Axioms are common in the privacy and security space. One that
has been popping up with more frequency is "privacy and
security is an enterprise risk that requires an enterprise-wide
effort to appropriately address." It is easy to say, hard to
execute and absolutely necessary.
We work with hundreds of companies a year during security
incidents, proactive risk and security assessments, compliance
advisory projects, and transactions. So we see the amount and
variety of technology and digital assets in use at an entity, and
we see the challenges in managing the attendant risks. Marketing
tries out something new using a vendor that will put the
entity's data in the cloud without vetting the service or the
contract through the security and legal groups. Security teams
struggle to translate risks in terms that "non-techies"
can understand to win enough resources to adequately secure an
environment that increasingly has no boundaries. Legal teams are
stretched thin and often
