Risk Management
Risk is the key driver for every business, and the current status of business risk and proposed mitigation activities should be presented and evaluated regularly. There are only four key methods to manage risk, and these include mitigation, transference, acceptance, and avoidance. Each risk is categorized based on its potential impact.
Data Protection and Governance
Data is the most important element of any organisation, and as a result, companies of all types and sizes need to understand who uses it, and where and how their data is stored. Data governance and auditing is defined as a group of measures that ensures essential data assets are formally managed throughout an organisation. For hedge funds and investment firms this data can include investor information, investment decisions and other critical firm information. With the growth of unstructured data, which refers to data that is not organised in a specific manner, organisations have needed to develop governance and auditing methods to ensure that they can identify the locations and usage of their critical data pieces.
Incident Response
Incident response plans define the procedures in the case of a cybersecurity breach or threat. The plan should take into account which individuals or departments will responsible for specific tasks, in addition to how to decide when to report the incident to necessary third parties such as clients and regulators.
Vendor Management
A vendor management programme must not only consider financials, contracts and reputational risks, but must put cybersecurity preparedness, as critical evaluation criteria. The first step in any vendor management programme should of course be to know your suppliers inside and out, understanding what services they provide for the firm, and what data they are party to.
