Bob Chaput Author Blog
Enabling Board Cyber Risk Oversight
The Common Architecture of Every Credible Risk Assessment
Why Cyber Risk Governance Depends Less on Choosing the “Right” Methodology—and More on the Quality of the Assessment It Produces Introduction Imagine sitting in a board meeting six months after a major cyber incident. The immediate crisis has passed. Systems have been...
Boards Oversee Risk. Management Owns the Decision.
Cybersecurity failures are often described as technology failures. Sometimes they are. A missing patch mattered. A compromised credential mattered. A weak control mattered. A flawed configuration mattered. A delayed detection mattered. But many of the most...
Methodology Matters: Why Defensible Risk Assessment Is More Than a Compliance Checkbox
What’s the Problem? Many organizations still treat risk assessment as a compliance task. A rule requires it. An auditor asks for it. A customer expects it. An insurer wants to see it. A regulator may later review it. So, the organization produces something. A...
Most Organizations Can Produce a Risk Assessment. Fewer Can Defend One.
Introduction Recently wrapping up our latest Healthcare Enterprise Cyber Risk Management course at The University of Texas at Austin, I have been thinking and writing about a problem I now call Defensible Risk Assessment. Our Capstone Project requires students to...
Raising the Bar for HIPAA Risk Analysis and Risk Management
Introduction As my readers know, I have an affinity for risk analysis and risk management, which I often pose in the form of this question: How will you make informed, intelligent decisions about what safeguards you should invest in and implement until you understand...
Elevating the Role of the C-Suite and Board in Cybersecurity
“As the world is increasingly interconnected, everyone shares the responsibility of securing cyberspace.” ― Newton Lee “And it starts with C-suite and board accountability.” ― Bob Chaput Introduction In today’s rapidly evolving digital landscape, enterprise cyber risk...
Rethinking ECRM Funding to Enhance Cybersecurity Outcomes
ignment of business strategy and risk appetite should minimize the firm's exposure to large and unexpected losses. In addition, the firm's risk management capabilities need to be commensurate with the risks it expects to take. —Jerome Powell Introduction In an era...
Comments on the Proposed HIPAA Security Rule Revisions
The Role of Risk Literacy, Accountability, and Business Value in Strengthening Healthcare Cybersecurity “The most important defense is to instill a patient safety-focused culture of cybersecurity.” – John Riggi, Senior Advisor for Cybersecurity and Risk for the...
My 2025 Non-Prognostication
Never make predictions, especially about the future. —Casey Stengel Introduction I’ll leave all the 2025 prognostications to those more qualified and those who think they are. This post is simply a reflection on Enterprise Cyber Risk Management (ECRM) and the Chief...
The Healthcare Cyber Risk Problem: A Perfect Storm of Threats and Vulnerabilities
It’s just not about patient safety. It’s also about public safety and even national security. —Errol Weiss, chief security officer, Health Information Sharing and Analysis Center (H-ISAC) Introduction In recent years, the healthcare sector has become increasingly in...