 trillion annually by 2021, doubling the $3 trillion spent in 2015.
The expected cost of Norsk Hydro’s 2019 cyber attack is $51 million, which brought production to a halt.
Maybe you’re spending more every year but you aren’t seeing a proportional impact on risk reduction. So what’s going on here?
Your organization might still be operating from the perspective that risk management is a one-time function to be performed single-handedly, rather than a collaborative effort. It’s becoming abundantly clear, however, that organizations are facing risks that threaten every part of the organization. Viewing cybersecurity as “the IT person’s problem” is outdated thinking. Continued reliance on siloed approaches undermines efforts to collectively bring issues to light, slows remediation following a breach, and leaves firms more vulnerable.
If your company is still doing things the old way – you’re not alone. Deloitte found that fewer than 30% of firms are embedding security liaisons into each of their business units.
In 2020, the importance of collaborating on cybersecurity is at an all time high as workforces shift to remote work, accelerating the digital transformation and the need to do more with less. Many organizations are depending on outdated siloed approaches, but this is an enterprise-wide exercise that requires everyone to work together better.
While this article is laid out in steps, you may find that certain aspects of your risk management program may already be in place or that a specific element takes priority before others. To make the most of this article, feel free to jump to the step that is most important to your organization. The key points for each section as below.
Step 1: Identify and Align Cybersecurity with Business Goals
Digital transformation is making firms’ risk profiles even more complex with an expansive vendor landscape and a constantly growing number of endpoint devices in use. It’s a lot to manage! You’ll learn how to think more strategically and ask the right questions about where cybersecurity is needed to set your organization up for success. You’ll start by identifying your company’s revenue and business goals, which internal teams are involved in meeting them, and the key vendors with whom you will need to align your strategy. You’ll then examine how cybersecurity fits in with your existing risk framework to better assist in implementation, which will take place in the coming steps.
Step 2: Explain Cybersecurity to Non-Technical Personnel
Employees don’t always have the same level of understanding about security issues that you do. It’s not something they have to worry about daily, so it doesn’t seem like a pressing issue. It’s your job to make them understand why it’s important. You’ll learn how to make cybersecurity easy to understand, which will empower employees to adopt best practices that make your whole company safer. Also, you will learn about the security tools that can support your process. Leverage these tools to make security a collaborative effort, empowering all of your business units to take ownership of the security of the third parties, vendors, and/or suppliers they onboard.
Step 3: Collaborate With Your Third-Party Vendors & Partners
According to an Opus and Ponemon Institute study, 59% of companies experienced a data breach caused by one of their third parties. Having complete and continuous visibility into your supply chain is critical to reducing the risk of a breach and avoiding costly business interruption. Establishing robust third-party relationships is essential to advancing any vendor risk management program, and technology provides crucial support. You’ll learn how to work together seamlessly with vendors to speed up the cybersecurity questionnaire process, perform faster remediation, and reduce risk.
Step 4: Provide Actionable Insights That Your Executives and Boards Can Understand
There is a growing need to report on cybersecurity measures to management, the board, and external stakeholders. However, boards don’t have time to be concerned with every technical detail of your cybersecurity initiatives. They need to know how cyber risk is affecting business functionality and how to invest in bringing that risk down in a way that is consistent with market trends. For some security leaders, this means hours manually preparing reports for the board. We’ll show you how you can easily pull automated reports using risk rating platforms with all the metrics board members need to know about.
Step 5: Operationalize Your Initiatives to Maintain Visibility and Transparency
You’ll learn how to operationalize your security initiatives across various teams in your organization, and leverage automated solutions to maintain visibility of your programs across every unit, enabling you to optimize threat detection and prioritize response capabilities. Modern risk management requires effective collaboration and seamless integration into your existing processes. By working collaboratively with your internal teams and third parties, you will enable your organization to increase the return on investment (ROI) of your existing tools, reduce risk, and strengthen your compliance posture.
Is Your Firm Collaborating Effectively?
