<p>At the end of my last post, I promised to provide visibility into categories and types of risk, and to provide visibility emphasis into Cyber Risks and their systemic interconnectedness with and potential impacts on business operations. This will take more</p><p>The most important consideration to fully embrace in understanding Risk to your Business today is that Digital and Information Technology Systems are the lifeblood of your business. Even the simplest “mom and pop business” utilizes information technology, online tools, and services today.</p><p><strong>Cyber Insecurity creates the opportunity for Business Interruption</strong></p><p><strong>Cybersecurity is a Business Decision</strong></p><p>To start, let’s first explore categories of risk to your business.</p><ul><li>Strategic Risks</li><li>Operational Risks</li><li>Financial Risks</li><li>Hazard Risks</li></ul><p><strong>Strategic risks</strong> are the things that can harm your business in a manner that impedes your business’s ability to achieve its strategic goals and objectives.&nbsp;</p><p><strong>Operational risks</strong> are the things that can prevent your business from carrying out day-to-day operational activities in either small or large ways.</p><p><strong>Financial risks</strong> are the things that have the potential to harm your business’s financials.&nbsp;</p><p><strong>Hazard risks</strong> can harm your business’s physical assets and employees and contractors.</p><p>Every business faces a large list of risks in each of these categories.</p><div style="display:flex;flex-wrap:wrap;gap:20px;justify-content:center;"><!-- Strategic Risks --><div style="border:1px solid #000000;padding:10px;width:220px;"><ul style="list-style-type:none;margin:0;padding-left:15px;"><li>Strategic Risks</li><li style="color:#f58220;">● <span style="color:black;">Political</span></li><li style="color:#f58220;">● <span style="color:black;">Economic</span></li><li style="color:#f58220;">● <span style="color:black;">Regulatory</span></li><li style="color:#f58220;">● <span style="color:black;">Market</span></li><li style="color:#f58220;">● <span style="color:black;">Reputation</span></li><li style="color:#f58220;">● <span style="color:black;">Leadership</span></li><li style="color:#f58220;">● <span style="color:black;">Brand</span></li><li style="color:#f58220;">● <span style="color:black;">Customer</span></li><li style="color:#f58220;">● <span style="color:black;">Mergers &amp; Acquisitions</span></li><li style="color:#f58220;">● <span style="color:black;">Etc.</span></li></ul></div><!-- Operational Risks --><div style="border:1px solid #000000;padding:10px;width:220px;"><ul style="list-style-type:none;margin:0;padding-left:15px;"><li>Operational Risks</li><li style="color:#f58220;">● <span style="color:black;">Human Resource</span></li><li style="color:#f58220;">● <span style="color:black;">Business Process</span></li><li style="color:#f58220;">● <span style="color:black;">Technology</span></li><li style="color:#f58220;">● <span style="color:black;">Supply Chain</span></li><li style="color:#f58220;">● <span style="color:black;">Business Continuity</span></li><li style="color:#f58220;">● <span style="color:black;">Channel Effectiveness</span></li><li style="color:#f58220;">● <span style="color:black;">Customer Satisfaction</span></li><li style="color:#f58220;">● <span style="color:black;">Health and Safety</span></li><li style="color:#f58220;">● <span style="color:black;">Environment</span></li><li style="color:#f58220;">● <span style="color:black;">Product and Service</span></li><li style="color:#f58220;">● <span style="color:black;">Efficiency</span></li><li style="color:#f58220;">● <span style="color:black;">Capacity</span></li><li style="color:#f58220;">● <span style="color:black;">Compliance</span></li><li style="color:#f58220;">● <span style="color:black;">Etc.</span></li></ul></div><!-- Financial Risks --><div style="border:1px solid #000000;padding:10px;width:220px;"><ul style="list-style-type:none;margin:0;padding-left:15px;"><li>Financial Risks</li><li style="color:#f58220;">● <span style="color:black;">Volatility</span></li><li style="color:#f58220;">● <span style="color:black;">Currencies</span></li><li style="color:#f58220;">● <span style="color:black;">Interest Rates</span></li><li style="color:#f58220;">● <span style="color:black;">Commodities</span></li><li style="color:#f58220;">● <span style="color:black;">Credit</span></li><li style="color:#f58220;">● <span style="color:black;">Liquidity</span></li><li style="color:#f58220;">● <span style="color:black;">Market</span></li><li style="color:#f58220;">● <span style="color:black;">Compliance</span></li><li style="color:#f58220;">● <span style="color:black;">Legal</span></li><li style="color:#f58220;">● <span style="color:black;">Etc.</span></li></ul></div><!-- Hazard Risks --><div style="border:1px solid #000000;padding:10px;width:220px;"><ul style="list-style-type:none;margin:0;padding-left:15px;"><li>Hazard Risks</li><li style="color:#f58220;">● <span style="color:black;">Natural Disasters</span></li><li style="color:#f58220;">● <span style="color:black;">Terrorism</span></li><li style="color:#f58220;">● <span style="color:black;">Shooter Events</span></li><li style="color:#f58220;">● <span style="color:black;">Insurable Liabilities</span></li><li style="color:#f58220;">● <span style="color:black;">Impairment of Assets</span></li><li style="color:#f58220;">● <span style="color:black;">Health / Pandemic</span></li><li style="color:#f58220;">● <span style="color:black;">Etc.</span></li></ul></div></div><p>If you start to feel that risks surround your business, you are not alone. James M. Kaplan et al. l, in their book “Beyond Cybersecurity, Protecting Your Digital Business”, provides extensive exposure to how every company is surrounded by risk.