Factors Comprising Effective Risk Communication, Decision-Making, and Measurement of IT and IA Risk

Introduction

For years the information technology (IT) department, and by extension, the information assurance (IA) department, has been perceived by board members and senior management as “someone who is managing back-office technology” (Wysopal, 2015). This is in part due to the inability of the departments to communicate using a common language. The IT/IA department speaks geek and managers speak business. According to Wysopal (2015), Chief Information Security Officers (CISOs) need to communicate the level of risk in terms that board members can understand, namely using numbers not acronyms. This study examined the challenges of how to effectively communicate IT/IA risk information to an extra-departmental audience. The effectiveness of that communication is judged by both the quality of the information relayed in the message and the decisions they affect.