How we operationalize security risk assessments at Vanta

This post is part of an ongoing series where you’ll hear directly from Vanta’s own Security, Enterprise Engineering, and Privacy, Risk, & Compliance Teams to learn about the team’s approach to keeping Vanta—and most importantly, our customers—secure. In today’s post, you’ll hear from Rob Picard, who leads Vanta’s Security team, and Matt Cooper, who leads Vanta’s Privacy, Risk, & Compliance team.

‍

Why security risk assessments are important

Risk assessments are exercises that help an organization understand, analyze, and address the most significant risks to their objectives. By approaching these exercises with a little formality, we can better respond and make sure that our risk treatment plans don’t fall through the cracks.

‍

What would prevent your organization from achieving its objectives or missing opportunities? What are known weaknesses or vulnerabilities within your environment? How will you address or accept these? Conducting formal risk assessments helps you uncover and understand these answers before adverse events happen (or your auditor points them out).

‍

As Vanta continues to grow, our internal Security and Privacy, Risk, & Compliance teams have worked together to develop a methodology for conducting information security risk assessments, both on a defined cadence and on an as-needed basis. Our goal for this post is to share more detail about our approach to operationalizing our security risk assessments, as well as tips for getting started if you’re new to risk assessments.

‍

How to approach security risk assessments

It’s important to remember that security risk assessments aren’t one-size-fits-all. How you structure your risk assessments will depend on what works for your culture and your objectives. In general, industry best practices and just about any compliance framework you’re implementing recommend that formal risk assessments should be conducted at least annually.

‍

Assessing risk is a skill that can be embedded in many processes throughout your organization. While you might commit to a thorough enterprise-level risk assessment on an annual basis, risk should be considered for all projects and initiatives your organization undertakes. This can be baked into your product development lifecycle, business change processes, changes to technical infrastructure, and more. 

‍

Importantly, if you’ve identified risks on an at-least annual basis, be sure to consider these (and remind teams who may own specific risks) to incorporate these when planning for future work. More specifically, teams should plan specific work or allocate a certain percentage of their bandwidth to address or reduce significant risks that have been identified.

‍

How Vanta operationalizes security risk assessments

Models for risk assessment differ by team and organization depending on how risk assessments are used. Vanta runs our enterprise-wide security risk assessment on an annual basis, and we incorporate considerations of risk throughout our daily workflows and processes. 

‍

Here are a few specific lessons we’ve learned while implementing this for our business:

‍

• Process and cadence: First, determine the most appropriate process and cadence to run your risk assessment. This will include updating your assessment document and defining a risk treatment plan for each identified risk. If you don’t have a specific cadence in mind, consider starting with a quarterly cadence, which can always be adjusted to be more or less frequent depending on your needs and goals. 
• Tracking: Determine how you’ll track the work that comes out of your risk assessment, whether manually in a spreadsheet or fed into a ticketing system like Jira. This helps you understand the volume of potential work required to track discussions, decisions, and next steps with the action items that derive from a risk assessment.
• Definitions: Define your criteria for what constitutes a risk. For instance, if you’re a small business, you may have a different threshold than a large enterprise for what constitutes a risk. In addition, it helps to consider the levels of impact that a risk could pose to your business, as well as the likelihood of occurrence. Here’s an example of how we’ve defined these levels at Vanta:

‍

• Structure: Decide if you’ll incorporate more frequent, smaller risk assessment activities into your risk assessment document and if so, how. You may also opt to only conduct one larger risk assessment per year instead of more frequent assessments.
• Audience: Consider your audience — for instance, is your risk assessment primarily for compliance purposes or internal purposes to manage business risk? If for compliance, you might opt to update this less frequently but ensure you have a thorough, comprehensive review prior to kicking off your audits. If it’s for your business, you might consider a process that’s more iterative and dynamic, with greater availability to your team so more stakeholders are able to interact with your risk assessment project. In addition, you’ll likely want an integration with whichever ticketing platform makes most sense, which not only helps with tracking but also enables your teams to tie their work to reducing business risk. 

‍

Guidance for presenting risk assessments

After conducting your risk assessment, you’ll want to determine who to share the results with — it’s common to share your findings with a leadership or executive team.

‍

When presenting your risk assessment, be mindful of your audience and practical outcomes, and remember that less is usually more. For instance, distilling your risks to a focused, prioritized list of higher-level risks is more digestible and impactful for a senior manager or leadership team than enumerating dozens of granular risks. 

‍

In addition, consider who will be presenting or part of the presentation. In general, those who were involved in conducting the risk assessment should either be part of the presentation or have rigorously prepped the presentation team. This is because it’s important to be able to understand the level of detail needed to support questions at a tactical level, particularly from an executive or leadership team.

‍

And finally, be sure you’ve already defined thorough risk solution plans for each identified risk before presenting. As with any challenges you’re presenting to an executive team, remember that their role is to provide oversight, not to ask them to actually conduct the risk assessment work or arrive at solutions themselves. 

‍

Tips for getting started

While every company and organization’s approach to operationalizing risk assessments may differ, here are a few tips from Vanta’s Security and Privacy, Risk, & Compliance teams:

‍

Remember that you don’t have to boil the ocean: You can start by creating a security risk assessment that will fundamentally meet your compliance objectives and will help set an annual checkpoint for the business

‍

How to get started: It can help to use a tool like Vanta to conduct your risk assessment in a systematic way. In any case, you can start with the following steps:

‍

1. Ask a simple question of your leadership team and managers: “From an information security perspective, what situations would be bad for our business? What are you worried about?”
2. Regardless of likelihood or impact, these can be defined as threat scenarios — be sure to incorporate any additional technical detail needed.
3. Once you’ve gathered your threat scenarios, you can turn these into a formalized risk scenario by including an event and an outcome, e.g. “Employee installs malicious remote access tool, leading to breach of customer or company data.”
4. For each threat scenario, identify the controls you have in place to ensure it doesn’t happen, as well as the known vulnerabilities. Remember that vulnerabilities may not always be technical — they can also be factors of your environment that make the threat scenario more realistic or concerning.
5. Next, discuss the potential impact this threat scenario could have, as well as how likely it is to occur. You can rate these in a way that makes sense for your organization, whether on a scale of low to high, 1-3, or otherwise.
6. Finally, discuss and capture what you’ll do about this scenario — for instance, you may decide to accept, transfer, mitigate, or avoid the risk as an organization.

‍

Interested in learning more? Read more from Matt Cooper about how to work backward from the controls to perform an information security risk assessment. 

‍