Information Security And Risk Management: Program Structure And Value Add

This discussion will follow this agenda:1.What is risk analysis and what is it supposed to do?2.What does it tell you and what does it not tell you?3.Why are there so many seemingly different “frameworks?,4.Is one better than another?5.Implementation of Risk Management as a “cultural” aspect in the org

Webinar Jan 01 2026, Thursday 01:00 PM EDT 60 Minutes Intermediate Level Code: GRC0000179

  • The Essence of Risk Analysis and Risk Management
     o Examples of Risk Management Frameworks
           - NIST RMF
           - FAIR
           - ISACA IT Risk
     o  Similarities and Differences
     o  How to evaluate, how to choose
     o  Program Development:  Evolution, not Revolution
     o  Remediation Strategy:  making informed mitigation choices
  • The Risk Analysis Process and its greater business value

  • CISO
  • CPO
  • Legal Counsel
  • IT Mgm
  • Operations officers
  • Compliance Officer
  • Privacy Officer
  • Security Officers

The idea of basing cybersecurity program actions on analyzing the various risks faced by an organization has been around for decades. Over time it has evolved and matured in its structure and approach. Analytical methods have emerged over time to define and structure the various elements and interactions that are germane. What remains as basic questions though is how to choose which method suits a given context and how to overcome the natural resistance to accepting results from this process that is often criticized for its perceived uncertainty when used to drive cybersecurity mitigation strategy.

Mr. Ross A Leo
Mr. Ross A Leo

Mr. Leo has trained over 15,000 CISSP candidates since 1998, and nearly 5000 in HIPAA privacy and security compliance since 2004, including law enforcement and attorneys.   Mr. Leo has provided Expert Witness services in several cases concerning compliance issues with regard to the impact of HIPAA on the subject matter and privacy violations.

Over the course Mr. Leo’s career since 1980, he worked in Security and Privacy as a contractor at Johnson Space Center from 1980 to 2002, in his final years in the role of Program Manager, Chief Security Architect and Chief Security Officer for Mission Operations for the Shuttle and Space Station programs.  From 2002 to 2006 he worked for the University of Texas-Galveston and Chief Information Security Officer and Director of IT for the Correctional Managed Care Division, establishing a complete security, privacy and compliance program for the organization.  Then he began a new chapter as a security and privacy consultant entirely devoted to Healthcare clients.

  • 90 Mins | Jan 01, Thu , 01:00 PM EDT

Getting to HIPAA compliance takes work, but work of a careful, thoughtful type. Instead of using an “all or nothin...

Mr. Ross A Leo By Mr. Ross A Leo

  • Oct 27, Monday | 01:00 PM EDT | 75 Mins

Tattoos were always associated with sailors, marines, and bikers. Not today. Over the past few decades, there has been r...

  • Oct 27, Monday | 01:00 PM EDT | 60 Mins

This webinar is for you if you ever find yourself in a difficult emotional situation where a cool head is necessary. Th...

  • Oct 27, Monday | 08:12 PM EDT | 90 Mins

Nisi earum est dicta ab perspiciatis expedita sint. Sint voluptatem deserunt autem rerum quia possimus ea asperiores. Fa...

By