Security Ratings: A Tool as Part of a Risk Management Program

As the world becomes more connected and the threat in cyber space continues to grow, financial institutions (FIs) have worked to more efficiently and effectively understand their own risk, as well as those of third parties or other supply chain players.

A number of providers now offer security ratings, also referred to as risk scores or risk ratings, as a way to measure an organization’s cybersecurity hygiene. They aim to provide a method for comparing two or more organizations on their cybersecurity implementation by using the same standards and controls. For businesses that are looking to evaluate their own security posture, or the risk exposure created by third parties, the existence of a single metric embodying the effectiveness of a cybersecurity program is a welcome development. The promise of a single score or rating, a financial institution can use to make an “apples to apples” comparison and objectively determine which third party potentially poses more risk of harm is enticing. Unfortunately, due to the inherent limitations, a security rating cannot provide a full picture of an organization’s cybersecurity program. However, they can provide valuable insight as part of a risk management program.

Security rating providers use a combination of data points collected or purchased from public and private sources and proprietary algorithms to articulate an organization’s security effectiveness into a quantifiable measure or score. As these ratings rely in part on the quality and breadth of the data they use, the variety of sources they consult and the dynamic nature of the environment they operate in, these ratings can potentially be inaccurate, irrelevant or incomplete. The goal of this paper is to help financial institutions understand what security ratings are, how they can be used as part of a risk management program, and identify other tools that can supplement security ratings.