A Risk Register is Not the First Step in Your Archer Journey

By Eric Noonan • January 26, 2016

Due to the way the RSA Archer product is sold, customers often find themselves the proud owners of the Risk Management module.  Side-by-side with the Enterprise, Policy, and Compliance modules, Risk Management is marketed as a necessary and important module to tackle in the initial phase of the Archer journey.  As professional services providers, clients often ask CyberSheath to assist them with the creation of a risk register as their first step with Archer because it is something they have heard they need to do.

A Risk Register as a First Step is Not the Answer

The problem is that the majority of new Archer customers that we have partnered with are in the information security field, where actual threats and incidents consume every working hour.  The daily realities of malware, vulnerabilities, exception requests, business needs, and compliance requirements take up more than enough of a security team’s time each month for them to be prioritizing a risk register as their first GRC capability.

In today’s fast-paced and dynamic cybersecurity world, a risk register managed by the security team seems almost a quaint and antiquated concept.  I cringe at the memories of my life in a large corporation before CyberSheath, where someone from corporate would take weeks and months to hold working groups, developing a risk register and asking us all about our thoughts on the likelihood and impact of a tsunami hitting our Austin, Texas data center.  At the time, my thoughts and efforts were instead concentrated on actual cyber events happening right then and how we were responding to them both tactically and strategically.

What NIST Recommends Your First Steps Should Be

NIST 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems does not mention the term “Risk Register,” not even once.  In fact, the steps in the RMF Process are now clearly focused on control definition and assessment:

  • RMF Step 1: Categorize Information System
  • RMF Step 2: Select Security Controls
  • RMF Step 3: Implement Security Controls
  • RMF Step 4: Assess Security Controls
  • RMF Step 5: Authorize Information System
  • RMF Step 6: Monitor Security Controls

The RSA Archer Risk Management Module does have a place and is valuable for mature organizations. However, it is best managed at a corporate, non-security level, assessing business risk, and only after significant Archer groundwork has been completed to map out governance.

For commercial information security organizations, the prioritized modules that provide the most value to the security team, in order are:

  • Enterprise Management
  • Policy Management
  • Compliance Management
  • Threat (Vulnerability) Management
  • Vendor Security Management

How Can CyberSheath Help Your Organization?

These modules provide structure, process, metrics, visibility, and accountability that can be used to gain a true picture of the effectiveness and maturity of the security organization.  At CyberSheath, we know cybersecurity processes first, and we use that knowledge and experience to help our partners get real value from Archer.

CyberSheath Blog

Dr. Robert Spalding to Address Nation-State Attacks at CMMC Con 2021

Since the inaugural CMMC Con, we’ve seen some of the most malicious attacks on American infrastructure ever executed. The SolarWinds attack reverberated across the entire government as agencies scrambled to discover what nation-state attackers had accessed and stolen. The Colonial Pipeline, shut down by a ransomware attack, led to fuel…

CMMC-AB vice chair Jeff Dalton to address CMMC Con 2021

The swiftness and severity of recent cyber attacks has dominated headlines and revealed that many organizations still don’t quite know what to do to protect themselves, as well as the businesses and government entities they’re connected to.   Ransomware attacks were a big point of discussion at the recent G7…

CMMC Con 2021 Opens Registration, Reveals Theme and Speakers

CMMC compliance stands in the way of revenue for every defense contractor in the supply chain. Now that CMMC is a reality for the Defense Industrial Base (DIB), learn how contractors — primes and subs, large and small, foreign-owned — are handling the standards and requirements, as well as the…

Our Trusted Partners

Cyberark McAfee Thycotic RSA Tenable Alien Vault Alert Logic Microsoft

CMMC Con 2021 is here! Save your spot to hear the latest on CMMC from our expert speakers across the government and Defense Industrial Base.