{"id":17836,"date":"2026-07-30T06:38:13","date_gmt":"2026-07-30T10:38:13","guid":{"rendered":"https:\/\/www.netwitness.com\/?post_type=glossary&#038;p=17836"},"modified":"2026-08-11T02:51:13","modified_gmt":"2026-08-11T06:51:13","slug":"risk-posture","status":"publish","type":"glossary","link":"https:\/\/www.netwitness.com\/ja\/cyber-glossary\/risk-posture\/","title":{"rendered":"Risk Posture"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"17836\" class=\"elementor elementor-17836\" data-elementor-post-type=\"glossary\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d7f09d2 e-flex e-con-boxed e-con e-parent\" data-id=\"d7f09d2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7565758 elementor-widget elementor-widget-heading\" data-id=\"7565758\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What is Risk Posture?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-da689aa elementor-widget elementor-widget-text-editor\" data-id=\"da689aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Risk posture is an organization\u2019s current level of exposure to cybersecurity, operational, compliance, and business risks. It reflects how effectively the organization\u00a0identifies\u00a0threats, protects critical assets, manages vulnerabilities, responds to incidents, and keeps residual risk within its defined risk appetite.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A company\u2019s\u00a0risk\u00a0posture is shaped by several interconnected factors, including its assets, identities, applications, data, vulnerabilities, security controls, threat environment, incident response capabilities, and business dependencies.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A strong\u00a0risk\u00a0posture does not mean that the organization has\u00a0eliminated\u00a0every cybersecurity risk. Instead, it means that material risks are visible, understood, prioritized, controlled, and continuously\u00a0monitored.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Risk posture is sometimes described as an organization\u2019s enterprise risk posture, cyber risk posture, security risk posture, IT risk posture, or digital risk posture, depending on the scope of the assessment.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c0a0ede e-con-full e-flex e-con e-child\" data-id=\"c0a0ede\" data-element_type=\"container\" data-e-type=\"container\" id=\"synonyms\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a3b8a4f elementor-widget__width-initial elementor-widget elementor-widget-heading\" data-id=\"a3b8a4f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Synonyms<\/h2>\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0fdb30d e-con-full e-flex e-con e-child\" data-id=\"0fdb30d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1a15d76 elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"1a15d76\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Risk Exposure<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Cyber Posture<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Threat Posture<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Attack Surface<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Risk Framework<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Defense Posture<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Risk Resilience<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Security Posture<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Threat Resilience<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Cybersecurity Posture<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Vulnerability Landscape<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Enterprise Risk Posture<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Cybersecurity Risk Posture<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"28\" height=\"28\" viewBox=\"0 0 28 28\" fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M13.9999 23.625H5.24992C4.89642 23.625 4.57705 23.4115 4.44142 23.0851C4.3058 22.7579 4.38104 22.3816 4.63129 22.1314L12.7627 14L4.63129 5.86863C4.38104 5.61838 4.3058 5.24213 4.44142 4.91488C4.57705 4.5885 4.89642 4.375 5.24992 4.375H13.9999C14.2318 4.375 14.4549 4.46687 14.6185 4.63137L23.3685 13.3814C23.7107 13.7226 23.7107 14.2774 23.3685 14.6186L14.6185 23.3686C14.4549 23.5331 14.2318 23.625 13.9999 23.625Z\" fill=\"#BE3A34\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Organizational Risk Posture<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9397ba4 elementor-widget elementor-widget-heading\" data-id=\"9397ba4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Risk Posture at a Glance<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ef941d5 elementor-widget elementor-widget-text-editor\" data-id=\"ef941d5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<ul><li><b><span data-contrast=\"auto\">Risk posture:<\/span><\/b><span data-contrast=\"auto\">\u00a0The organization\u2019s current risk condition and level of exposure<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Strong risk posture:<\/span><\/b><span data-contrast=\"auto\">\u00a0Critical risks are known, prioritized, controlled, and monitored<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Weak risk posture:<\/span><\/b><span data-contrast=\"auto\">\u00a0Important exposures\u00a0remain\u00a0unidentified, unmanaged, or insufficiently controlled<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Primary\u00a0objective:<\/span><\/b><span data-contrast=\"auto\">\u00a0Keep residual risk within the organization\u2019s approved risk appetite<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Key activities:<\/span><\/b><span data-contrast=\"auto\"> Risk assessment, vulnerability identification, risk analysis, control validation, incident response, and continuous monitoring.<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-26738ec elementor-widget elementor-widget-heading\" data-id=\"26738ec\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Why is Risk Posture Important?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-59d0148 elementor-widget elementor-widget-text-editor\" data-id=\"59d0148\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Risk posture gives business and security leaders a practical view of how much risk the organization is carrying at a given time.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Without\u00a0an accurate\u00a0understanding of risk posture, organizations may invest in security tools and controls without knowing whether those investments are reducing their most important risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">An effective cyber risk posture helps organizations:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Identify\u00a0the systems, data, identities, and business services most at risk.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/risk-prioritization\/\" target=\"_blank\" rel=\"noopener\">Prioritize cybersecurity risks<\/a> based on business impact.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Detect gaps in security controls and operational processes.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Reduce the likelihood and\u00a0impact\u00a0of a\u00a0cyber attack.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Improve threat mitigation and incident response.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Support regulatory compliance and audit readiness.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Make informed cybersecurity investment decisions.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Align\u00a0security activities with the organization\u2019s risk appetite.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Improve preparation for\u00a0a data\u00a0breach or operational disruption.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Establish clear accountability for risk treatment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Risk posture also helps organizations move from reactive security to proactive risk management. Rather than responding only after a security incident occurs, teams can\u00a0identify\u00a0emerging risks and address them before they become\u00a0serious\u00a0business problems.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6df086e elementor-widget elementor-widget-heading\" data-id=\"6df086e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Determines an Organization\u2019s Risk Posture?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-48b5cae elementor-widget elementor-widget-text-editor\" data-id=\"48b5cae\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">An organization\u2019s risk posture is influenced by the interaction between its technology, people, business processes, and threat environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Business-Critical Assets:<\/strong><\/h3><p><span data-contrast=\"auto\">Organizations must understand which systems, applications, data, identities, and services are essential to operations.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A vulnerability affecting a low-value test system may present limited risk. The same vulnerability affecting a production payment platform, healthcare system, cloud management console, or privileged identity may create significant exposure.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Asset criticality is therefore an essential part of risk analysis.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>2. Threat Exposure:<\/strong><\/h3><p><span data-contrast=\"auto\">Threat exposure describes the threats that are relevant to the organization based on its industry, technology environment, geographic presence, data, and business model.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Examples include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/ransomware\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"auto\">Ransomware<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/a><\/li><li><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/credential-theft\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"auto\">Credential theft<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/a><\/li><li><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/phishing\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"auto\">Phishing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/a><\/li><li><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/insider-threat\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"auto\">Insider threats<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Supply chain attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud account compromise<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Application exploitation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data exfiltration<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Distributed\u00a0denial-of-service\u00a0attacks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Nation-state activity<\/span><\/li><\/ul><p><span data-contrast=\"auto\">An organization\u2019s threat posture can change rapidly as new threat actors, attack techniques, and vulnerabilities\u00a0emerge.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>3. Vulnerabilities and Misconfigurations:<\/strong><\/h3><p><span data-contrast=\"auto\">Vulnerability identification is a core\u00a0component\u00a0of risk posture assessment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Risk may result from:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Unpatched software<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Misconfigured cloud services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Weak authentication<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Excessive privileges<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unsupported systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exposed administrative interfaces<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Insecure application programming interfaces<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Missing encryption<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unmonitored endpoints<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Inadequate <a href=\"https:\/\/www.netwitness.com\/blog\/network-segmentation-explained\/\" target=\"_blank\" rel=\"noopener\">network segmentation<\/a><\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">A vulnerability does not create the same level of risk in every environment. Its significance depends on exploitability, asset value, exposure, business impact, and the effectiveness of existing controls.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>4. Identity Risk:<\/strong><\/h3><p><span data-contrast=\"auto\">Identity risk posture reflects how effectively an organization protects user accounts, administrative identities, service accounts, machine identities, and access privileges.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Identity-related risk can increase when organizations have:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Dormant accounts<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Excessive administrative privileges<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Weak passwords<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Limited multifactor authentication coverage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unmanaged service accounts<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Inadequate access reviews<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Poorly protected credentials<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unmonitored privilege escalation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Inconsistent identity governance<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Because attackers frequently use valid credentials to move through an environment, identity risk posture is a critical part of modern <a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/security-risk-management\/\" target=\"_blank\" rel=\"noopener\">security posture management<\/a>.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>5. Attack Paths:<\/strong><\/h3><p><span data-contrast=\"auto\">An attack path is a sequence of vulnerabilities, permissions, systems, identities, and network connections that an attacker could use to reach a critical asset.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">For example, an attacker may compromise a standard user account, access an exposed system, obtain elevated privileges, move laterally through the network, and eventually reach sensitive data.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Risk posture assessments should therefore evaluate combinations of weaknesses, not just individual vulnerabilities.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>6. Security-Control Effectiveness:<\/strong><\/h3><p><span data-contrast=\"auto\">Security tools only reduce risk when they are properly deployed, configured,\u00a0monitored, and\u00a0validated.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Relevant controls may include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Firewalls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><a href=\"https:\/\/www.netwitness.com\/blog\/advanced-persistent-threat-endpoint-security\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"auto\">Endpoint security<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/identity-and-access-management-iam\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"auto\">Identity and access management<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud security controls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Email security<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/data-loss-prevention-dlp\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"auto\">Data loss prevention<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network monitoring<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Security information and event management<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Encryption<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Backup and recovery<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Vulnerability management<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><a href=\"https:\/\/www.netwitness.com\/platform\/threat-detection-and-response\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"auto\">Threat detection and response<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Security posture validation helps determine whether these controls can prevent, detect, investigate, and respond to realistic attacks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>7. Business Impact:<\/strong><\/h3><p><span data-contrast=\"auto\">Risk posture must consider the potential business consequences of a cyber incident.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Possible impacts\u00a0include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Revenue loss<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Operational downtime<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Regulatory penalties<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data loss<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Legal liability<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Reputational damage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Loss of customer trust<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Safety consequences<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Intellectual property theft<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Supply chain disruption<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Risk analysis should connect technical weaknesses with these business outcomes.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>8. Incident Response and Recovery Readiness:<\/strong><\/h3><p><span data-contrast=\"auto\">An organization\u2019s ability to detect, investigate,\u00a0contain, and recover from an incident directly affects its\u00a0risk\u00a0posture.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A mature organization should\u00a0maintain:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Documented incident response plans<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Clearly defined roles and responsibilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Investigation procedures<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Communication protocols<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Escalation processes<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Evidence retention policies<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Containment playbooks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Backup and restoration capabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">An incident recovery plan<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Regular incident response exercises<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Strong incident response capabilities may not prevent every\u00a0cyber attack, but they can significantly reduce the duration and impact of an incident.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>9. Third-Party and Supply Chain Risk:<\/strong><\/h3><p><span data-contrast=\"auto\">Organizations often depend on vendors, cloud providers, software suppliers, contractors, and business partners.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">These relationships may introduce risk through:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Third-party access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Shared credentials<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Software dependencies<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud integrations<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Managed services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data sharing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Remote administration<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Supply chain compromise<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Enterprise risk posture must account for the security practices and access privileges of connected third parties.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>10. Human Risk and Security Awareness:<\/strong><\/h3><p><span data-contrast=\"auto\">Employees, contractors, administrators, and business partners can influence risk posture through their actions.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/vantage-points-of-effective-cybersecurity-awareness-programs\/\" target=\"_blank\" rel=\"noopener\">Security awareness<\/a> programs can help reduce risks associated with:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Phishing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Social engineering<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Password reuse<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Mishandling sensitive data<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unauthorized software<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unsafe remote access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Delayed incident reporting<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Employee security awareness should be continuous, role-specific, and reinforced with realistic exercises.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6de16b4 elementor-widget elementor-widget-heading\" data-id=\"6de16b4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Does Risk Posture Work?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4bcb3c8 elementor-widget elementor-widget-text-editor\" data-id=\"4bcb3c8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Risk posture can be understood through four connected concepts:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ol><li aria-level=\"3\"><span data-contrast=\"none\"><strong>Inherent Risk: <\/strong><\/span><span data-contrast=\"auto\">Inherent risk is the level of risk that exists before security controls are applied.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">For example, an internet-facing application that processes sensitive customer data may naturally have\u00a0a high level\u00a0of inherent risk.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>Control Effectiveness:\u00a0<\/strong><span data-contrast=\"auto\">Control effectiveness measures how well security safeguards reduce the likelihood or impact of a threat.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Examples include multifactor authentication, segmentation, endpoint detection, encryption, access control, backups, and security monitoring.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>Residual Risk: <\/strong><span data-contrast=\"auto\">Residual risk is the risk that\u00a0remains\u00a0after controls have been applied.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Even a well-protected system may\u00a0retain\u00a0some residual risk because no security control is perfect.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>Risk Appetite: <\/strong><span data-contrast=\"auto\">Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its business\u00a0objectives.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">The goal of risk posture management is to\u00a0identify\u00a0where residual risk exceeds the organization\u2019s risk appetite and then\u00a0determine\u00a0whether that risk should be reduced, transferred, avoided, or formally accepted.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ol><p><span data-contrast=\"auto\">A simplified model is:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><b><span data-contrast=\"auto\">Risk posture = inherent risk adjusted by control effectiveness, response readiness, and business context<\/span><\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ce3b4d3 elementor-widget elementor-widget-heading\" data-id=\"ce3b4d3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Risk Posture vs. Related Cybersecurity Concepts<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-370c351 elementor-widget elementor-widget-text-editor\" data-id=\"370c351\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<table data-tablestyle=\"MsoTable15Grid6ColorfulAccent1\" data-tablelook=\"1696\" aria-rowcount=\"7\"><tbody><tr aria-rowindex=\"1\"><td data-celllook=\"256\"><strong><span class=\"TextRun SCXW20652474 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW20652474 BCX0\">Concept<\/span><\/span><\/strong><\/td><td data-celllook=\"256\"><strong><span class=\"TextRun SCXW193855546 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW193855546 BCX0\">What It Describes<\/span><\/span><\/strong><\/td><td data-celllook=\"256\"><strong><span class=\"TextRun SCXW145609135 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW145609135 BCX0\"><span class=\"TextRun SCXW230361754 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW230361754 BCX0\">Primary Question<\/span><\/span><\/span><\/span><\/strong><\/td><\/tr><tr aria-rowindex=\"2\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW102772804 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW102772804 BCX0\">Risk posture<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW109617255 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW109617255 BCX0\">The organization\u2019s current risk exposure and readiness<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW19216727 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW19216727 BCX0\">How much risk are we carrying now?<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"3\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW6082689 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW6082689 BCX0\"><span class=\"TextRun SCXW69909675 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW69909675 BCX0\">Security posture<\/span><\/span><\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW101182579 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW101182579 BCX0\">The strength and coverage of security controls.<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW177417778 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW177417778 BCX0\">How well are we protected?<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"4\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW171465468 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW171465468 BCX0\"><span class=\"TextRun SCXW7795207 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW7795207 BCX0\">Cybersecurity posture<\/span><\/span><\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW131643211 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW131643211 BCX0\">The organization\u2019s overall ability to prevent, detect, and respond to cyber threats.<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW190307066 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW190307066 BCX0\">How prepared are we for cyber threats?<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"5\"><td data-celllook=\"0\"><b><span data-contrast=\"none\"><span class=\"TextRun SCXW162424418 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW162424418 BCX0\"><span class=\"TextRun SCXW207602989 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW207602989 BCX0\">Threat posture<\/span><\/span><\/span><\/span><\/span><\/b><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW203969297 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW203969297 BCX0\">The threats currently relevant to the organization.<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW140636817 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW140636817 BCX0\">Which threats are most likely to affect us?<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"6\"><td data-celllook=\"0\"><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\"><span class=\"TextRun SCXW262276408 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW262276408 BCX0\"><strong><span class=\"TextRun SCXW125545790 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW125545790 BCX0\">Risk appetite<\/span><\/span><\/strong><\/span><\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW61980603 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW61980603 BCX0\">The amount of risk leadership is willing to accept.<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW224294731 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW224294731 BCX0\">How much risk are we prepared to tolerate?<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"7\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW152990366 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW152990366 BCX0\"><span class=\"TextRun SCXW10231042 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW10231042 BCX0\">Risk assessment<\/span><\/span><\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW267451142 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW267451142 BCX0\">The process used to\u00a0<\/span><span class=\"NormalTextRun SCXW267451142 BCX0\">identify<\/span><span class=\"NormalTextRun SCXW267451142 BCX0\"> and evaluate risk.<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW56437575 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW56437575 BCX0\">What risks exist and how serious are they?<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"8\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW168568757 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW168568757 BCX0\"><span class=\"TextRun SCXW236216136 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW236216136 BCX0\">Vulnerability posture<\/span><\/span><\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW140637398 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW140637398 BCX0\">The current state of weaknesses and remediation.<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW85233430 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW85233430 BCX0\">Which vulnerabilities require attention?<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"9\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW153016348 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW153016348 BCX0\"><span class=\"TextRun SCXW160535727 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW160535727 BCX0\">Attack surface<\/span><\/span><\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW67194996 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW67194996 BCX0\">The systems, identities, applications, and services that could be targeted.<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW89114170 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW89114170 BCX0\">Where could an attacker gain access?<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"10\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW164022984 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW164022984 BCX0\">Exposure management<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW202590134 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW202590134 BCX0\">The continuous discovery and prioritization of exploitable exposure.<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW181407760 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW181407760 BCX0\">Which exposures create realistic attack opportunities?<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"10\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW8264649 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW8264649 BCX0\">Defense posture<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW226667240 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW226667240 BCX0\">The organization\u2019s defensive capabilities and preparedness.<\/span><\/span><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW20504225 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW20504225 BCX0\">Can our controls withstand relevant attacks?<\/span><\/span><\/td><\/tr><\/tbody><\/table>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2c608d2 elementor-widget elementor-widget-heading\" data-id=\"2c608d2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What are the Different Types of Risk Posture?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-40e9a32 elementor-widget elementor-widget-text-editor\" data-id=\"40e9a32\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Risk posture can be assessed across several security and business domains.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Cyber Risk Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">Cyber risk posture describes the organization\u2019s overall exposure to cybersecurity threats and its ability to manage them.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It includes:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Asset exposure<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Threat activity<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Vulnerabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Security controls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Incident response<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Recovery capabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Business impact<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Cyber risk posture management should provide leadership with a clear view of current and emerging cybersecurity risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>2. Security Risk Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">Security risk posture focuses on the risks created by weaknesses in security controls, policies, technology, and operational practices.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">It may include both cyber and physical security risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>3. Identity Risk Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">Identity risk posture measures exposure associated with users, privileges, credentials, service accounts, and access rights.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Identity security posture management may include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Privileged access reviews<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Dormant account identification<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Multifactor authentication coverage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Password policy enforcement<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identity threat detection<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Access certification<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Service-account monitoring<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Least privilege implementation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><h3 aria-level=\"3\"><strong>4. Cloud Risk Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">Cloud security posture evaluates risk across cloud infrastructure, services, workloads, identities, APIs, permissions, and data.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Common cloud risks include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Publicly accessible storage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Excessive permissions<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unencrypted data<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Weak cloud identity controls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Misconfigured network rules<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unmanaged cloud resources<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Insecure APIs<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Limited logging<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/cloud-security\/\" target=\"_blank\" rel=\"noopener\">Cloud security<\/a> posture management helps\u00a0identify\u00a0and remediate these issues across cloud environments.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>5. Network Security Posture:<\/strong><\/h3><p><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/network-security-management\/\" target=\"_blank\" rel=\"noopener\">Network security<\/a> posture reflects the organization\u2019s ability to protect and\u00a0monitor\u00a0communications across its environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It includes:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Network segmentation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Firewall\u00a0configuration<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Remote access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Internet-facing services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Traffic visibility<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Lateral movement detection<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Protocol security<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network access control<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Encrypted traffic analysis<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><h3 aria-level=\"3\"><strong>6. Data Security Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">Data security posture focuses on the location, classification, access, storage, movement, and protection of sensitive information.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Data security posture management may assess:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Where sensitive data is stored<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Who can access it<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Whether it is encrypted<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">How it moves across systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Whether access is appropriate<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Whether data is exposed to third parties<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Whether data retention policies are followed<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><h3 aria-level=\"3\"><strong>7. IT Risk Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">IT risk posture considers risks affecting technology operations, availability, performance, governance, and resilience.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">This may include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">System outages<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unsupported technology<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Backup failures<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Configuration errors<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Capacity limitations<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Vendor dependencies<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Change management weaknesses<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Disaster recovery gaps<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><h3 aria-level=\"3\"><strong>8. Digital Risk Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">Digital risk posture extends beyond traditional IT environments to include an organization\u2019s broader digital presence.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It may cover:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Exposed domains<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Brand impersonation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Leaked credentials<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Public cloud assets<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Mobile applications<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Social media accounts<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">External attack surfaces<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Third-party digital services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><h3 aria-level=\"3\"><strong>9. Enterprise Risk Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">Enterprise risk posture\u00a0provides\u00a0an organization-wide view of technology, cybersecurity, operational, compliance, financial, and third-party risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">It helps leadership understand how different risks combine and affect critical business\u00a0objectives.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>10. Application Risk Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">Application risk posture evaluates exposure created by application code, software dependencies, APIs, access controls, and deployment configurations.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>11. Operational Technology Risk Posture:<\/strong><\/h3><p><span data-contrast=\"auto\">Operational technology risk posture focuses on industrial systems, control systems, production environments, critical infrastructure, and safety-sensitive operations.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c20598a elementor-widget elementor-widget-heading\" data-id=\"c20598a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Risk Posture Maturity Levels<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3b42699 elementor-widget elementor-widget-text-editor\" data-id=\"3b42699\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span class=\"TextRun SCXW229898331 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW229898331 BCX0\">Organizations can evaluate the maturity of their risk posture using the following model.<\/span><\/span><\/p><table data-tablestyle=\"MsoTableGrid\" data-tablelook=\"1696\" aria-rowcount=\"6\"><tbody><tr aria-rowindex=\"1\"><td data-celllook=\"0\"><b><span data-contrast=\"auto\"><span class=\"TextRun SCXW216673843 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW216673843 BCX0\">Maturity Level<\/span><\/span><\/span><\/b><\/td><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW210946449 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW210946449 BCX0\">Characteristics<\/span><\/span><\/strong><\/td><\/tr><tr aria-rowindex=\"2\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW38709891 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW38709891 BCX0\">Reactive<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW40247132 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW40247132 BCX0\">Risks are addressed mainly after incidents occur. Asset visibility and ownership are limited.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"3\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW1066180 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW1066180 BCX0\">Developing<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW138816047 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW138816047 BCX0\">Basic risk assessments and controls exist, but processes are inconsistent.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"4\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW61098058 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW61098058 BCX0\">Defined<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW183809095 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW183809095 BCX0\">Risk processes, ownership, controls, and reporting are formally documented.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"5\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW21715529 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW21715529 BCX0\">Proactive<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW113101526 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW113101526 BCX0\">Threat intelligence, business context, and continuous monitoring guide decisions.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"6\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW112364517 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW112364517 BCX0\">Adaptive<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW256398726 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW256398726 BCX0\">Risk posture is continuously assessed,\u00a0<\/span><span class=\"NormalTextRun SCXW256398726 BCX0\">validated<\/span><span class=\"NormalTextRun SCXW256398726 BCX0\">, and adjusted as threats and environments change.<\/span><\/span><\/td><\/tr><\/tbody><\/table><p><span class=\"TextRun SCXW41251674 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW41251674 BCX0\">An organization may have different maturity levels across different areas. For example, its network security posture may be proactive while its identity risk posture or cloud security posture\u00a0<\/span><span class=\"NormalTextRun SCXW41251674 BCX0\">remains<\/span><span class=\"NormalTextRun SCXW41251674 BCX0\"> developing.<\/span><\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd2427e elementor-widget elementor-widget-heading\" data-id=\"fd2427e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What is a Risk Posture Assessment?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e9ed216 elementor-widget elementor-widget-text-editor\" data-id=\"e9ed216\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">A risk posture assessment is a structured evaluation of an organization\u2019s current exposure to risk, the effectiveness of its controls, and its ability to respond to and\u00a0recover from\u00a0security incidents.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">A risk posture assessment may evaluate:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Critical assets<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Threats<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Vulnerabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Applications<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network architecture<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud infrastructure<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Third parties<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Security controls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Incident response capabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Recovery readiness<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Regulatory requirements<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Business impact<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Unlike a narrow vulnerability scan, a <a href=\"https:\/\/www.netwitness.com\/blog\/cybersecurity-assessment-checklist\/\" target=\"_blank\" rel=\"noopener\">risk posture assessment<\/a> considers the broader context surrounding a weakness.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3feb237 elementor-widget elementor-widget-heading\" data-id=\"3feb237\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How to Conduct a Risk Posture Assessment<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-de93300 elementor-widget elementor-widget-text-editor\" data-id=\"de93300\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><b><span data-contrast=\"auto\">1. Define the Scope: <\/span><\/b><span data-contrast=\"auto\">Determine which business units, systems, applications, identities, cloud environments, and third parties will be included.\u00a0<\/span><span data-contrast=\"auto\">The scope should reflect business priorities, regulatory obligations, and critical operations.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><b><span data-contrast=\"auto\">2. Identify Critical Assets:<\/span><\/b> <span data-contrast=\"auto\">Create\u00a0an accurate\u00a0inventory of:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Hardware<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Software<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Applications<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud resources<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data repositories<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">User accounts<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Privileged identities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Business services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Third-party connections<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Each asset should have an owner and a defined level of criticality.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><b><span data-contrast=\"auto\">3. Identify Relevant Threats:<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Determine which cyber threats are most likely to affect the organization.\u00a0<\/span><span data-contrast=\"auto\">Threat intelligence, industry trends, previous incidents, and business context can help identify relevant threat scenarios.<\/span><\/p><p><strong>4. Perform Vulnerability Identification: <\/strong><span data-contrast=\"auto\">Use vulnerability scanning, configuration reviews, code analysis, cloud assessments, pen testing, and penetration testing to\u00a0identify\u00a0weaknesses.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Testing should include both technical and process-related vulnerabilities.<\/span><\/p><p><b><span data-contrast=\"auto\">5. Analyze Attack Paths: <\/span><\/b><span data-contrast=\"auto\">Determine\u00a0whether attackers could combine multiple weaknesses to reach critical systems or data.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Attack path analysis should consider:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Network connectivity<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identity permissions<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Trust relationships<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Vulnerabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud roles<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Administrative access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Remote connections<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><b><span data-contrast=\"auto\">6. Evaluate Security Controls: <\/span><\/b><span data-contrast=\"auto\">Assess whether preventive, detective, and responsive controls are properly configured and\u00a0operating\u00a0effectively.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Security posture validation may include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Control testing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Attack simulation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Detection testing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Penetration testing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Incident response exercises<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Log coverage reviews<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Recovery testing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><b><span data-contrast=\"auto\">7. Assess Likelihood and Impact: <\/span><\/b><span data-contrast=\"auto\">Estimate how likely each risk scenario is and what its potential business impact could be.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Possible impacts include financial loss, data exposure, downtime, compliance penalties, and reputational damage.<\/span><\/p><p><b><span data-contrast=\"auto\">8. Calculate Residual Risk: <\/span><\/b><span data-contrast=\"auto\">Determine how much risk remains after existing controls are considered.<\/span><\/p><p><b><span data-contrast=\"auto\">9. Compare Risk with Risk Appetite: <\/span><\/b><span data-contrast=\"auto\">Identify\u00a0risks that exceed approved tolerance levels.<\/span><\/p><p><b><span data-contrast=\"auto\">10. Prioritize Remediation: <\/span><\/b><span data-contrast=\"auto\">Prioritize actions based on:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Asset criticality<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exploitability<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Threat relevance<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Business impact<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Existing controls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Regulatory exposure<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Remediation complexity<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><b><span data-contrast=\"auto\">11. Assign Ownership: <\/span><\/b><span data-contrast=\"auto\">Every material risk should have a responsible owner, remediation plan, due date, and escalation path.<\/span><\/p><p><b><span data-contrast=\"auto\">12. Monitor Continuously: <\/span><\/b><span data-contrast=\"auto\">Risk posture changes whenever the organization introduces new technology, identities, applications, vendors, or business processes.\u00a0<\/span><span data-contrast=\"auto\">Continuous monitoring helps\u00a0identify\u00a0these changes before they create unmanaged exposure.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2016558 elementor-widget elementor-widget-heading\" data-id=\"2016558\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How is Risk Posture Measured?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8ddcef6 elementor-widget elementor-widget-text-editor\" data-id=\"8ddcef6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Risk posture should be measured using a combination of technical, operational, and business metrics.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><h3 aria-level=\"3\"><strong>1. Exposure Metrics:<\/strong><\/h3><ul><li><span data-contrast=\"auto\">Number of internet-facing assets<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Number of unknown or unmanaged assets<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Critical vulnerabilities on important systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Exposed administrative services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Excessive user privileges<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unprotected sensitive data<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Third-party access paths<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Number of critical attack paths<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><h3 aria-level=\"3\"><strong>2. Security-Control Metrics:\u00a0<\/strong><\/h3><ul><li><span data-contrast=\"auto\">Multifactor authentication coverage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Endpoint protection coverage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Logging and telemetry coverage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Patch compliance<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Encryption coverage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network segmentation effectiveness<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Backup success rates<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Detection coverage<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Security-control validation results<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><h3 aria-level=\"3\"><strong>3. Operational Metrics:\u00a0<\/strong><\/h3><ul><li><a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/mean-time-to-detect\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"auto\">Mean time to detect<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Mean time to investigate<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Mean time to\u00a0contain<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Mean time to recover<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Percentage of risks with assigned owners<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Remediation SLA compliance<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Percentage of critical risks closed<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/incident-response-tabletop-exercises\/\" target=\"_blank\" rel=\"noopener\">Incident response exercise<\/a> results<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Number of repeated findings<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><h3 aria-level=\"3\"><strong>4. Business Metrics:\u00a0<\/strong><\/h3><ul><li><span data-contrast=\"auto\">Number of critical services at risk<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Estimated\u00a0financial impact<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Residual risk above tolerance<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Regulatory control gaps<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Potential operational downtime<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Third-party risk concentration<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Percentage of accepted risk requiring review<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">A single risk score can help summarize posture, but it should not replace the underlying evidence and context.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-707cd1c elementor-widget elementor-widget-heading\" data-id=\"707cd1c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Can Weaken Risk Posture?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-97ad744 elementor-widget elementor-widget-text-editor\" data-id=\"97ad744\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Several conditions can weaken an organization\u2019s risk posture:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Incomplete asset inventory<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unknown cloud resources<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Shadow IT<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unpatched vulnerabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Weak passwords<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Limited multifactor authentication<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Excessive privileges<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unmonitored service accounts<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Inadequate network segmentation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Limited endpoint visibility<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Misconfigured security tools<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unsupported legacy systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unencrypted sensitive data<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Inconsistent security policies<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Poor\u00a0third-party\u00a0oversight<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Untested incident response plans<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Inadequate security awareness<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Disconnected security data<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Point-in-time assessments<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Limited executive visibility<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Lack of business context<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8c25753 elementor-widget elementor-widget-heading\" data-id=\"8c25753\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How to Improve Risk Posture<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a3480bb elementor-widget elementor-widget-text-editor\" data-id=\"a3480bb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Improving risk posture requires coordinated action across technology, processes, people, and governance.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong>1. Improve Asset Visibility: <\/strong><span data-contrast=\"auto\">Maintain a continuously updated inventory of systems, applications, cloud resources, data, identities, and third-party connections.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Organizations cannot manage risks associated with assets they do not know exist.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong>2. Prioritize Business-Critical Risks: <\/strong><span data-contrast=\"auto\">Prioritize risks based on the business services, data, identities, and operations they could affect.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Risk posture management should focus on material exposure rather than the total number of findings.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong>3. Reduce the Attack Surface: <\/strong><span data-contrast=\"auto\">Remove unnecessary:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Accounts<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Applications<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Ports<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Permissions<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Internet-facing systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud resources<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Remote access paths<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Attack surface reduction limits the number of opportunities available to attackers.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong>4. Strengthen Identity Security:\u00a0<\/strong><span data-contrast=\"auto\">Improve identity risk posture through:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Multifactor authentication<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Least privilege<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Privileged access management<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Regular access reviews<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Service-account governance<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Strong authentication policies<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identity threat detection<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Continuous monitoring of privileged activity<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p aria-level=\"3\"><strong>5. Improve Network Security Posture: <\/strong><span data-contrast=\"auto\">Organizations can improve network security posture by:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Strengthening segmentation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Monitoring east-west traffic<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Restricting administrative access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Reviewing\u00a0firewall\u00a0rules<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Securing remote access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Detecting lateral movement<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Monitoring encrypted traffic<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Eliminating\u00a0insecure protocols<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p aria-level=\"3\"><strong>6. Improve Cloud Security Posture: <\/strong><span data-contrast=\"auto\">Cloud risk can be reduced through:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Continuous configuration monitoring<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Permission reviews<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Encryption<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud logging<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Workload protection<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Secure network configuration<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">API security<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud asset discovery<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Automated remediation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p aria-level=\"3\"><strong>7. Validate Security Controls: <\/strong><span data-contrast=\"auto\">Security posture validation helps confirm that controls work against realistic threats.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Organizations can\u00a0use:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Pen testing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Penetration testing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Breach and attack simulation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Red team exercises<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Detection validation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Control testing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Incident response exercises<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Recovery testing<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p aria-level=\"3\"><strong>8. Strengthen Incident Response: <\/strong><span data-contrast=\"auto\"><a href=\"https:\/\/www.netwitness.com\/blog\/mastering-the-art-of-incident-response\/\" target=\"_blank\" rel=\"noopener\">Improve incident response<\/a> by maintaining and testing:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Incident response plans<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Investigation playbooks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Communication procedures<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Escalation paths<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Containment actions<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Evidence collection processes<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Incident recovery plans<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Backup restoration procedures<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p aria-level=\"3\"><strong>9. Improve Security Awareness: <\/strong><span data-contrast=\"auto\">Security awareness should address the specific risks employees and administrators face.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Effective employee security awareness programs should include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Phishing simulations<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Role-based training<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Password guidance<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data handling procedures<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Incident reporting expectations<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Remote work security<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Social engineering awareness<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p aria-level=\"3\"><strong>10. Connect Security Data: <\/strong><span data-contrast=\"auto\">Security teams should correlate data from:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Networks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Endpoints<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud platforms<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Applications<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Email<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Threat intelligence<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Vulnerability tools<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Connected visibility helps teams\u00a0identify\u00a0relationships between separate events and understand the full scope of a\u00a0cyber attack.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong>11. Track Residual Risk: <\/strong><span data-contrast=\"auto\">Remediation should be measured by the reduction in residual risk, not simply by the number of closed tickets.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p aria-level=\"3\"><strong>12. Report Risk in Business Terms: <\/strong><span data-contrast=\"auto\">Leadership reporting should explain:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Which business services are affected<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">What could happen<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">How likely the event is<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Which controls are in place<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">What residual risk\u00a0remains<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Who owns the risk<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">What action is required<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c4dc818 elementor-widget elementor-widget-heading\" data-id=\"c4dc818\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Who is Responsible for Risk Posture?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d63f17f elementor-widget elementor-widget-text-editor\" data-id=\"d63f17f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span class=\"TextRun SCXW259470067 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW259470067 BCX0\">Risk posture is a shared responsibility across the organization.<\/span><\/span><\/p><table data-tablestyle=\"MsoTableGrid\" data-tablelook=\"1696\" aria-rowcount=\"11\"><tbody><tr aria-rowindex=\"1\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW194956783 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW194956783 BCX0\">Stakeholder<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW89995837 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW89995837 BCX0\">Primary Responsibility<\/span><\/span><\/strong><\/td><\/tr><tr aria-rowindex=\"2\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW250612214 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW250612214 BCX0\">Board and executive leadership<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW147140983 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW147140983 BCX0\">Define risk appetite and oversee material risk.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"3\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW138868966 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW138868966 BCX0\">CISO and security leadership<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW148385681 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW148385681 BCX0\">Establish cybersecurity strategy and risk priorities.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"4\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW29507722 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW29507722 BCX0\">Security operations teams<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW37588336 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW37588336 BCX0\">Monitor threats, detect incidents, and investigate exposure.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"5\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW21715529 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW21715529 BCX0\">IT teams<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW89677420 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW89677420 BCX0\">Maintain systems, configurations, access, and resilience.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"6\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW112364517 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW112364517 BCX0\">Cloud teams<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW47867247 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW47867247 BCX0\">Manage cloud security posture and cloud risk.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"6\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW91784737 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW91784737 BCX0\"><span class=\"TextRun SCXW102183732 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW102183732 BCX0\">Identity <\/span><\/span> teams<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW180297542 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW180297542 BCX0\">Protect identities, privileges, and authentication systems.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"6\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW91784737 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW91784737 BCX0\">Application teams<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW135399043 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW135399043 BCX0\">Address software, dependency, and application security risks.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"6\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW168812879 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW168812879 BCX0\">Risk and compliance teams<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW29940245 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW29940245 BCX0\">Maintain frameworks, policies, controls, and reporting.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"6\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW211780533 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW211780533 BCX0\">Business owners<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW166244732 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW166244732 BCX0\">Evaluate impact and accept or fund treatment of residual risk.<\/span><\/span><\/td><\/tr><tr aria-rowindex=\"6\"><td data-celllook=\"0\"><strong><span class=\"TextRun SCXW158487629 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW158487629 BCX0\">Employees and contractors<\/span><\/span><\/strong><\/td><td data-celllook=\"0\"><span class=\"TextRun SCXW61928978 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW61928978 BCX0\">Follow security policies and report suspicious activity.<\/span><\/span><\/td><\/tr><\/tbody><\/table><p><span class=\"TextRun SCXW156962573 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW156962573 BCX0\">Security teams can\u00a0<\/span><span class=\"NormalTextRun SCXW156962573 BCX0\">identify<\/span><span class=\"NormalTextRun SCXW156962573 BCX0\">\u00a0and explain\u00a0<\/span><span class=\"NormalTextRun SCXW156962573 BCX0\">risk<\/span><span class=\"NormalTextRun SCXW156962573 BCX0\">, but business leaders are often responsible for deciding whether residual risk should be accepted.<\/span><\/span><span class=\"EOP Selected SCXW156962573 BCX0\" data-ccp-props=\"{}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-81e8a0b elementor-widget elementor-widget-heading\" data-id=\"81e8a0b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Risk Posture Assessment Frameworks<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-90e2fd8 elementor-widget elementor-widget-text-editor\" data-id=\"90e2fd8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Organizations can use recognized frameworks to structure their\u00a0risk\u00a0posture assessments.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li aria-level=\"3\"><strong>NIST Cybersecurity Framework:\u00a0<\/strong><span data-contrast=\"auto\">The <a href=\"https:\/\/www.nist.gov\/cyberframework\" target=\"_blank\" rel=\"noopener nofollow\">NIST Cybersecurity Framework<\/a> helps organizations organize cybersecurity activities around governance, identification, protection, detection, response, and recovery.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>NIST Risk Management Framework:\u00a0<\/strong><span data-contrast=\"auto\">The NIST Risk Management Framework provides a structured process for managing security and privacy risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>ISO\/IEC 27001:\u00a0<\/strong><span data-contrast=\"auto\">ISO\/IEC 27001 provides requirements for\u00a0establishing\u00a0and maintaining an information security management system.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>ISO\/IEC 27005:\u00a0<\/strong><span data-contrast=\"auto\">ISO\/IEC 27005 provides guidance for information security risk management.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>CIS Controls:\u00a0<\/strong><span data-contrast=\"auto\">The CIS\u00a0Controls provide prioritized security safeguards for reducing common cyber risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>FAIR:\u00a0<\/strong><span data-contrast=\"auto\">Factor Analysis of Information Risk helps organizations quantify cyber risk in financial terms.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>MITRE ATT&amp;CK:\u00a0<\/strong><span data-contrast=\"auto\"><a href=\"https:\/\/attack.mitre.org\/\" target=\"_blank\" rel=\"noopener nofollow\">MITRE ATT&amp;CK<\/a> helps security teams map risk and detection coverage against known adversary tactics and techniques.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li aria-level=\"3\"><strong>COBIT:\u00a0<\/strong><span data-contrast=\"auto\">COBIT supports enterprise governance and management of information and technology.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">A security posture assessment\u00a0methodology\u00a0may combine multiple frameworks depending on the organization\u2019s industry, regulatory obligations, and\u00a0objectives.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4f378c1 elementor-widget elementor-widget-heading\" data-id=\"4f378c1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Risk Posture vs. Compliance<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c99ad92 elementor-widget elementor-widget-text-editor\" data-id=\"c99ad92\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Compliance and risk posture are related, but they are not the same.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Compliance demonstrates that an organization meets specific regulatory, contractual, or industry requirements.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><span data-contrast=\"auto\">Risk posture describes the organization\u2019s actual exposure to risk.<\/span><\/p><p><span data-contrast=\"auto\">An organization may pass an audit while still having:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Unknown assets<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Weak identity controls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unvalidated security controls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Incomplete logging<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unmonitored third-party access<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Critical attack paths<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Untested incident response plans<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Excessive cloud permissions<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Compliance can support a stronger <a href=\"https:\/\/www.netwitness.com\/cyber-glossary\/security-posture\/\" target=\"_blank\" rel=\"noopener\">security posture<\/a>, but it does not guarantee that cybersecurity risks are adequately managed.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2b8154a elementor-widget elementor-widget-heading\" data-id=\"2b8154a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Common Risk Posture Challenges<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b1bc300 elementor-widget elementor-widget-text-editor\" data-id=\"b1bc300\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Organizations often face the following challenges:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Rapidly changing cloud and hybrid environments<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Incomplete asset inventories<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Disconnected security tools<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Limited visibility across identities and cloud services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Too many unprioritized findings<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Lack of business context<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Inconsistent risk scoring<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Limited security resources<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Complex third-party dependencies<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Difficulty\u00a0validating\u00a0control effectiveness<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Overreliance on vulnerability severity scores<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Point-in-time assessments<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Unclear risk ownership<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Inconsistent executive reporting<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Rapid changes in the threat posture<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Extended security posture management can help organizations address these challenges by bringing multiple security domains into a more unified assessment and improvement process.