{"id":536,"date":"2020-05-22T20:04:00","date_gmt":"2020-05-22T20:04:00","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=536"},"modified":"2024-01-09T22:45:47","modified_gmt":"2024-01-09T22:45:47","slug":"subsidiary-it-risk","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/subsidiary-it-risk\/","title":{"rendered":"You Can\u2019t Just Walk Away from Subsidiary IT Risk"},"content":{"rendered":"\n

If a product can help you evaluate third-party IT risk, it\u2019s not a huge stretch to imagine that same product could help you assess the security risk of your subsidiaries. But many of the chief information security officers (CISOs) we talk to who have tried to apply a security ratings service  to the challenge of monitoring their subsidiaries\u2019 security tell us this approach really hasn\u2019t worked for them. Here\u2019s why:<\/p>\n\n\n\n

There\u2019s a big difference in your level of responsibility for a subsidiary owned by your parent company and a third-party you are considering doing business with.<\/h2>\n\n\n\n

Network connections with either can introduce your organization to risk, of course, but you can\u2019t just walk away from the security issues of your subsidiaries the way you can from an independent vendor. Ultimately your organization has the responsibility for addressing the IT risks in your subsidiaries. Thus, you\u2019re not just looking to score<\/strong> the level of risk at your subsidiaries, you are looking to remediate and manage issues.<\/p>\n\n\n\n

Deep security expertise must be built into your subsidiary risk management approach.<\/h2>\n\n\n\n

Expertise that helps you prioritize the many exposures identified and guides subsidiary teams to quickly remediate those exposures. The lack of useful remediation guidance in security ratings products is perhaps the biggest complaint we hear from CISOs who have tried unsuccessfully to use a security ratings service to manage their subsidiary or corporate risk and are now looking for a better way to do it. A\u00a0product that is built for managing subsidiary risk<\/a>\u00a0should be able to identify:<\/p>\n\n\n\n