itSMF Switzerland - Blog #Compliance

The AI-native service desk: why 2025 changes everything for ITSM

Thu, 18 Dec 2025 22:03:23 +0100

Reading time: ~ 5 min.

Introduction

The inflection point has arrived. After years of incremental improvements to ticketing systems and process frameworks, IT service management is experiencing a fundamental transformation that will reshape how organizations deliver value through technology services.

When three forces converge

Something remarkable happens when artificial intelligence, experience analytics, and cloud-native architectures mature simultaneously. We're not talking about adding chatbots to service desks or implementing another monitoring tool. We're witnessing the emergence of intelligent, self-healing service platforms that predict problems before users notice them and resolve issues before tickets are created.

The numbers tell part of the story: the global AIOps market is projected to grow from $11-16 billion in 2025 to more than double by 2030. But market size doesn't capture the operational reality. Consider the ITSM team drowning in thousands of daily alerts from monitoring tools, where critical signals are buried in noise. Machine learning now aggregates, deduplicates, and correlates these alerts into actionable incidents automatically, reducing alert fatigue while improving mean time to resolve.

This is predictive incident management in practice: when your monitoring system forecasts a storage capacity breach three days in advance, your team shifts from firefighting to strategic problem prevention. The explosion of telemetry data from containerization, microservices, and multi-cloud complexity makes manual event management unsustainable. AIOps provides the essential layer of intelligent automation needed to maintain visibility and control.

The service desk gets intelligent

While AIOps operates behind the scenes, generative AI disrupts the most visible face of ITSM: the service desk. But implementation patterns reveal two distinct transformation vectors working in tandem.

AI copilots are augmenting human agents in ways that meaningfully reduce cognitive load. GenAI summarizes tickets, proposes contextually relevant responses, drafts knowledge articles from resolved incidents, and suggests similar historical cases — all in real-time during agent interactions. Early implementations show 2040% reductions in ticket volume through improved self-service and 15-25% improvements in agent efficiency.

Simultaneously, advanced virtual agents handle growing shares of Level-1 requests. The technology finally matches user expectations: conversational AI that understands context, handles multi-turn dialogues, and gracefully escalates to human agents when necessary.

The storytelling connection becomes clear: together, AIOps and GenAI create end-to-end intelligence across the service lifecycle. AIOps predicts and prevents incidents before they occur; when incidents do surface, GenAI accelerates resolution through intelligent agent assistance. The result is a service experience that feels simultaneously more proactive and more responsive.

By 2026, the "AI-first service desk" will be the reference model, where every interaction is mediated or augmented by AI. Human agents will focus increasingly on complex, emotional, and cross-domain cases that genuinely require human judgment and empathy.

Beyond IT: service management without boundaries

While AI captures headlines, enterprise service management quietly reshapes organizational boundaries. The expansion of ITSM practices into HR, facilities, legal, and other business functions reflects a deeper insight: structured service delivery, workflow automation, and knowledge management principles apply across all enterprise services, not just IT.

When employees access IT support, submit HR requests, book facilities, and request legal approvals through unified portals, organizational friction decreases significantly. This isn't empire building—it's practical efficiency pulled by employee experience initiatives and the need to support distributed, hybrid workforces with coherent digital journeys.

By 2026, ESM platforms will act as orchestration layers on top of multiple departmental tools, with AI-driven routing and knowledge reuse across domains. The connection to experience management becomes evident: when service management spans IT and business functions, experience metrics must span these domains too.

From measuring uptime to measuring outcomes

This brings us to perhaps the most fundamental shift: the evolution from service level agreements to experience level agreements. Traditional SLA metrics—uptime, response time, closure time—measure what IT delivers but not what users actually experience or value.

Digital employee experience monitoring tools now track end-user device health, application performance, and usage patterns, feeding this data into ITSM for proactive action. When DEX monitoring reveals that 40% of remote workers experience video conferencing latency above acceptable thresholds, ITSM teams can investigate and remediate before complaint tickets accumulate.

Experience level agreements tie metrics to end-user satisfaction and business outcomes. Instead of measuring "we restored service in 4 hours," XLAs ask "did this outage prevent salespeople from closing deals?" Machine learning models identify which infrastructure issues correlate with productivity drops, customer churn, or revenue impact—enabling ITSM teams to prioritize work based on actual business consequences.

