Over the summer, Gartner announced that it was moving its focus away from GRC and launching a new Magic Quadrant for integrated risk management, or IRM:
IRM enables simplification, automation and integration of strategic, operational and IT risk management processes and data. IRM goes beyond the traditional, compliance-driven GRC technology solutions to provide actionable insights that are aligned with business strategies, not just regulatory mandates.
Is this, as Gartner calls it, the end of the GRC era? Yes and no. Gartner’s announcement is part of a larger market shift towards adopting a risk-based, data-centric approach throughout the enterprise before any GRC or cyber security activities begin. This has always been the most prudent, proactive way to approach GRC and cyber security; if you do not understand what data you have, where it resides, and how it’s being processed and stored, it’s impossible to secure it. IRM also offers numerous advantages that go beyond better GRC and cyber security.
Following are five reasons why organizations should embrace an IRM-first approach to data governance, compliance, and security.
IRM Eliminates Silos & Promotes a Security-Focused Culture
In a digital world where every employee operates a computer, cyber security and compliance are now everyone’s responsibility, from the C-suite down to the reception desk, and even extending to third-party vendors. IRM fosters a top-down, security-focused and risk management-based culture throughout the organization, eliminating silos and enabling organizations to identify situations where a risk factor in one area affects other areas.
IRM Improves Effectiveness & Cuts Costs
IRM identifies redundancies and inefficiencies in organizational GRC and cyber security, allowing organizations to eliminate processes that add no value, allocate funds and human resources more effectively, improve GRC and cyber security functions on all levels, and free up employees to work on projects that further the organization’s goals.
IRM Uncovers Opportunities
Risk isn’t always negative; businesses need to take risks to grow. By integrating risk management into overall organizational strategy, IRM treats risk management as a business driver, not a business cost. It allows organizations to see how risk management, compliance, and data security can further their business goals and uncovers opportunities to take calculated risks.
IRM Allows Organizations to Rapidly Respond to a Changing Regulatory Environment
The EU’s new General Data Protection Regulation (GDPR) is arguably the most sweeping data privacy law to date – and it is highly unlikely to be the last. As more transactions are digitized, more massive breaches on the scale of Equifax and Uber will occur, and consumers in the U.S. will pressure federal and state governments to enact similar protections. Organizations that take an IRM-based approach will be in a better position to comply with new data privacy legislation. Additionally, they will enjoy a competitive advantage in a market where customers are aware of data security risks and demanding that their data be handled securely.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.