No one likes paying for insurance. You pay a lot and, if things go well, you get nothing back. Did you know that, when you take out insurance, you’re actually applying an internationally recognised standard? ISO 31000 is all about risk and how you respond to it. And taking out insurance is just one of four options it defines.

Working in information security, I see all four options apply directly to how organisations deal with cybersecurity risk, usually without realising it.

How does risk management actually work?

Let’s use car insurance as a quick analogy. The risk: you might have an accident, and if you do, someone will have to pay.

Risk management starts with two assessments:

• Impact: How big is the risk? This is nearly always converted into a financial cost. In this case: the value of the vehicle and estimated third-party costs.
• Probability: How often is the risk likely to occur? For the car, this is based on your driving style and past incidents.

Once you have a sense of both, you decide how to respond. That’s where the four options come in.

The four ways to respond to a risk

Option 1: Share the risk

Find a partner to accept the impact if the risk occurs. An insurance company will take on part of the impact in exchange for a monthly fee, but it can also be done through contractual agreements that define who covers the impact depending on the cause.

Option 2: Eliminate the risk

Reduce the probability to zero by not doing the activity at all. In the car example: sell the car. Drastic, but sometimes the right call.

Option 3: Reduce or mitigate the risk

Lower the impact or probability to an acceptable level. Buy a cheaper car, or improve your driving. Insurance companies reward both with lower premiums. This option is often combined with Option 4: reduce the risk as much as possible, then accept the remainder.

Option 4: Accept the risk

You cover the costs yourself if something goes wrong. For most people this is actually the default, not a deliberate choice. Option 4 is a valid option, but only when the risk owner is fully aware of the potential impact and has the resources to absorb the costs. In information security, unlike car insurance, no one is making you do anything.

So where does information security fit in?

Risk is all around us. In information security, I see many businesses quietly defaulting to Option 4, not because they’ve made a considered decision, but because they don’t know enough about the technology to make an informed one.

Getting advice costs money. And, just like insurance, it’s hard to pay for something when you can’t see the benefit. Of course the benefit is in risks not occurring, and that is very hard to quantify.

My advice: take a little time to think about the size of the risk that you face.

A practical starting point: the CIA triad

In information security, we start with the CIA triad. It’s a simple framework for assessing what’s at stake.

C — Confidentiality

If your data was leaked, what would the impact be? For a business, this could mean fines from the government if the data contained personal information (GDPR) or a competitive disadvantage if customers or competitors find out about your finances. For individuals: think about what it would cost if your bank details were leaked.

I — Integrity

What if your data wasn’t stolen, but changed? Databases corrupted without anyone noticing, giving wrong information to customers and suppliers.

A — Availability

If you lost access to your emails or data, what impact would that have, and what would it cost to get it back? This is often calculated by cost per day, comparing the impact of a few hours of downtime versus a few days or weeks.

The bottom line

With this in mind, you can start making informed decisions about which of the four options makes sense for you and, how much it’s worth to get expert advice.