Based on our work with firms across geographies and industries, we’ve observed that remediation time is strongly impacted by one commonly neglected factor – the degree of collaboration between teams. Before going onto Step 1, it is important to understand where your organization stands today. If you’re confident that your company is doing everything it can to collaborate around cyber risk, make sure there aren’t any gaps.
99% of exploited vulnerabilities that are known by security and IT teams for at least one year before they are resolved, according to Gartner. This disturbing statistic reveals that the problem isn’t always in identifying threats, but is in fact due to lack of communication.
The following assumption will help you measure your firm’s baseline level of preparedness when it comes to collaborating and communicating around cybersecurity. Check true or false to see where your organization currently stands, and where there’s room for improvement.*
- Everyone in my organization understands security and how it impacts them directly.
- Everyone in my organization cares about security.
- IT has mapped all of the third-party suppliers that are being used and ensure that all vendors are following proper governance protocols.
- My company’s different business units are collaborating with our internal security experts to ensure that they are working proactively to prevent cybersecurity issues.
- My company’s different business units involve the security team before onboarding a new vendor.
- Security teams are making the best use of security tools and outsourcing when necessary to maximize their capabilities.
- Security teams are working at their highest efficiency.
- Security goals are in line with the company’s revenue goals.
- The executive team and board understand the importance and impact of cybersecurity initiatives.
* If you answered ‘False’ to any of these assumptions, you may not be making the most out of your organization’s expertise, processes, and tools to collaborate and function effectively.
Step 1: Identify and Align Cybersecurity with Business Goals
Digital transformation is making firms’ risk profiles more complex
Your company is not alone in undergoing an accelerated digital transformation. As more and more industries embrace automation to power their business, their cyber risk posture changes drastically. When you consider all of your internal teams, expansive vendor landscapes, and a constantly growing number of endpoint devices in use, there’s a lot to manage. To know what cybersecurity procedures are needed where you’ll need to first examine your business from multiple perspectives.
IoT is everywhere and it’s creating more risk than companies realize In one study, 52% of organizations that maintained an IoT inventory said they had at least 1,000 IoT devices – while the actual average was much higher, at more than 15,000!
You’ll need to zoom out to view the demands of your customers and the marketplace, and zoom in to identify the teams, technology, and applications involved in delivering your goods and services, as well as how cybersecurity aligns with your strategic goals and compliance concerns.
>1 in 4 Executives reporting a lack of awareness of cyber risks associated with the development of new solutions to be their greatest challenge in managing application security risk, according to Deloitte?
Examining your business from multiple perspectives – what to consider
There is no silver bullet for prioritizing cybersecurity strategy in the current digital environment, but these eight recommendations can help security leaders think strategically and ask the right questions about where cybersecurity is needed to set their organization up for success.
28% Firms reporting a lack of clarity in classification of third parties as significant or critical to the business.
Identifying your most critical partners and stakeholders
- Identify internal teams involved
- Identify key vendors (i.e. third parties)
- Establish clear roles and responsibilities for security internally and externally along your supply chain
To determine how to prioritize and implement your cybersecurity procedures, you must first identify your most critical services and trace them back to the vendors and internal teams that are instrumental in providing them. Once you know who your most important teams and partners are, you can prioritize embedding strong cybersecurity practices and policies into those operations.
Rethinking cybersecurity as a business priority
- Identify and map out your company’s overall revenue goals
- Understand what security means for your specific industry
- Align your strategy
Business growth is synonymous with cyber growth. Unfortunately, the implementation of new technology is also accompanied by new risks, and you’ll want to make sure you’re doing everything your competitors are doing to minimize it. Competitive benchmarking will help you identify performance gaps in your cybersecurity approach and ensure that you’re always improving. Allowing your cybersecurity strategy to work synergistically with your business strategy will enhance the integrity of your products and help guarantee regulatory compliance.
Spend smart! According to McKinsey, refocusing investments to your most crucial assets can cut up to 20% of your cybersecurity cost.
