Your IT service provider keeps systems running, installs updates and resolves problems. But who assesses whether the IT environment as a whole is configured to provide adequate security and reliability?
Good IT management is not the same as risk management
Many organisations rely on an internal IT administrator or an external IT service provider for their day-to-day IT. They make sure employees can work, systems remain available and technical problems are resolved. Updates are installed, backups are checked and security measures are maintained. When this goes well, it is understandable to feel confident that the IT environment is also secure.
Yet these are two different things. Good IT management concerns the execution of technical tasks. Risk management concerns whether the organisation has sufficient insight into what could go wrong, what the consequences would be and whether the measures in place are appropriate. A system can function correctly from a technical perspective and still pose a significant risk to business operations.
This does not mean the IT service provider is doing a poor job. It means that IT management and risk assessment are different responsibilities that need to complement each other.
Why risks are not always visible in day-to-day IT management
The day-to-day focus of IT management is usually on specific tasks. A fault needs resolving, a workstation needs setting up, an application needs updating or a user needs help. There are also recurring tasks, such as monitoring, patch management and checking backups. These activities are necessary and contribute directly to a reliable IT environment.
But many risks only become apparent when different components are considered together. A business application may be fully up to date while its database runs on an outdated system. A firewall may be configured correctly while external suppliers access the same network through a different connection. And a backup may complete successfully every night without anyone ever testing whether the entire application can be recovered within an acceptable timeframe.
None of these situations necessarily causes immediate problems during normal use. That is precisely why vulnerabilities can remain unnoticed for a long time. The question is not only whether individual measures work, but also whether the organisation understands how they work together to support the security and continuity of business operations.
The consequences determine how much a risk matters
A technical vulnerability is not equally serious for every organisation. Its significance depends on the system, the data being processed, the potential consequences and the measures already in place. A vulnerability in an isolated test environment usually has different implications from the same vulnerability in a system that is essential to daily production.
That is why a good risk assessment starts with an understanding of business operations rather than a list of technical problems. Which processes cannot withstand a prolonged outage? Which information is confidential or essential? Which applications, employees and suppliers does the organisation depend on? And what would the financial, operational or reputational consequences be if a system or service failed or was misused?
Only once these questions have been answered can the organisation determine which technical risks deserve priority. This prevents organisations from investing mainly in measures that appear technically attractive while more significant business risks receive insufficient attention.
What a production environment reveals
Imagine a manufacturer with a well-maintained IT environment. Workstations are managed, servers are updated and the firewall is actively monitored. The company also uses an ERP system for order processing and production planning. Several production machines receive remote support from external suppliers.
An assessment reveals that the machine suppliers have access through various connections set up over the years. Some connections are only used during maintenance; others are permanently available. It is not always clear who approved the access, which systems can be reached and who periodically reviews the connections.
Day-to-day IT services may work extremely well in this situation. Yet there is a risk that will not become apparent simply by checking faults, updates and availability. Unauthorised access to a production system can affect production continuity even when office IT is fully in order.
The relevant question is therefore not just whether the connections are technically secure. It is also about who decides which access is necessary, how the risks are assessed and who is responsible for changing or terminating connections.
Who assesses the IT service provider's work?
An organisation that outsources IT management trusts its service provider to act competently. That trust matters, but it does not remove the need for insight. The organisation must be able to establish whether the service meets its risk and continuity requirements. This takes more than an overview of completed updates, resolved tickets and available systems.
A risk assessment does not always have to be carried out by a separate external auditor. A competent IT service provider can perform risk analyses, identify shortcomings and propose improvements. However, the assessment must be sufficiently broad and look beyond the provider's own management activities. It must also consider the design of the environment, dependencies on third parties, existing exceptions and the consequences for business operations.
Findings also need to be presented transparently. An organisation must be able to understand which risks have been identified, which measures are recommended and which risks may remain. When an IT service provider assesses the environment it manages, it also needs to maintain sufficient critical distance. For significant or complex issues, an independent review can provide additional assurance.
The aim is not to constantly check up on an IT service provider or call it to account. The aim is to give the organisation reliable information so it can fulfil its responsibilities.
From identifying risks to demonstrable control
A risk assessment is not a one-off technical check. It is a process that turns findings into choices, measures and checks on implementation. Four steps are important.
Identify
Identify risks and dependencies.Assess
Assess likelihood, business impact and existing measures.Decide
Decide which measures are needed and which risks are acceptable.Follow up
Implement measures and check that they work.
