No Result
View All Result
SUBSCRIBE | NO FEES, NO PAYWALLS
MANAGE MY SUBSCRIPTION
NEWSLETTER
Corporate Compliance Insights
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
No Result
View All Result
Corporate Compliance Insights
Home Cybersecurity

Lack of Investments in Training and IT GRC Holding Back Cybersecurity Maturity, Finds MetricStream Survey

by Corporate Compliance Insights
February 8, 2018
in Cybersecurity
virus infecting insecure system

  • 51 percent of enterprises report low maturity of security training
  • 62 percent of enterprises without IT GRC solutions report low security readiness, as opposed to only 25 percent of those with IT GRC solutions

Palo Alto, Calif. (February 8, 2018) – MetricStream, the independent market leader in governance, risk and compliance (GRC) apps and solutions, announced today the findings of its latest survey, Moving Up the IT Risk Management Maturity Curve: An In-Depth Look at How Enterprises Are Managing and Mitigating Their IT Risks. The survey covered 139 respondents from 120+ enterprises and 20 industries across more than six geographic regions to examine the maturity of IT risk management programs, methods used to assess IT risks, impact of IT regulations and the role of technology in managing IT risks.

Key Findings

IT GRC Solutions as Maturity Enablers

Respondents were asked to rate their IT risk management maturity on the 5 level Capability Maturity Model Integration Scale (CMMI). Seventy-five percent of the respondents who have implemented IT GRC solutions reported a CMMI maturity level of 3 or higher. In comparison, only 38 percent of the respondents who have not implemented IT GRC solutions reported a similar level of maturity – these organizations rely on a combination of spreadsheets, point solutions and other tools which, going by the survey results, may not be as effective as IT GRC solutions in improving the maturity of IT risk management programs.

Top IT Threats

The top 5 IT threats and risks that respondents reported in the last two years are malware infections, security breaches, compliance violations and regulatory actions, account phishing and spoofs of company executives.

Potential Vulnerabilities

Respondents reported relatively high levels of maturity (CMMI level 3 or higher) in IT risk identification and assessments, standardized documentation of processes and controls, control design and assessments and IT risk monitoring and reporting.

However, when it came to IT risk management training, 51 percent of the respondents and 52 percent of those in banking and financial services reported a CMMI maturity of only level 1 or level 2. This lack of maturity could prove disastrous, as poorly trained employees fall prey more easily to social engineering attacks such as phishing which, in turn, open the door to larger attacks on enterprise security.

Despite these risks — and the fact that account phishing and spoofing were cited among the top 5 enterprise IT threats — it appears that respondents are not investing enough in employee training programs or better information governance frameworks. Instead, their top three priorities over the next 18 months are investments in IT security solutions, compliance with government regulations and IT security data aggregation and business reporting through a common application.

Other Findings

  • 44 percent of large-sized enterprises cited internet of things (IoT) technologies and 35 percent cited the cloud as having the most potential to disrupt IT risk management programs in the next three years
  • 61 percent of the respondents reported data privacy as a key IT risk area that is monitored
  • Respondents in Europe, the U.S. and Canada cited compliance with government regulations as the top area for improvement in their IT risk management programs over the next 18 months. In the Asia-Pacific, Middle East and Africa, the focus is on investments in IT security solutions

“Guarding against the next Equifax-style cyberattack will require enterprises to have holistic, agile IT risk management programs,” said French Caldwell, Chief Evangelist, MetricStream. He continued, “An IT GRC software solution can really add value by automating workflows and providing timely risk intelligence to guide decisions. However, it’s just one piece of the pie. Policies, training programs and information governance frameworks are all equally important. Together, they lay the foundation for a resilient and secure enterprise.”

To access the MetricStream Research report, click here.

About MetricStream
MetricStream, the independent market leader in enterprise and cloud applications for governance, risk, compliance (GRC) and quality management, makes GRC simple. MetricStream apps improve business performance by strengthening risk management, corporate governance, regulatory compliance, vendor governance and quality management for hundreds of thousands of users in dozens of industries, including financial services, health care, life sciences, energy and utilities, food, retail, CPG, government, hi-tech and manufacturing. MetricStream is headquartered in Palo Alto, California, with an operations and R&D center in Bangalore, India, and sales and operations support in 12 other cities globally. (www.metricstream.com)


Previous Post

Are We Winning the Battle Against Bribery and Corruption?

Next Post

The True Test of an Effective E&C Program

Corporate Compliance Insights

Corporate Compliance Insights

Corporate Compliance Insights

Related Posts

Fox_DOJ Speeches_f

Analysis of Recent DOJ Statements

by Corporate Compliance Insights
March 23, 2023

DOJ leaders provide insight into agency's plans. Analysis of Recent Statements DOJ Shaping the Future of Corporate Criminal Enforcement What’s...

Fox_2023 ECCP Update_f

2023 Evaluation of Corporate Compliance Programs

by Corporate Compliance Insights
March 23, 2023

Keeping up with 2023 changes to DOJ guidelines. Additions, Deletions & Changes From 2020 2023 Evaluation of Corporate Compliance Programs...

encompass update

Encompass Launches pKYC Maturity Model

by Corporate Compliance Insights
March 22, 2023

KYC automation platform Encompass has unveiled a new perpetual Know Your Customer (pKYC) maturity model designed to help banks improve...

consilio onna partnership

Consilio, Onna Seek to Streamline eDiscovery for Cloud Apps

by Corporate Compliance Insights
March 22, 2023

Legal technology provider Consilio has launched a new platform, Sightline Collect, powered by data management supplier Onna. The platform is...

Next Post
slice of pie chart on plate

The True Test of an Effective E&C Program

Compliance Job Interview Q&A

Jump to a Topic

AML Anti-Bribery Anti-Corruption Artificial Intelligence (AI) Automation Banking Board of Directors Board Risk Oversight Business Continuity Planning California Consumer Privacy Act (CCPA) Code of Conduct Communications Management Corporate Culture COVID-19 Cryptocurrency Culture of Ethics Cybercrime Cyber Risk Data Analytics Data Breach Data Governance DOJ Download Due Diligence Enterprise Risk Management (ERM) ESG FCPA Enforcement Actions Financial Crime Financial Crimes Enforcement Network (FinCEN) GDPR HIPAA Know Your Customer (KYC) Machine Learning Monitoring RegTech Reputation Risk Risk Assessment SEC Social Media Risk Supply Chain Technology Third Party Risk Management Tone at the Top Training Whistleblowing
No Result
View All Result

Privacy Policy

Founded in 2010, CCI is the web’s premier global independent news source for compliance, ethics, risk and information security. 

Got a news tip? Get in touch. Want a weekly round-up in your inbox? Sign up for free. No subscription fees, no paywalls. 

Follow Us

Browse Topics:

  • CCI Press
  • Compliance
  • Compliance Podcasts
  • Cybersecurity
  • Data Privacy
  • eBooks Published by CCI
  • Ethics
  • FCPA
  • Featured
  • Financial Services
  • Fraud
  • Governance
  • GRC Vendor News
  • HR Compliance
  • Internal Audit
  • Leadership and Career
  • On Demand Webinars
  • Opinion
  • Resource Library
  • Risk
  • Uncategorized
  • Videos
  • Webinars
  • Well-Being
  • Whitepapers

© 2022 Corporate Compliance Insights

No Result
View All Result
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe

© 2022 Corporate Compliance Insights

Welcome to CCI. This site uses cookies. Please click OK to accept. Privacy Policy
Cookie settingsACCEPT
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
cookielawinfo-checbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
SAVE & ACCEPT