The Situation – no visibility into data-related risks & unmet compliance requirements

A large, specialty automotive insurance company was swiftly growing through mergers and acquisitions, bringing on new IT risk. Because the insurance industry works with such sensitive customer data, this data must be properly secured and protected. With little IT oversight and a non-operational Enterprise Risk Management (ERM) process, the company’s senior leadership had no visibility into data-related risks or overall security posture. They also had customers throughout the United States and Canada, subjecting them to numerous state and provincial data privacy regulations, as well as the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). Achieving and maintaining compliance with additional industry security requirements from the Payment Card Industry (PCI) was another top priority.

The Solution – fill the ERM gap through Risk Transformation Service (RTS)

We immediately went to work on the gap in ERM by leveraging Optiv’s Risk Transformation Service (RTS). To accelerate our client’s security maturity, we custom-built an ISO-based, IT security risk management program – which linked risk back to business drivers, justifying security spending while communicating executive-level measurement and risk management. This risk management program covered the full risk lifecycle, including risk source identification, risk analysis, risk prioritization mapping, risk treatment options calculation and metrics reporting.

To aid in our client’s rapid adoption, Optiv’s Risk Consultants tailored supplemental tools and workpapers, and conducted risk training and tabletop exercises with the client.