Do I need a risk management program?

First you need to know what a risk management program is before you decide if you need one. Simply put, it’s a program that helps you identify the risks your business faces and provides guidance for addressing those risks. It’s not something you do once, instead it’s something you revisit at least annually and sometimes more often depending on your business and regulatory/compliance requirements you may face. The goal of the program is to help you be prepared to deal with common risks you face, have your tools and processes in place to respond if need be to an incident, and ensure that what you’ve put in place is effective, not just at the time you implement it but also in the future. Networks, systems, and people all change with surprising regularity in most companies. The periodic “health checks” ensure that your people, processes, and technology are all up to the task which you’ve assigned them.