Strategic questions and cyber risk

1 Usually forecasting would be part of gathering information needed to analyse an organisation’s position and hence to move to the strategic planning stage.

2 A brand name is much more likely to be an implementation step. Strategic choice would deal with what products we intend to produce; design, branding, logos and advertising are detailed implementation steps.

3 It depends on the type of course. If you are merely teaching people about the different types of malware to be aware of then they need no coding knowledge at all. So CIMA members need to be aware of the threats and how virus checkers and firewalls can be defences. No coding knowledge is needed. However, if you are going to teach people in detail about how malware works (perhaps they are technical IT people who need to be on the lookout for it) they would would certainly have to be able to read code. If you can read it you can write it. Determined hackers will learn it anyhow.

It completely depends on the system. Also they are not mutually exclusive so if you were carrying out a pilot in one subsidiary you might well decide to phase it in eg sales and receivables first.

Also, for a pilot approach you need to have several branches or companies that will use the same system – otherwise you are not really piloting anything.

Direct changeover is high risk. All the other methods attempt to reduce the risk to an acceptable level. For example, parallel running lets you monitor the performance of the new system against the old and maintains the old system for a period as a fallback in an emergency.