- The SCR-RMM is a risk management model that places controls at the center of all GRC activities.
- Controls are the nexus of a cybersecurity program since policies, standards, procedures, metrics, threats, and risks all map to controls.
- The model enables holistic risk management at the control level rather than at the system or business process level alone.
- Risk and threat catalogs are mapped directly to SCF controls, creating a clear chain from threat to safeguard.
- The SCR-RMM is a free resource from the Secure Controls Framework.
The SCR-RMM Model
The Secure, Compliant & Resilient Risk Management Model (SCR-RMM) is built directly into the Secure Controls Framework (SCF). The concept of creating the SCR-RMM was to create an efficient methodology to identify, assess, report and mitigate risk. This project was approached from the perspective of asking the question, “How should I management risk?” and was a collaboration between ComplianceForge and the SCF.
The SCR-RMM takes a holistic approach to controls, risks and threats as a way to reduce or eliminate the traditional Fear, Uncertainty and Doubt (FUD) that makes many risk assessments meaningless. The SCR-RMM is free to use and is licensed under the Creative Commons licensing model. This means that when a control is assessed, you simultaneously understand its compliance status (via policies and standards), its operational effectiveness (via procedures and metrics), and its risk posture (via threats and risks mapped to that control).
Cybersecurity Risk Management Requirements
All organizations have a need to manage risk. Most organizations are compelled to management risk and these requirements come from a broad range of statutory, regulatory and contractual origins. Regardless of your industry, requirements to manage cybersecurity risk exist and failing to manage risk could leave your organization exposed to liabilities from non-compliance:
In risk management, the old adage of “the path to hell is paved with good intentions” is very applicable. The reason for this is all too often, risk management personnel are tasked with generating risk assessments and creating the questions to ask in those assessments without having a centralized set of organization-wide cybersecurity and privacy controls to work from. This generally leads to risk teams making up risks and asking questions that are not supported by the organization’s policies and standards. For example, an organization is an “ISO shop” that operates an ISO 27002-based Information Security Management System (ISMS) to govern its policies and standards, but its risk team is asking questions about NIST SP 800-53 or 800-171 controls that are not applicable to the organization. This scenario of “making up risks” points to a few security program governance issues:
- If the need for additional controls to cover risks is legitimate, then the organization is improperly scoped and does not have the appropriate cybersecurity and privacy controls to address its applicable statutory, regulatory, contractual or industry-expected practices.
- If the organization is properly scoped, then the risk team is essentially making up requirements that are not supported by the organization’s policies and standards.
Cybersecurity Risk Management Requirements
The SCR-RMM breaks risk management down into 17 distinctive steps, providing coverage from start to finish. This spans from establishing risk management principles through implementing and documenting risk treatment.
SCR-RMM: Applicability To NIST 800-171 & CMMC
An immediate need for many organizations is compliance with NIST SP 800-171 and the Cybersecurity Maturity Model Certification (CMMC). The SCR-RMM is a tool that can be used to address the following NIST SP 800-171 requirements: