A year from now, somebody is going to look at a risk your organization chose to live with and ask why it was decided that way. Most of the time, they want to know whether anyone can explain it. In this episode, Professor Simon explains what makes a cybersecurity risk decision defensible: a decision that can be explained and supported using what was known at the time, whether or not it turned out well.

He walks through a hypothetical, not a real case, about a business team that wants to connect a new tool to customer data before the security review is finished. Along the way, he covers seven things a good risk decision record should show and five questions it should be able to answer. It is useful for security and GRC professionals who make or document risk decisions, and for anyone learning to write them.

In this episode you'll learn:

- Why a defensible decision is one that can be explained using what was known at the time, not one that turned out well

- Why cybersecurity risk decisions should be written down when they are made, not rebuilt from memory later

- How to state a risk in plain words that a business decision maker can weigh

- How to be honest about evidence, assumptions and confidence in a risk rating

- Why a record should show the options considered, and keep security's recommendation separate from the decision

- How to record residual risk, assumptions and constraints, and the triggers for reviewing a decision

- Five questions a risk decision record should be able to answer

▶️ Companion YouTube Video: https://youtu.be/SzwZ2SGvL-U

📝 Companion Blog Post: https://professorsimon.com/blog/defensible-cybersecurity-risk-decisions

🎧 More Podcast Episodes: https://professorsimon.com/podcast

👉 Need help with your IT or cybersecurity career? Work with me: https://professorsimon.com/guidance

🔗 Resources, blog & more: https://professorsimon.com/links

🌐 Website: https://professorsimon.com

💼 LinkedIn: https://www.linkedin.com/in/leonardsimon

📸 Instagram • X • TikTok: @profsimononline

If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.