Developing a Cyber Risk Management Strategy for Enterprise Resilience

Why cyber risk is now a boardroom conversation

Most senior leaders understand that cyberattacks happen, but fewer have internalised what a breach actually costs their specific organisation.

The global average cost of a data breach reached $4.88 million in 2024 according to IBM’s annual report, but averages obscure more than they reveal. A healthcare breach runs closer to $9.8 million, and a financial services breach can trigger regulatory scrutiny that can drag on for years.

The shift from IT problem to business problem happened gradually, then all at once. Three forces drove it:

Threats are external (such as a ransomware group targeting your sector), while vulnerabilities are internal (for example, an unpatched server, a misconfigured API gateway, or an employee clicking a phishing link). A threat without a corresponding vulnerability is theoretical, but a vulnerability without an active threat is a ticking clock.

Cyber risk management lives at the intersection, quantifying where threats meet vulnerabilities and prioritising responses based on business impact rather than technical severity alone.

The organisations that treat cyber risk as a strategic function, reported to the board with the same rigour as financial risk or operational risk, consistently recover faster and lose less when incidents occur.

The four pillars of an effective risk management strategy

A workable cyber risk management strategy operates as a cycle, not a checklist. Four pillars support it, and weakness in any one of them undermines the others.

Risk identification

You cannot protect what you have not mapped. Risk identification means cataloguing every information system, data repository, third-party integration, and process that touches sensitive information. This includes shadow IT, the SaaS tools teams adopted without formal approval, the test environments that never got decommissioned, and the API keys hardcoded into legacy applications.

Most organisations undercount their assets on first pass. A structured asset inventory, updated continuously rather than annually, is the prerequisite for everything else.

Beyond assets, identification means understanding the threat actors relevant to your industry. A regional bank faces different adversaries than a medical device manufacturer. Threat intelligence feeds, industry-specific ISACs (Information Sharing and Analysis Centres), and red team exercises all contribute to a realistic threat picture.

Risk assessment and prioritisation

Not all risks deserve equal attention. Assessment evaluates each identified risk along the likelihood of occurrence and potential business impact. The output is a prioritised risk register that tells leadership where to allocate limited resources.

This is where many organisations stumble. Technical teams tend to prioritise based on CVSS scores (how severe a vulnerability is technically), while business leaders care about revenue impact, regulatory consequences, and customer trust. Effective risk assessment bridges both perspectives.

Qualitative methods (like high/medium/low ratings) work for initial triage, whereas Quantitative methods, like the FAIR (Factor Analysis of Information Risk) model, translate risks into dollar figures that finance teams and boards can evaluate alongside other business risks. We have found that organisations using quantitative risk assessment make more defensible investment decisions. However, quantitative risk assessments are often more difficult to run and more time consuming as well, which is why most organisations use general, high/medium/low ratings.

Risk mitigation and controls

Once risks are prioritised, mitigation strategies fall into four categories: accept, avoid, transfer, or reduce.

Most mitigation effort falls into the ‘reduce’ category. Controls range from technical (endpoint detection, network segmentation, encryption at rest and in transit) to administrative (security awareness training, access review policies, vendor risk assessments) to physical (data centre access controls, device management).

The mistake we see most often is that organisations invest heavily in prevention and underinvest in detection and response. Prevention eventually fails, so the question is whether you detect the failure in minutes or months.

Risk monitoring and continuous improvement

A risk management strategy that is not continuously monitored is just a document. Monitoring means tracking key risk indicators (KRIs), reviewing the effectiveness of controls, and updating the risk register as the environment changes.

An incident response plan sits within this pillar. The plan should be tested through tabletop exercises at least twice a year, involving not just the security team but also legal, communications, and executive leadership.

Continuous improvement means feeding lessons from incidents, near-misses, and industry events back into the identification and assessment process, then repeating this cycle.

Choosing your cybersecurity risk management framework

Frameworks provide structure, preventing you from building a strategy based solely on intuition or the latest vendor pitch. But choosing the right one depends on your organisation’s regulatory environment, maturity level, and strategic goals.

NIST Cybersecurity Framework (CSF)

The NIST CSF organises security activities into six functions:

Its strength is flexibility. The framework is outcome-based rather than prescriptive, meaning it tells you what to achieve without dictating exactly how. This makes it adaptable across industries and organisation sizes.

The CSF also uses implementation tiers (Partial, Risk-Informed, Repeatable, Adaptive) that help organisations benchmark their current maturity and set realistic improvement targets. CSF is recommended as a starting point for organisations that need to build a security program from a moderate baseline, particularly in technology and financial services.

NIST Risk Management Framework (RMF)

The RMF is more prescriptive than the CSF. It is structured around a seven-step process:

Originally designed for federal agencies, it is well suited to organisations in highly regulated environments that need documented, auditable control selection and authorisation processes.

The trade-off, however, is overhead. RMF requires more administrative rigor, which can slow down teams accustomed to agile development cycles.

ISO/IEC 27001

ISO 27001 provides a specification for an information security management system (ISMS). Unlike the NIST frameworks, it is certifiable, meaning a third-party auditor can formally assess and certify your compliance, which is important when customers, partners, or regulators demand demonstrable proof of security practices.