Compliance considerations
- Understand your firm’s current risk framework
- Understand how cybersecurity factors into this risk framework, considering industry and geography-specific requirements
The common understanding is key, and there are often gaps between IT teams and senior management. Just as cybersecurity needs to be a risk-management priority at the executive level, security teams need to understand the commercial needs of the organization. What are the minimum requirements for compliance with your industry-specific regulations, such as GDPR, NY DFS, and PCI? You want your risk-appetite to be in line with the regulatory burden of your particular trade. Leverage open communication and a focused strategy so you can be compliant and resilient.
Set your firm up for success
By identifying your company’s revenue goals and the business functions that support them, you now have a better idea of what you need to protect the most. You have a clearer understanding of the aspects of your supply chain as well as the internal structures that are most important to your company’s operations. With this information, you are now better able to determine where and how to deploy your cyber risk management resources. Add in your more robust compliance posture and competitive insights and there’s nowhere to go but up!
Step 2: Explain Cybersecurity to Non-Technical Personnel
Why breaking down knowledge silos is a must for effective remediation
Security requires effective collaboration across multiple teams who all have a role to play in the protection of the firm’s cyber ecosystem. Often, the person who discovers the problem isn’t the one who fixes it or is affected by it.
Although security teams are starting to recognize the importance of continuous collaboration throughout the organization, this concept isn’t put into practice as often as it should be. Departments are conditioned to work independently, which is detrimental to any remediation effort.
As the security champion, you can educate key business stakeholders inside and outside of your organization and get everyone on the same page to reduce risk – even personnel who don’t have deep security expertise.
Overlooked vulnerabilities during M&A deals have enormous costs. In 2017, an acquisition target from the media industry was forced to lower its deal price by $350 million when an attack was revealed between deal announcement and closing.
Best practices for communicating with non-security personnel
Now that we’ve established how important collaboration is, let’s take a look at how to cultivate it within your company. To educate and communicate with non-security teams, the following best practices should be implemented:
- Promote standardized and easy-to-understand terminology across the company
- Group assets by business function or service and assign risk impact by group
- Create a single source of truth for all vulnerabilities
- Share cyber risk and business risk with IT ops and client-facing teams
- Help non-security teams track tasks in their systems
- Automate remediation efforts to shorten the time spent on tracking
- Incorporate risk reduction into everyday processes
Leveraging security ratings to enhance collaboration
By utilizing automated solutions like security rating services, which translate technical cybersecurity issues into an easy-to-understand language, your entire organization will be more equipped to bring issues to light and remediate them faster. Here are some of how security professionals collaborate with every department to make security a team sport:
- Vendor risk managers onboard third parties 75% faster;
- Legal teams incorporate security ratings into vendor contracts as an enforceable metric of their security hygiene;
- Sales and marketing teams stand out against the competition by showcasing their firm’s security rating;
- Finance optimizes the cost of cyber insurance, getting more coverage under their policy;
- Corporate strategy teams better assess the cybersecurity posture of potential acquisition targets;
- And executives quickly understand the ROI of cybersecurity initiatives with all of the metrics they need in an easy-to-understand report.
Work faster, smarter, and “win” together
Maintaining a strong cybersecurity posture is a culturewide core value that relies on constant communication and cooperation among different teams. By encouraging collaboration, you’ll prepare your organization to face today’s threat landscape. With the help of automated tools, such as security ratings, you’ll be able to get an objective look at your cyber health and support company-wide initiatives such as providing a competitive advantage to M&A, sales, and marketing teams through visibility into your firms’ security posture. Having a universally understood security metric shows all of your employees that they are making a difference when it comes to maintaining the company’s cyber health. It’s a win-win for everyone.
