The NIST 800-53 Specialist Training Program
Business goals may include organizing the company to make it more efficient and profitable, or to redefine our target market to three major areas. One of our key business goals must be to reduce the risk of a data breach, the loss of intellectual property, the compromise of valuable research data, or the protection of employee and customer information. To be successful, we require a business focused cyber-risk management program that includes a complete understanding of business activities and the potential risk to the organization if a bad actor compromises one or more of these activities.
Technology goals start with the identified business activities. What technology underpins enables, supports, or delivers each business activity? To understand security control requirements, we must first identify how the system supports the business activity and the impact on the business if a bad actor compromises the system. It is essential to consider the risks associated with our systems, applications, and processing environment.