Risks can become apparent through monitoring, vulnerability scans, changes to the IT environment, security incidents or periodic assessments. Changes within the organisation can also call for a new assessment, for example when a new application is introduced or a supplier is given access to systems.
Not every finding has the same significance. The assessment therefore considers the likelihood of a risk materialising, the potential consequences for business operations and the measures already in place. It must make clear why a risk deserves attention and what priority is appropriate.
A decision must be made based on the assessment. A risk can be reduced through additional measures, accepted subject to conditions or prompt a change in working practices. The IT service provider may handle the technical implementation, but the organisation must be involved in decisions that affect its business operations.
A decision only has value when the agreed measures are actually implemented and checked. Responsibilities, deadlines and results must therefore be documented. For significant risks, the organisation must also establish whether the measures have reduced the risk sufficiently.
The way these four steps work together determines whether risk assessment leads to effective risk management.
Why a list of findings is not enough
A technical assessment can produce dozens of findings. These might include missing updates, excessive access rights, insufficient network segmentation or outdated systems. Such an overview can be valuable, but it is not in itself a useful basis for decision-making.
What matters most to directors and management is what the findings mean. Which business processes are at risk? What could happen if a shortcoming is not addressed? Which measures are necessary and what investment do they require? And which risks will remain if certain measures are not taken?
A good report therefore connects technical findings to specific business risks. It distinguishes urgent problems from improvements that can be addressed through planned work. It also makes clear who is responsible for following up and when a further assessment will establish whether the risk is adequately controlled.
This requires cooperation between the IT service provider and the organisation. The IT specialist contributes technical knowledge and insight into vulnerabilities. The organisation contributes knowledge of business processes, dependencies and acceptable consequences. Only this combination produces an assessment that guides the right measures.
Changes call for new assessments
An IT environment never stands still. Applications are replaced, employees take on different responsibilities, suppliers change their services and organisations grow or redesign processes. Every change can affect existing security measures and dependencies.
A new cloud application, for example, may require additional integrations with business data. An acquisition may lead to connections between previously separate networks. And a change in how employees work remotely can affect access management and device security. A risk that was acceptable yesterday may no longer be acceptable today.
That is why risk assessment should not be confined to an annual review. Significant changes should prompt an assessment in advance of the risks they introduce and whether existing measures remain appropriate. Periodic assessments are still needed to identify vulnerabilities and dependencies that have developed gradually.
Responsibility remains with the organisation
IT management can be outsourced, as can security monitoring, technical assessments and the implementation of improvements. Responsibility for the consequences of IT risks, however, remains with the organisation itself. Directors do not need to understand every technical vulnerability, but they must be able to assess whether significant risks are being recognised, discussed and managed.
This means an organisation is entitled to expect more from its IT service provider than operational reports alone. It must be able to gain insight into relevant risks, the status of security measures and progress on improvements. It must also be clear which risks cannot be eliminated entirely and which decisions this requires the organisation to make.
Legislation and regulations, including the Dutch Cybersecurity Act (Cyberbeveiligingswet) for organisations within its scope, underline the importance of risk management and management accountability. But even without a specific legal obligation, managing IT risks is a normal part of responsible business practice. Business continuity and organisational reliability are sufficient reasons in themselves.
How can you gain more control over your IT risks?
Gaining more control does not necessarily start with an extensive security programme. A first step is to establish whether the organisation has an up-to-date, coherent view of its IT environment and its main dependencies. It can then assess which risks are relevant, which measures already exist and where further attention is needed.
A few specific questions can help. Is it clear which systems and business processes are critical? Are vulnerabilities and dependencies assessed periodically? Does management have insight into the consequences of significant findings? Are responsibilities and deadlines for improvements documented? And does anyone check whether the measures actually work?
The answers often provide a good indication of how mature the organisation's risk management is. Where insight is lacking, targeted work can establish which additional assessments or measures are necessary. The aim is not to eliminate every conceivable risk, but to make informed choices based on reliable information.
Good IT management deserves a good risk assessment
A well-managed IT environment is an important prerequisite for reliable business operations. But the quality of day-to-day IT management does not tell the full story about the risks an organisation faces. This requires systems, people, suppliers and business processes to be assessed together.
Ultimately, the value of a risk assessment does not lie in the number of vulnerabilities found or the length of the report. It lies in how well the organisation understands which risks matter, makes appropriate decisions and can establish that measures are actually being implemented.
The most important question is therefore not only who manages your IT, but also who makes sure you stay in control of the risks.
