The start of the Digital Security Transformation

Our first ISACA NL Chapter Journal, at a minimum I can say that ISACA NL can be proud of this achievement. But I would rather say that I’m honored to write this first intro for a journal with great articles, from our ISACA members and reviewed by the ISACA Review Board.

With the recent developments in IT such as Generative AI, new risks arrive in our landscape. At the same time IT risk and security often feel themselves as chasing the business owners on the importance to mitigate the risks, protect the organization and sometimes even as a police officer stating an employee went through the red light. Interesting developments like Zero Trust sound great in the ears of an information security officer looking for protection of the organization but for a business person it sounds like ‘I cannot move an inch before having approval from security’.

Why is it that people who want to protect are often seen as the ‘department of no’ instead of the team making sure I can do the business without being afraid to be hacked. It is my belief that our next step in Risk & Security is starting the Digital Security Transformation. It is the action of Risk & Security to start aligning our capabilities with the ‘business’. This will require to start seeing Trust, Risk & Security as a business or as a service.

In order to achieve this, it should be clear what the services are. Some are more easy to recognize such as a performed pentest and others are more difficult to show such as policy, standard and control management or assessing open source software.

The Digital Trust & Security transformation is working towards a services structure, risk based, protecting a dollar with dime (instead of the other way around), being able to be benchmarked on services instead of being a ‘cost center’. But it is also being the trusted advisor, selling cherries instead of lemons and becoming Seneca instead of Al Capone (picture below).