The value question

As ITSM becomes more automated, AI-driven, and experience-oriented, a critical challenge emerges: how do we know which improvements actually create business value? This is where the Value Management Database concept enters, extending the traditional CMDB by explicitly linking services, products, and IT initiatives to measurable business outcomes—revenue, cost avoidance, risk reduction, and experience scores.

Consider a practical example: your ITSM team invests in AIOps to reduce MTTR. Traditional measurement tracks technical metrics. A VMDB approach links these technical metrics to business outcomes: how did faster incident resolution impact customer satisfaction scores, sales productivity, or support costs? Did the investment hypothesis prove correct?

By 2026, leading organizations will operate ITSM around value streams with closed feedback loops, transforming service management from a cost center focused on efficiency to a value center focused on outcomes.

The governance imperative

As AI capabilities pervade ITSM — from chatbots to AIOps and predictive analytics — governance becomes critical. ITSM leaders must understand how AI models triage tickets, recommend actions, or predict incidents, and ensure these decisions can be explained to stakeholders, regulators, and auditors.

Analyst guidance stresses treating AI in ITSM as a portfolio of products requiring lifecycle management: experimentation, validation, monitoring, periodic retraining, and decommissioning. Governance without measurement becomes compliance theater; measurement without governance creates uncontrolled risk.

The path forward

The transformation of ITSM from reactive, process-centric support to proactive, AI-driven, experience-oriented service orchestration is neither optional nor distant. It's happening now, driven by genuine technological capability and real business pressure.

For ITSM leaders, the strategic imperative is clear: begin the journey while maintaining operational excellence. Start with experience metrics that tie to business outcomes. Experiment with AI capabilities in low-risk areas. Extend service management practices where standardization creates obvious value. Invest in skills development so your team can operate in this new environment.

The organizations that thrive through 2026 won't be those with the most sophisticated technology— they'll be those that successfully blend technology, process, and people to deliver services that genuinely matter to their stakeholders. ITSM is evolving from keeping the lights on to powering business value.

The inflection point is here. The question isn't whether to transform—it's how quickly and effectively you can navigate the transformation while bringing your organization along on the journey.

Author: Andrea Cherubini, itSMF Switzerland President

itSMF Switzerland subscribed members could find on the member area the exclusive
e-book «Service Management trends 2025-2026» written by President Andrea Cherubini.
To get this premium content and benefit of all the membership advantages, join us now!

BECOME A MEMBER NOW

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The EU Artificial Intelligence Act: a structured step toward trustworthy AI

Wed, 26 Nov 2025 07:00:00 +0100

Reading time: ~ 2 min.

Background and legislative path of AI act

After nearly three years of negotiation, the European Union Artificial Intelligence Act (AI Act) has become the world’s first comprehensive regulatory framework for artificial intelligence. Initially proposed on April 21, 2021, the Act underwent multiple readings and amendments before final approval by the European Parliament on March 13, 2024 (EUR-Lex).

The Act reflects the EU’s commitment to a human-centric approach to technology, balancing innovation with fundamental rights. It aims to establish a harmonized, risk-based legal framework that ensures AI systems introduced in the European market are safe, transparent, and compliant with EU values such as privacy, dignity, and fairness.

Objectives and scope of the regulation

The AI Act’s overarching goal is to guarantee the safety and ethical use of AI while promoting innovation across the Union. Specifically, it seeks to:

Ensure that AI systems respect fundamental rights and European values;
Foster legal certainty to encourage investment and innovation;
Strengthen governance and oversight mechanisms for AI deployment;
Promote a single European market for legitimate, trustworthy AI solutions.

The law applies to developers, providers, and users of AI systems within the EU, as well as to entities outside the EU whose systems affect EU citizens — mirroring the extraterritorial principle also seen in modern data protection laws.

A harmonized risk-based framework

At the heart of the regulation lies its risk-based classification of AI systems.

The Act defines AI as “a machine-based system that operates with varying levels of autonomy and may exhibit adaptiveness after deployment, inferring from inputs how to generate outputs such as predictions, content, or decisions” — a future-proof definition intended to encompass evolving AI forms.

