Summary

At the beginning of this chapter, we learned about the relationship between IT governance and risk. We learned about the IT strategy and how the IT risk strategy acts as a supporting mechanism for achieving business objectives. We then learned about the relationship between threats, vulnerabilities, assets, risks, and the IT risk management life cycle. Then, we learned about the importance of organizational structure and setting the tone for risk management from the top and how is it related to the organizational culture. Finally, we learned about policy documentation and the importance of asset classification and labeling for implementing appropriate controls per the asset valuation.

In the next chapter, we will look at the importance of three lines of defense in cybersecurity and why is it required to establish accountability and avoid conflicts of interest.