Step 3: Collaborate With Third-Party Partners and Vendors
The escalating need for more effective Third-Party Risk Management (TPRM)
Third-party breaches are on the rise. Cybercriminals are actively targeting third-party vendors, knowing that they represent a viable point of entry. In 2019, an online text invitation service that was considered a “low-risk” vendor exposed more than 10 million client and business data files. When you consider all of the vendors that make up your supply chain as well as the fourth-party contractors they employ, there’s a lot of ground to cover! Now, let’s examine what can be done to minimize third-party risk.
Exposed: 100 million client data files. In 2019, an outside party gained access to the servers of a third-party online text invitation service. The breach exposed 100 million client data files. Many companies do not recognize the need to continuously monitor low-risk business partners such as marketing tools, however, and this incident highlights the need for strict and continuous monitoring.
Cybersecurity collaboration is key
Collaboration is a key component in minimizing third-party risk. In its 2019 report, McKinsey recommends establishing a true partnership with your vendors based on active collaboration, rather than a simple transactional relationship. With active collaboration comes more supply chain oversight and faster remediation.
Make sure your TPRM program has the following four key elements:
- Productive, data-driven conversations. Develop an outline of the metrics that will be tracked, specifying KPI’s to keep cooperative efforts productive
- Ongoing communication and engagement. Frequent communication with a common language results in stronger relationships, and more effective remediation.
- Ability to track vendor progress. Give your vendors and your team visibility into posture improvements.
- Use of automation. Reduce the time and resources spent prioritizing and assessing business partners during the cybersecurity questionnaire process.
Save time and speed up remediation efforts
An effective TPRM program should include automation tools that facilitate a strong working partnership between your organization and business partners. Tools like security ratings have an important place throughout the full vendor lifecycle.
At the beginning of the relationship, security ratings help you perform due diligence to gain an understanding of a vendor’s security posture when negotiating a contract. An objective security rating can help you save time when onboarding a new vendor and understand the right questions and controls you need to assess for. Furthermore, they can be leveraged in contract stipulations to specific performance requirements as they relate to security ratings, protecting your business ecosystem. With suppliers you’ve already onboarded and work with, security ratings provide a valuable performance metric that allows you to make informed decisions and perform ongoing assessments at scale, so you know which vendors pose the largest risk and how to prioritize and collaborate on remediation.
Companies that Collaborate With Their Vendors See A Quantifiable Improvement in Their Ecosystem Posture Companies that are invited to the SecurityScorecard Platform with low security grades (C, D, or F) typically exhibit on average a 7 to 8 point improvement within 3 months, while the average score of unengaged companies remains relatively unchanged over the same period.
Maybe you’ve been relying on point-in-time audits to mitigate third-party risk. Utilizing a cybersecurity rating platform can help identify risks that may have slipped through the cracks of a questionnaire-based audit, or that have emerged since the last assessment. Security ratings provide a holistic view of a vendor’s risk by automatically validating their cybersecurity questionnaire responses against objective data.
With a comprehensive view of your partners’ ecosystem and objective metrics to go with it, you are now able to engage in meaningful, fact-driven conversations that allow you to formulate solutions.
32% Demand from CISOs for collaboration tools, guides, training, and operating norms during the Coronavirus Crisis.
Step 4: Provide Actionable Insights that Your Executives and Board Can Understand
Board reporting challenges
The average organizational cost of a data breach in 2019 in the United States was $8.19 million, according to Ponemon.
It’s more important than ever for corporate boards to be driving cybersecurity solutions from the top down. The fallout from a breach can have lasting repercussions, from reputational damage to significant business interruption costs, both of which represent top concerns for board members. Effectively shaping cybersecurity strategy requires an open and effective line of communication between the board and security leaders, who need to present their security findings in a way that informs and supports business growth and risk management.
28% of Respondents in the 2018-19 EY Global Information Security Study reported that their company did not have a comprehensive understanding of information security to fully evaluate cyber risks and preventive measures.
Given the hazards of doing business in the digital age, why is it that CISOs still find reporting to the board of directors to be one of their most difficult tasks?
