Risk, security and compliance
The board does not expect you to remove every risk. It expects you to know the big ones, to keep them inside limits it has agreed, and to lead well on the day one goes wrong. This lesson gives you the tools for that at Mangrove Market: risk appetite, a risk register, the Three Lines Model, security governance with NIST CSF 2.0, card payment and data protection rules, and incident accountability.
By the end you can
- Write a risk appetite statement in plain words for each risk area, and use it to decide which risks need action
- Keep a risk register with likelihood, impact, an owner and a treatment (avoid, reduce, transfer or accept) for each risk
- Explain who does what under the Three Lines Model, and where security, compliance and internal audit sit
- Assess security with the six functions of NIST CSF 2.0, and decide whether ISO/IEC 27001 certification is worth it
- Know what PCI DSS and data protection laws ask of you, lead as an executive during a major incident, and hire a head of security
The everyday picture
Think of a big shopping centre. The owners decide how much risk they will live with: they will never accept blocked fire exits, but they will accept that a lift sometimes breaks down for an hour. Each shop manager keeps their own shop safe every day. The centre's safety officer writes the rules, checks the shops and challenges anyone who cuts corners. Once a year an independent inspector, who answers to the owners, checks whether the whole system works. The owners also buy insurance for the risks they cannot remove.
When a fire alarm goes off, nobody holds a meeting. A trained fire warden takes charge, people have clear jobs, and the centre manager deals with the fire service, the press and the shop owners while the warden runs the evacuation. Afterwards they ask what in the building or the rules let it happen, not whose fault it was. Risk, security and compliance in a technology department work the same way.
Risk appetite and the risk register
Risk appetite is how much risk the board is willing to accept, area by area, to reach the company's goals. It is the board's decision, and your job is to propose it in words the board can test. A useful appetite statement names the area, the level (very low, low, moderate or high) and what that means in practice. For Mangrove:
- Card and personal data: very low. We accept no known exposure of card data, and we fix any known weakness in systems holding customer data within days.
- Store selling: low. Tills must keep selling when the network drops. We accept short outages of the Mangrove app outside festival peaks, but not of the tills.
- New-city technology: moderate. We accept trying new tools and suppliers in pilot stores, as long as a pilot can be rolled back in a day.
- Supplier dependence: low to moderate. We accept relying on one agency for part of the Partner app only with a written exit plan.
The appetite turns into decisions through the risk register. Each row is one risk, written as cause, event and consequence: "Because the back-office database takes about 14 hours to restore, a failure on a festival day could stop store deliveries for a day." Writing the cause makes the risk fixable; "data loss" alone is a topic, not a risk.
Score each risk for likelihood and impact, each from 1 (rare, small) to 5 (almost certain, severe), and multiply. Define the scales once, in money, customers and days, so that a 4 means the same thing to everyone: for example, an impact of 4 might mean a loss above $1 million, or customers unable to order for more than a day. Then compare the score with the appetite for that area and choose one of four treatments:
- Avoid: stop the activity that creates the risk. Mangrove stops handling card numbers in its own systems by using a payment provider's hosted payment page.
- Reduce: lower the likelihood or the impact. A faster restore, multi-factor login for vendors, a second network link in each store.
- Transfer: move part of the cost to someone else, through insurance or a contract. Cyber insurance pays some costs of a breach; it does not move the damage to trust.
- Accept: live with it, because it is inside the appetite or reducing it costs more than it saves. Accepting is a decision, recorded with a named owner and a review date.
Every risk has one owner: the leader who runs the area where it lives, such as Victor for till outages or Ken for the Lagoon dependence. Security does not own everyone's risks. Review the register monthly with the leadership team, and send the top risks, with their trend, to the audit and risk committee each quarter.
Quick check
The risk "a store network outage stops card payments at the tills" scores likelihood 4 and impact 3. The appetite for store selling is low. The tills can already sell for cash offline. What is the best treatment?
A score of 12 against a low appetite needs action, and practical steps can lower both likelihood and impact. Accepting ignores the appetite, since many customers pay by card. Insurance would pay some lost sales but leaves customers unable to pay. Stopping card payments removes the risk by removing something the business needs.