Information security risk management

Due to the growing number of cyberattacks, modern organizations are increasingly exposed to information security (IS) risks that can lead to financial, reputational, or operational losses. Organizations that want to mitigate the negative impact must be proactive in ensuring their cyber security. An effective IS risk management process will help them in it, addressing the following questions: "What and how should we protect, and what would be a reasonable investment in it?". 

The team

Photographic portrait of Dmytro Lazuchenkov
Dmytro Lazuchenkov
Partner, Technology Risk Consulting Leader
Photographic portrait of yevheniia honcharenko
Yevheniia Honcharenko Yevheniia Honcharenko
Manager, Technology Risk Consulting

How EY can help

Our team of experts assists clients in developing and implementing an IS risk management process to timely identify, assess and handle risks that could compromise the confidentiality, integrity and availability of critical information.

Since this process is continuous and cyclical, as part of a collaborative project, we go through the first cycle together with the client's team to establish the process and prepare them for further independent work.

After a project with us, clients can answer the following questions:

  • What information exists and what is its level of criticality?
  • What losses may they face because of disclosure, unauthorized modification, or destruction of critical information?
  • What are the threats targeting critical information, its storage and processing locations, and what is the likelihood of these threats being realized?
  • What protective measures should be implemented to mitigate the potential damage or reduce the likelihood of threats being realized, and what is the associated cost of implementing these measures?

We help our clients understand what protective measures are economically feasible, considering information about the identified risks, their level and possible losses for the company. 

What we do

In order to successfully implement and establish the process of IS risk management, we perform the following tasks together with the client's team:

Why EY?

Our team has huge experience in the implementation of various information security projects, including information security risk management projects. The Ukrainian team has completed more than 10 such projects over the past 5 years for leading local companies in their field. To form our approach, we use leading practices of information security, in particular, ISO 27001, NIST Cybersecurity Framework, and others.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.