When presenting your security findings to boards and members of the C-suite, you might not always feel like you’re speaking the same language. Let’s take a look at some common challenges:
- Board members are busy and don’t have time to sift through lengthy reports
- Executives have varying levels of expertise when it comes to security
- Your spending wants and needs may be at odds with budgetary constraints
- Your concerns are largely technical, while the board’s main concerns are the company’s growth, reputation, and financial health
54% of Executives polled in a McKinsey study said that risk reports are too technical.
Finding common ground
CISOs can do their part to bridge the gap by advising boards in an understandable way, with the use of pertinent and actionable supporting data. When presenting reports, this means contextualizing technical information within the board’s business-focused needs.
Here are some ways to get you and your executive teams on the same page:
- Report concisely and only on what is relevant to the board
- Use KPI data to make your case in budgetary discussions
- Share data that demonstrate the ROI on cybersecurity investments to ensure that spending is done in a way that supports your security capabilities
- Present security findings in terms of business risk and market trends to shape the conversation in a way that marries security and business goals
Remember, when it comes to demonstrating threats averted and ROI on security projects, it’s more effective to communicate in terms of resolved incidents, added value, and money saved than to run down exhaustive lists of remediated vulnerabilities.
Competitive benchmarking
Whether it’s financial growth, operational processes, or level of customer service, the need to be better than the competition is always a top-level board concern. When aligning business and cybersecurity goals, boards must not only track internal progress, they also need to know what the competition is doing. Security rating platforms provide an objective look at the posture of your firm as well as that of your competition, so you can work together to strategize your investments and improve your standing in the marketplace.
Guiding board-level discussion and investment surrounding cybersecurity is integral to organizational success. As a security champion, you have the opportunity to use your expertise and technological tools to shape the conversation and bring the data to life.
Step 5: Operationalize your Initiatives to Maintain Visibility and Transparency
Focus on data and actionable insights that matter
Now that you’ve been introduced to some tools and strategies to get your teams firing on all cylinders, by increasing visibility into your ecosystem, aggregating data in a meaningful way, and utilizing automated tools and alerts, you’ll empower teams throughout your organization to collaborate effectively on cybersecurity initiatives.
How to maximize your cybersecurity ROI
Here are four ways to get the most out of your existing cybersecurity investments and strategy:
Get more visibility from your existing tools
Modernizing your cybersecurity approach doesn’t have to mean tearing it down and rebuilding from scratch; it means boosting your ROI. Integrating security ratings into your existing framework is a great way to enhance visibility into your company’s overall security performance. As a data-driven and objective measure of performance, security ratings can boost your existing strategy by adding transparency where it may have previously been lacking.
Modernize your approach with curated threat intelligence
For many security leaders, manually gathering cyber threat intelligence is an overwhelming and time-intensive task that often produces imprecise data. We have found that many companies produce data that is either too granular or overly customized and doesn’t enable effective decision making across teams. You want your threat intelligence to promote efficiency so that teams can collaborate and act quickly.
We recommend modernizing your approach with curated intelligence in a cybersecurity dashboard. Dashboards enable you to effectively identify patterns within large amounts of data and display meaningful information such as the most critical and common risks. If you’re a manager looking to streamline your remediation efforts, you can easily drill down into the data, prioritize your remediation, and devote your limited resources to only what is relevant.
Did you know that threat intelligence reduces the cost of a data breach? The Ponemon Institute found threat intelligence sharing to be a mitigating factor in the overall cost of a data breach, and according to SANS, accurate and timely threat intelligence should be a key input for optimizing security practices.
Leverage automation
Cybersecurity is a constantly shifting landscape. As bad actors continually adopt more sophisticated methods, you’ll need to ensure that you have the same advantages to mount your defense. Enabling a rapid response is essential to minimizing the impact of a data breach. Automated cybersecurity solutions, such as security rating platforms, continuously monitor for vulnerabilities, and alert your team to weaknesses within your organization and your third-party ecosystem. With accurate real-time alerts, you can focus on the most critical activities.