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1777b44 elementor-widget elementor-widget-heading\" data-id=\"1777b44\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Best Practices for Risk Posture Management<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0e9736d elementor-widget elementor-widget-text-editor\" data-id=\"0e9736d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<ul><li><span data-contrast=\"auto\">Assess risk posture continuously rather than annually<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Maintain\u00a0an accurate\u00a0asset and identity inventory<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Prioritize exploitable risks affecting critical assets<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Evaluate attack paths, not only individual vulnerabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Validate preventive and detective controls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Compare residual risk with approved risk appetite<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Assign ownership to every material risk<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Test incident response and recovery procedures<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Integrate threat intelligence into risk analysis<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Track risk trends over time<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Report\u00a0business impact rather than only technical severity<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Review risk after major technology or business changes<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Include third-party and supply chain exposure<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Provide continuous security awareness training<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Use a documented security posture plan<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cc26d8a elementor-widget elementor-widget-heading\" data-id=\"cc26d8a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Related Terms &amp; Synonyms<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7b28ca4 elementor-widget elementor-widget-text-editor\" data-id=\"7b28ca4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<ul><li><b><span data-contrast=\"auto\">Risk Exposure:\u00a0<\/span><\/b><span data-contrast=\"auto\">The potential for an organization to experience loss or harm because of threats, vulnerabilities, and business dependencies.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Cyber Posture:\u00a0<\/span><\/b><span data-contrast=\"auto\">The organization\u2019s overall preparedness to prevent, detect, respond to, and recover from cyber threats.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Threat Posture:\u00a0<\/span><\/b><span data-contrast=\"auto\">The current set of threats, threat actors, techniques, and attack patterns relevant to an organization.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Attack Surface:\u00a0<\/span><\/b><span data-contrast=\"auto\">The collection of systems, applications, identities, interfaces, and services that attackers could target.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Risk Framework:\u00a0<\/span><\/b><span data-contrast=\"auto\">A structured approach for\u00a0identifying, assessing, prioritizing, treating, and monitoring risk.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Defense Posture:\u00a0<\/span><\/b><span data-contrast=\"auto\">The strength and readiness of an organization\u2019s defensive security capabilities.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Risk Resilience:\u00a0<\/span><\/b><span data-contrast=\"auto\">The ability to continue\u00a0operating, adapt, and recover when risk events occur.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Security Posture:\u00a0<\/span><\/b><span data-contrast=\"auto\">The overall strength and effectiveness of an organization\u2019s security controls, processes, and practices.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Threat Resilience:\u00a0<\/span><\/b><span data-contrast=\"auto\">The ability to withstand, respond to, and recover from threat activity.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Cybersecurity Posture:\u00a0<\/span><\/b><span data-contrast=\"auto\">The organization\u2019s ability to protect digital assets and manage cybersecurity risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Vulnerability Landscape:\u00a0<\/span><\/b><span data-contrast=\"auto\">The complete set of known and potential weaknesses across an organization\u2019s technology environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Enterprise Risk Posture:\u00a0<\/span><\/b><span data-contrast=\"auto\">An organization-wide view of financial, operational, cybersecurity, technology, compliance, and third-party risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Cybersecurity Risk Posture:\u00a0<\/span><\/b><span data-contrast=\"auto\">The current level of cybersecurity risk\u00a0based\u00a0on threats, vulnerabilities, asset exposure, business impact, and\u00a0security-control\u00a0effectiveness.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><b><span data-contrast=\"auto\">Organizational Risk Posture:\u00a0<\/span><\/b><span data-contrast=\"auto\">The combined level of risk across the organization\u2019s people, processes, technology, and business operations.<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b9b8efb e-flex e-con-boxed e-con e-parent\" data-id=\"b9b8efb\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a7b41d3 elementor-widget elementor-widget-heading\" data-id=\"a7b41d3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">People Also Ask<\/h2>\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c2498ac e-con-full e-flex e-con e-child\" data-id=\"c2498ac\" data-element_type=\"container\" data-e-type=\"container\" id=\"faq-section\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b7af59c elementor-widget elementor-widget-n-accordion\" data-id=\"b7af59c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;default_state&quot;:&quot;expanded&quot;,&quot;max_items_expended&quot;:&quot;one&quot;,&quot;n_accordion_animation_duration&quot;:{&quot;unit&quot;:&quot;ms&quot;,&quot;size&quot;:400,&quot;sizes&quot;:[]}}\" data-widget_type=\"nested-accordion.default\">\n\t\t\t\t\t\t\t<div class=\"e-n-accordion\" aria-label=\"Accordion. Open links with Enter or Space, close with Escape, and navigate with Arrow Keys\">\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1920\" class=\"e-n-accordion-item\" open>\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"1\" tabindex=\"0\" aria-expanded=\"true\" aria-controls=\"e-n-accordion-item-1920\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 1. What is security posture? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1920\" class=\"elementor-element elementor-element-7f4aa81 e-con-full e-flex e-con e-child\" data-id=\"7f4aa81\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1920\" class=\"elementor-element elementor-element-0a80958 e-flex e-con-boxed e-con e-child\" data-id=\"0a80958\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-afe789b elementor-widget elementor-widget-text-editor\" data-id=\"afe789b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Security posture is the overall strength and effectiveness of an organization\u2019s security controls, policies, processes, technologies, and response capabilities.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It reflects how well the organization can prevent, detect, investigate, respond to, and\u00a0recover from\u00a0security threats.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Risk posture is broader because it considers not only security controls but also threats, vulnerabilities, business impact, residual risk, and risk appetite.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1921\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"2\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1921\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 2. What is a security posture assessment? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1921\" class=\"elementor-element elementor-element-0cb3db5 e-con-full e-flex e-con e-child\" data-id=\"0cb3db5\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1921\" class=\"elementor-element elementor-element-f66bb0a e-flex e-con-boxed e-con e-child\" data-id=\"f66bb0a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a341ecb elementor-widget elementor-widget-text-editor\" data-id=\"a341ecb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">A security posture assessment is a structured evaluation of an organization\u2019s security capabilities, weaknesses, controls, and exposure.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It may\u00a0examine:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Security architecture<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identity controls<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Network security<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Endpoint security<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Cloud security<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Data protection<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Vulnerabilities<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Logging and monitoring<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Incident response<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Recovery readiness<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">The assessment identifies gaps and provides recommendations for security posture improvement.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1922\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"3\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1922\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 3. What is security posture management? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1922\" class=\"elementor-element elementor-element-5813b56 e-con-full e-flex e-con e-child\" data-id=\"5813b56\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1922\" class=\"elementor-element elementor-element-d9f0ad3 e-flex e-con-boxed e-con e-child\" data-id=\"d9f0ad3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-eb79a0d elementor-widget elementor-widget-text-editor\" data-id=\"eb79a0d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Security posture management is the continuous process of identifying, assessing, prioritizing, and remediating weaknesses across an organization\u2019s security environment.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It may include asset discovery, vulnerability management, configuration assessment, control validation, identity governance, cloud security, exposure management, and risk reporting.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1923\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"4\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1923\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 4. How do you conduct a security posture assessment? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1923\" class=\"elementor-element elementor-element-38bd880 e-con-full e-flex e-con e-child\" data-id=\"38bd880\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1923\" class=\"elementor-element elementor-element-f75101f e-flex e-con-boxed e-con e-child\" data-id=\"f75101f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1ae8c5a elementor-widget elementor-widget-text-editor\" data-id=\"1ae8c5a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">To conduct a security posture assessment:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ol><li><span data-contrast=\"auto\">Define the scope and\u00a0objectives.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Inventory critical assets and identities.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Review relevant threats.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Identify\u00a0vulnerabilities and configuration gaps.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Evaluate security controls.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Perform risk analysis.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Test detection and incident response capabilities.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Assess residual risk.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Prioritize remediation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Document findings and assign ownership.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Reassess regularly.<\/span><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1924\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"5\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1924\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 5. What is identity security posture management?  <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1924\" class=\"elementor-element elementor-element-606f103 e-con-full e-flex e-con e-child\" data-id=\"606f103\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1924\" class=\"elementor-element elementor-element-9ac2c15 e-flex e-con-boxed e-con e-child\" data-id=\"9ac2c15\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-da93424 elementor-widget elementor-widget-text-editor\" data-id=\"da93424\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Identity security posture management is the process of continuously\u00a0identifying\u00a0and reducing identity-related risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It evaluates user accounts, administrative privileges, service accounts, authentication methods, access policies, dormant identities, and unusual identity behavior.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">Its goal is to ensure that users and systems have only the access they require and that suspicious identity activity can be detected quickly.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1925\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"6\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1925\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 6. What is data security posture management? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1925\" class=\"elementor-element elementor-element-fc973b2 e-con-full e-flex e-con e-child\" data-id=\"fc973b2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1925\" class=\"elementor-element elementor-element-bdc6450 e-flex e-con-boxed e-con e-child\" data-id=\"bdc6450\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a802f44 elementor-widget elementor-widget-text-editor\" data-id=\"a802f44\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Data security posture management is the continuous discovery, classification, assessment, and protection of sensitive data across cloud and on-premises environments.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It helps organizations understand:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">Where sensitive data is stored<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Who can access it<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Whether it is encrypted<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Whether access is appropriate<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">How data is shared<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">Whether data is exposed<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1926\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"7\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1926\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 7. What is cloud security posture management? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1926\" class=\"elementor-element elementor-element-d99a925 e-con-full e-flex e-con e-child\" data-id=\"d99a925\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1926\" class=\"elementor-element elementor-element-7a6d731 e-flex e-con-boxed e-con e-child\" data-id=\"7a6d731\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c8d617a elementor-widget elementor-widget-text-editor\" data-id=\"c8d617a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Cloud security posture management is the continuous identification and remediation of configuration, compliance, identity, and security risks across cloud environments.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It can identify issues such as public storage, excessive permissions, unencrypted data, open network ports, missing logs, and insecure cloud configurations.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-1927\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"8\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-1927\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><h3 class=\"e-n-accordion-item-title-text\"> 8. How can encryption help improve your cybersecurity posture? <\/h3><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1402)\"><path d=\"M39.9375 19.9998C39.9375 31.0111 31.0111 39.9375 19.9998 39.9375C8.98853 39.9375 0.0617981 31.0111 0.0617981 19.9998C0.0617981 8.98853 8.98853 0.0617981 19.9998 0.0617981C31.006 0.0742111 39.9251 8.99328 39.9375 19.9998ZM2.05582 19.9998C2.05582 29.9101 10.0896 37.9438 19.9998 37.9438C29.9101 37.9438 37.9438 29.9101 37.9438 19.9998C37.9438 10.0896 29.9101 2.05582 19.9998 2.05582C10.0943 2.06714 2.06714 10.0943 2.05582 19.9998Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 22.3341C28.0909 22.7489 28.0485 23.3786 27.6342 23.7411C27.2195 24.1033 26.5897 24.0609 26.2272 23.6466L19.9998 16.5291L13.772 23.6469C13.4095 24.0617 12.7798 24.1036 12.3654 23.7415C11.9507 23.379 11.9083 22.7492 12.2709 22.3345L19.2492 14.3595C19.4383 14.143 19.7121 14.0189 19.9998 14.0189C20.2875 14.0189 20.5609 14.143 20.7504 14.3595L27.7284 22.3341Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1402\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 -1 -1 0 39.9375 39.9375)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"40\" height=\"40\" viewBox=\"0 0 40 40\" fill=\"none\"><g clip-path=\"url(#clip0_726_1407)\"><path d=\"M39.9375 20.0002C39.9375 8.98887 31.0111 0.0625 19.9998 0.0625C8.98853 0.0625 0.0617981 8.98887 0.0617981 20.0002C0.0617981 31.0115 8.98853 39.9382 19.9998 39.9382C31.006 39.9258 39.9251 31.0067 39.9375 20.0002ZM2.05582 20.0002C2.05582 10.0899 10.0896 2.05616 19.9998 2.05616C29.9101 2.05616 37.9438 10.0899 37.9438 20.0002C37.9438 29.9104 29.9101 37.9442 19.9998 37.9442C10.0943 37.9329 2.06714 29.9057 2.05582 20.0002Z\" fill=\"#001D3B\"><\/path><path d=\"M27.7284 17.6659C28.0909 17.2511 28.0485 16.6214 27.6342 16.2589C27.2195 15.8967 26.5897 15.9391 26.2272 16.3534L19.9998 23.4709L13.772 16.3531C13.4095 15.9383 12.7798 15.8964 12.3654 16.2585C11.9507 16.621 11.9083 17.2508 12.2709 17.6655L19.2492 25.6405C19.4383 25.857 19.7121 25.9811 19.9998 25.9811C20.2875 25.9811 20.5609 25.857 20.7504 25.6405L27.7284 17.6659Z\" fill=\"#001D3B\"><\/path><\/g><defs><clipPath id=\"clip0_726_1407\"><rect width=\"39.8756\" height=\"39.8756\" fill=\"white\" transform=\"matrix(0 1 -1 0 39.9375 0.0625)\"><\/rect><\/clipPath><\/defs><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1927\" class=\"elementor-element elementor-element-929e245 e-con-full e-flex e-con e-child\" data-id=\"929e245\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-1927\" class=\"elementor-element elementor-element-4ea6ffe e-flex e-con-boxed e-con e-child\" data-id=\"4ea6ffe\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d1214f0 elementor-widget elementor-widget-text-editor\" data-id=\"d1214f0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">Encryption improves cybersecurity posture by protecting sensitive information from unauthorized access.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">It can protect data:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><ul><li><span data-contrast=\"auto\">At rest in databases, devices, and storage systems<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">In transit across networks and cloud services<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">In backups<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">In applications<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><li><span data-contrast=\"auto\">On removable devices<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li><\/ul><p><span data-contrast=\"auto\">Encryption reduces the potential impact of a data breach because stolen information is more difficult to read without the correct decryption keys.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">However, encryption should be combined with strong identity controls, key management, monitoring, vulnerability management, and incident response.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<script type=\"application\/ld+json\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"1. What is security posture?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Security posture is the overall strength and effectiveness of an organization\\u2019s security controls, policies, processes, technologies, and response capabilities.\\u00a0It reflects how well the organization can prevent, detect, investigate, respond to, and\\u00a0recover from\\u00a0security threats.\\u00a0Risk posture is broader because it considers not only security controls but also threats, vulnerabilities, business impact, residual risk, and risk appetite.\"}},{\"@type\":\"Question\",\"name\":\"2. What is a security posture assessment?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A security posture assessment is a structured evaluation of an organization\\u2019s security capabilities, weaknesses, controls, and exposure.\\u00a0It may\\u00a0examine:\\u00a0Security architecture\\u00a0Identity controls\\u00a0Network security\\u00a0Endpoint security\\u00a0Cloud security\\u00a0Data protection\\u00a0Vulnerabilities\\u00a0Logging and monitoring\\u00a0Incident response\\u00a0Recovery readiness\\u00a0The assessment identifies gaps and provides recommendations for security posture improvement.\"}},{\"@type\":\"Question\",\"name\":\"3. What is security posture management?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Security posture management is the continuous process of identifying, assessing, prioritizing, and remediating weaknesses across an organization\\u2019s security environment.\\u00a0It may include asset discovery, vulnerability management, configuration assessment, control validation, identity governance, cloud security, exposure management, and risk reporting.\"}},{\"@type\":\"Question\",\"name\":\"4. How do you conduct a security posture assessment?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"To conduct a security posture assessment:\\u00a0Define the scope and\\u00a0objectives.\\u00a0Inventory critical assets and identities.\\u00a0Review relevant threats.\\u00a0Identify\\u00a0vulnerabilities and configuration gaps.\\u00a0Evaluate security controls.\\u00a0Perform risk analysis.\\u00a0Test detection and incident response capabilities.\\u00a0Assess residual risk.\\u00a0Prioritize remediation.\\u00a0Document findings and assign ownership.\\u00a0Reassess regularly.\"}},{\"@type\":\"Question\",\"name\":\"5. What is identity security posture management?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Identity security posture management is the process of continuously\\u00a0identifying\\u00a0and reducing identity-related risks.\\u00a0It evaluates user accounts, administrative privileges, service accounts, authentication methods, access policies, dormant identities, and unusual identity behavior.\\u00a0Its goal is to ensure that users and systems have only the access they require and that suspicious identity activity can be detected quickly.\"}},{\"@type\":\"Question\",\"name\":\"6. What is data security posture management?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Data security posture management is the continuous discovery, classification, assessment, and protection of sensitive data across cloud and on-premises environments.\\u00a0It helps organizations understand:\\u00a0Where sensitive data is stored\\u00a0Who can access it\\u00a0Whether it is encrypted\\u00a0Whether access is appropriate\\u00a0How data is shared\\u00a0Whether data is exposed\"}},{\"@type\":\"Question\",\"name\":\"7. What is cloud security posture management?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Cloud security posture management is the continuous identification and remediation of configuration, compliance, identity, and security risks across cloud environments.\\u00a0It can identify issues such as public storage, excessive permissions, unencrypted data, open network ports, missing logs, and insecure cloud configurations.\"}},{\"@type\":\"Question\",\"name\":\"8. How can encryption help improve your cybersecurity posture?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Encryption improves cybersecurity posture by protecting sensitive information from unauthorized access.\\u00a0It can protect data:\\u00a0At rest in databases, devices, and storage systems\\u00a0In transit across networks and cloud services\\u00a0In backups\\u00a0In applications\\u00a0On removable devices\\u00a0Encryption reduces the potential impact of a data breach because stolen information is more difficult to read without the correct decryption keys.\\u00a0However, encryption should be combined with strong identity controls, key management, monitoring, vulnerability management, and incident response.\"}}]}<\/script>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>What is Risk Posture? Risk posture is an organization\u2019s current level of exposure to cybersecurity, operationa [&hellip;]<\/p>\n","protected":false},"featured_media":17837,"template":"","class_list":["post-17836","glossary","type-glossary","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.netwitness.com\/ja\/wp-json\/wp\/v2\/glossary\/17836","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.netwitness.com\/ja\/wp-json\/wp\/v2\/glossary"}],"about":[{"href":"https:\/\/www.netwitness.com\/ja\/wp-json\/wp\/v2\/types\/glossary"}],"version-history":[{"count":13,"href":"https:\/\/www.netwitness.com\/ja\/wp-json\/wp\/v2\/glossary\/17836\/revisions"}],"predecessor-version":[{"id":18156,"href":"https:\/\/www.netwitness.com\/ja\/wp-json\/wp\/v2\/glossary\/17836\/revisions\/18156"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.netwitness.com\/ja\/wp-json\/wp\/v2\/media\/17837"}],"wp:attachment":[{"href":"https:\/\/www.netwitness.com\/ja\/wp-json\/wp\/v2\/media?parent=17836"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}