</p><p>The risk your company faces is also not yours alone; it extends and is extended to your company from throughout your extended business chain or value chain, including to and from you and your suppliers, customers, and attackers.</p><p>The<strong> World Economic Forum “Global Risks Report 2023”</strong> (in partnership with Marsh McLennan and Zurich Insurance Group) continues to report year after year that widespread cybercrime and cyber insecurity are among the top ten <strong>Global Risks in the short term (2 years) and long term (10 years). </strong>WEF reports, <em>“Alongside a rise in cybercrime, attempts to disrupt critical technology-enabled resources and services will become more common, with attacks anticipated against agriculture and water, financial systems, public security, transport, energy, and domestic space-based and undersea communications infrastructure. Technological risks are not solely limited to rouge actors. Sophisticated analysis of larger data sets will enable the misuse of personal information through legitimate legal mechanism, weakening individual digital sovereignty and the right to privacy, even in well-regulated democratic regimes.”</em> Business participants in this report rated the severity of Widespread Cybercrime and Cyber Insecurity as their fourth highest concern (rating Cost-of-Living, Natural Disasters and Extreme Weather, and Geoeconomic Confrontation as higher concerns).</p><p>Let’s get back to Cybersecurity and Cyber Insecurity: the <strong>Allianz Risk Barometer 2023</strong> (prepared and published by the Allianz Global Corporate and Specialty Insurance company) reports that the #1 most important global business risk of concern to their clients is Cyber Incidents, including cybercrime, malware and ransomware causing system downtime, data breaches, fines, and penalties.</p><p>The Allianz Risk Barometer 2023 reports that <strong>Business Interruption</strong> is the most feared business risk, reflecting ongoing concern for the disruption caused by ransomware attacks, IT system, and cloud outages, and the threat of cyber war. “Severe Business Interruption can result from a wide range of cyber-related triggers, including malicious attacks by criminals or state-backed hackers, human error, or technical glitches. Allianz’s analysis of cyber-related insurance industry claims that it has been involved with over the past five years, Business Interruption is the main cost driver for 57% of claims globally and is a significant driver for the rising severity of claims, including from ransomware attacks, which have proliferated in recent years. Hackers increasingly target both digital and physical supply chains providing opportunities to simultaneously attack multiple companies and gain additional leverage for extortion. Cyber Business Interruption exposures are also growing with the trend for digitalization, as companies introduce new technology and live with the legacy of aging IT infrastructure and software.”</p><p><strong>Cyber Insecurity / Cybercrime triggered Business Interruption is the most feared of all Risks.</strong></p><p>Cyber Insecurity / Cybercrime enabled Business Interruption is the most feared of all Business Risks today because of the pervasive and persistent integration of digital and information technology systems within and between our business partners, customers, suppliers, employees and their families. The physical infrastructures supporting our businesses include electrical grids, water supplies, transportation systems and networks (trains, planes and automobiles), food sources and supplies, etc. There is no aspect of our business and personal lives which are not Cyber interconnected today.</p><p><strong>Cyber Connectedness is Pervasive</strong></p><p><strong>Cyber Business Interruptions, as a result, are Pervasive and Impactful.</strong></p><p>Risk is an integral part of any business. Risk is also an essential part of any business investment decision.</p><p><strong>Risk + Investment should yield Desired Business Outcomes.</strong></p><p>Thus: <strong>Cybersecurity is a Business Decision</strong></p><p>This is why in my last blog post, I asked you to consider two questions:</p><ol><li>How much security do you need?</li><li>As a business, what can you live without?</li></ol><p>I also suggested that you could ask yourself a series of questions to help wrap your mind around “risk event triggered” loss with these questions:</p><ul><li>Can your business survive a complete shutdown of business operations for 1 day?</li><li>Can your business survive a complete shutdown of business operations for 7 days?</li><li>Can your business survive a complete shutdown of business operations for 14 days?</li><li>Can your business survive a complete shutdown of business operations for 21 days?</li><li>Can your business survive a complete shutdown of business operations for 28 days?</li></ul><p>Also, as you consider the answers to these questions, you will most likely begin to “qualify” your answers from your perspective of “impacts” or impacts to your business or parts of your business.</p><p>In my next blog post, I will introduce the notion that we are all Risk Managers, taught by our parents and caregivers from birth. I will also share perspectives on understanding Threats and creating a Threat Catalog. This will set the stage to discuss how you may make decisions about how much security you need and, as a business, what you can live without. Along the way, I promise to further explore the emerging risk management model utilizing a fully integrative approach to identifying risk from a corporate director’s and senior leader’s perspective, which can be found in the DIRECTOR™ and RISCX™ Models.</p><p>Feedback and comments are welcome, as well as any specific Cybersecurity or Cyber Insecurity topic you might want me to comment upon.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>