Go beyond “checking the compliance box”
Data transparency is essential in verifying that your internal teams and vendors are doing their part to maintain collective cyber health. Without internal visibility into your security posture, you’re rolling the dice with auditors and regulatory agencies. In both instances, having a common source of objective data to draw upon drives more effective decision making and collaboration between you, your internal teams, and your vendors. Look for platforms that allow you to stay audit-ready by combining continuous monitoring with features that automatically map to compliance frameworks, so you can easily assess the maturity of your compliance posture.
34% of Security professionals polled at Infosecurity Europe 2019 said they wouldn’t necessarily disclose a public exposure of cloud data if they didn’t think hackers gained access. Without transparency, you risk leaving judgment calls that impact your organization in the hands of others.
Stay current to stay prepared
In today’s fast-paced threat landscape, it can be hard to keep up. The right technology stack can help you maximize your cybersecurity ROI and ensure that your time and effort don’t go to waste. Dynamic and automated threat analysis capabilities are the easiest and most effective way to stay ahead. Having these tools built into all of your business units also allows for easier communication internally, so you can work together to quickly and effectively neutralize threats. The
Conclusion
What’s next?
Go back to the assumption you took at the beginning to understand where your organization stands. By knowing your firm’s baseline, you can focus on the areas where collaboration is needed most. Once you have pinpointed your area of focus, outline your goals. Revisit the 5 steps and the specific sections that are most important to you.
Need a refresher? Here are the 5 proven steps to building and optimizing your Modern Cyber Risk Management team.
Step 1: Identify and Align Cybersecurity with Business Goals
Identify your organization’s business revenue and business goals as well as which internal teams are involved in meeting them. Examine how cybersecurity can be built into your organization’s overall strategy to set your organization up for success.
Step 2: Explain Cybersecurity to Non-Technical Personnel
As you already know, cybersecurity is a value that needs to be adopted enterprise-wide. It is your job to educate and empower your firm to understand, care about, and embrace cybersecurity practices. One key component in achieving this is creating an easy-to-understand language around cybersecurity, making it an inclusive topic for everyone.
Step 3: Collaborate with Your Third-Party Vendors and Partners
In today’s interconnected business environment, threats can originate from your third-party ecosystem, outside of your organization’s perimeter. Therefore, you need a sound and scalable strategy to continuously monitor your business partners and collaborate with them to mitigate risk.
Step 4: Provide Actionable Insights that Your Executives and Board Understand
Boards and executive leadership seek more information about cybersecurity than ever before. They need to be quickly brought up to speed on how cyber risk affects business operations. We showed you how to streamline the reporting process and leverage automated platforms to build reports with all of the metrics your leadership cares about in minutes.
Step 5: Operationalize Your Initiatives to Maintain Visibility and Transparency
You’ve put in all of the work to build a modern and collaborative cybersecurity program. The final step of optimizing your modern cyber risk management team is creating seamless processes around it. We showed you how to leverage integrations, maintain transparency across your initiatives, and utilize automation to help you aggregate data in a meaningful way and optimize threat response.
What benefits can you expect from working collaboratively?
We’ve seen how modern cyber risk management impacts every team in an organization. By collaborating on cybersecurity:
- Vendor risk management teams onboard third parties 75% faster.
- Legal ensures 100% of cybersecurity liability to vendors in contracts.
- Finance teams increase the value of cyber insurance by getting more coverage for the same price.
- Sales decrease time to close by several weeks by leveraging cybersecurity hygiene upfront.
- Marketing stands out against the competition with objective security ratings to benchmark their cybersecurity hygiene.
- Preparing reports for Executives and the Board of Directors goes down to minutes, helping them understand the ROI of cybersecurity initiatives.
- Security teams maintain an up-to-date inventory of their digital footprint, optimizing pen tests, and other cybersecurity initiatives.
- IT teams maintain control over their firm’s cybersecurity hygiene and automate tasks based on rating changes, saving hours by prioritizing risk.
Source: SecurityScorecard