The standard covers risk assessment, treatment, and a set of controls outlined in Annex A (updated in the 2022 revision). It is widely recognised internationally, making it particularly valuable for organisations operating across multiple jurisdictions.

COSO ERM Framework

COSO’s Enterprise Risk Management framework is not cybersecurity-specific, but it is relevant here because it provides the structure for integrating cyber risk into broader business risk management. COSO ERM organises risk management around five components:

For organisations looking to connect their cyber risk program to enterprise risk governance (which, as we will discuss next, is where the real strategic value lies), COSO provides the connective tissue.

How to choose

If you are building a security programme and want something flexible, NIST CSF is a good place to start. If you need to demonstrate compliance to customers, regulators or partners, ISO 27001 may be the better fit. Organisations working in the U.S. federal space will often need to follow RMF requirements. And if you want to bring cyber risk into your wider business risk management, COSO ERM can sit alongside your cybersecurity framework.

These are not mutually exclusive, though. Many mature organisations map their controls to multiple frameworks simultaneously, using a common control set as the baseline.

Integrating cyber risk with ERM

Many people make the mistake of treating cyber risk management as a standalone program, staffed by the security team, reported through the CISO, and disconnected from how the organisation manages financial, operational, strategic, and compliance risks.

This isolation creates blind spots. A product launch that accelerates time-to-market might introduce API vulnerabilities that the security team discovers only after deployment. Or, a cost-cutting initiative that consolidates data centers might concentrate risk in ways the CFO never considered. When cyber risk lives in a silo, these trade-offs do not surface until something breaks.

Integrating cyber risk into enterprise risk management (ERM) solves this by placing cyber risks on the same register, evaluated with the same methodology, and reported to the same governance structures as every other business risk.

Practical steps to integrate cyber risk with ERM

Adopt a common risk taxonomy

Describe cyber risks in business terms (revenue impact, regulatory exposure, customer churn) rather than technical jargon (CVE numbers, CVSS scores), so they are accessible to a broader audience without losing technical detail.

Establish a unified risk register

Cyber risks appear alongside supply chain, market, and operational risks. This enables leadership to make comparative resource allocation decisions. Is the $500K investment in network segmentation a better use of capital than the $500K investment in supply chain diversification? You can only answer that question if both risks are assessed on the same scale.

Create a cross-functional risk committee

Include the CISO alongside the CFO, COO, and General Counsel in regular risk review meetings. Cyber risk decisions benefit from business context, and business decisions benefit from security awareness.

Align reporting to the board

Board-level reporting should present cyber risk in the context of strategic objectives, not as a separate security briefing. Dashboards that show risk exposure relative to risk appetite, mapped to business outcomes, drive better decisions than slide decks full of patch compliance metrics.

Building the business case for a cyber risk management plan

Every senior leader asks how much you should spend, and the honest answer is unsatisfying, because it always depends.

A more useful approach starts with the risk register. If your quantitative risk assessment identifies $50 million in annualised loss exposure across your top 20 risks, and proposed controls can reduce that exposure to $15 million at a cost of $5 million, the math is straightforward.

Measuring ROI

Traditional ROI calculations do not map cleanly to security because the ‘return’ is a loss avoided, which is inherently hypothetical. Two frameworks help make the case:

Annualised Loss Expectancy (ALE)

ALE equals the Single Loss Expectancy (what one incident costs) multiplied by the Annual Rate of Occurrence (how often it’s expected to happen). If a specific type of breach would cost $2 million and is expected to occur once every four years, the ALE is $500,000. Any control that costs less than $500,000 annually and effectively prevents that breach category delivers positive ROI.

Risk Reduction as a Percentage

After implementing a control, reassess the ALE. The difference between pre-control and post-control ALE, minus the cost of the control, is your net risk reduction value. This translates directly into financial terms that CFOs and boards understand.

Beyond direct financial return

Some security investments do not fit neatly into ALE calculations but deliver measurable business value:

Presenting to the board

Drop the technical jargon and present cyber risk investment alongside other business investments using the same financial metrics. Show the current risk exposure, the proposed investment, the projected residual risk, and the net value delivered. If the board approves capital expenditures for physical plant safety based on expected loss avoidance, the same logic applies to cybersecurity.

Partnering for a resilient future

Cyber risk management is a continuous business function that demands the right mix of technology, process, and expertise. Most organisations have some of these elements but struggle to bring them together into a coherent strategy, especially while simultaneously driving digital transformation.

This is where having the right partner changes the equation. At Infinum, we work with enterprise leaders to design and implement security strategies that are grounded in business outcomes. We help clients identify their actual risk exposure (not just run a vulnerability scanner), select and implement the right frameworks, integrate cyber risk into broader enterprise risk programs, and build the business case that gets board-level buy-in.

We start with your strategic objectives, map the technology and threat environment, and build a risk management capability that scales as your organisation grows. Whether you are modernising legacy systems, deploying IoT at scale, or integrating AI into your products, we ensure security is architected in from the beginning rather than bolted on after launch.

The organisations that treat cybersecurity as a proactive, strategic investment consistently outperform those that react to incidents after the damage is done.

If your current approach has gaps, or if you are not sure where the gaps are, that’s exactly the conversation we want to have.