The regulation distinguishes between three primary risk categories:

Unacceptable risk – Systems that pose a clear threat to people's safety or rights are banned outright. These include AI used for social scoring (as in China’s credit system), real-time biometric surveillance in public spaces (except in narrowly defined cases), and manipulative or exploitative applications targeting vulnerable groups such as minors or disabled persons.
High risk – Systems that can significantly impact fundamental rights or safety are subject to strict obligations. Examples include AI used in critical infrastructure, education and employment, law enforcement, migration, or judicial administration (Annex III). Developers must perform conformity assessments, maintain traceability, and ensure data quality and transparency throughout the system’s lifecycle.
Limited and minimal risk – Systems such as chatbots or generative AI tools fall into this category and face transparency requirements (e.g., disclosing that the user is interacting with an AI, or labeling synthetic content such as deepfakes).

This graduated approach aims to ensure proportionate regulation, preventing excessive administrative burden for low-risk AI while tightening controls on high-impact applications.

AI growth led by transparency, privacy and compliance

Even for non-high-risk systems, the AI Act encourages providers to adopt voluntary codes of conduct addressing values like environmental sustainability, accessibility, and diversity.

The Act interacts closely with existing data protection laws such as Switzerland’s Federal Act on Data Protection (LPD) and the EU General Data Protection Regulation (GDPR). While these frameworks primarily safeguard personal data and individual consent, the AI Act takes a systemic approach, addressing collective and ethical risks associated with automated decision-making. Privacy protection remains integral, particularly where AI systems process biometric, behavioral, or sensitive personal data.

Privacy protection appears explicitly in Chapter X, where the Act underscores the human factor as a persistent challenge.

The regulation also underscores the importance of human oversight and accountability in AI operations. Human judgment remains essential to interpret AI outputs, detect bias, and prevent misuse — a reminder that compliance cannot rely solely on technical safeguards.

Notably, the AI Act specifies that anonymized or aggregated data, as referenced for instance in OpenAI’s Data Processing Addendum, must still be handled with caution to avoid potential re-identification and ensure adherence to applicable data protection standards.

AI Act enforcement and penalties

The AI Act introduces significant financial sanctions for non-compliance, modeled partly after the GDPR. Depending on the violation, penalties can reach up to €35 million or 7% of global annual turnover for prohibited practices, €15 million or 3% for breaches of obligations, and €7.5 million or 1.5% for providing misleading information to authorities.

Supervisory authorities will be empowered to issue warnings, suspend systems, or prohibit market access if risks are not adequately mitigated. This structure complements, rather than replaces, national laws like the LPD (FADP), which remain the cornerstone for personal data protection within Switzerland’s jurisdiction.

Fostering innovation: regulatory sandboxes

Recognizing the need to balance compliance with innovation, the Act establishes Regulatory Sandboxes — controlled environments that allow AI developers, particularly startups and SMEs, to test systems under regulatory supervision before full deployment.

This approach aims to lower entry barriers for smaller entities while ensuring alignment with safety and ethics standards. It embodies the EU’s vision of responsible innovation — where progress is guided, not constrained, by regulation.

What to expect

As the AI Act enters into force, Europe — and by extension, Switzerland, through market interoperability — faces a new era of AI governance. The coming years will likely bring adjustments, refinements, and resistance, as organizations learn to align innovation strategies with compliance obligations.

Over time, however, the framework could strengthen public trust in AI and encourage the development of transparent, human-centered systems. For businesses and institutions, success will depend on how effectively they integrate ethical awareness into technological design and governance.

In this sense, the AI Act may represent not only a legal milestone but also the foundation of a new digital social contract — one that defines how humans and intelligent machines can coexist responsibly in the years ahead.

Author: Mattia Munari

If you want to keep you up-to-date with the most recent news on this topic, don't forget to subscribe to our newsletter: you will get a monthly update with the most relevant and valuable content from our experts!

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Europe and Switzerland's strategic dilemma: tariffs, tech, and data governance

Wed, 05 Nov 2025 07:00:00 +0100

Reading time: ~ 4 min.

Introduction

The global economic landscape is increasingly marked by strategic competition that goes beyond simple trade rivalry. Tariffs, technological restrictions, and conflicting regulations are testing supply chains and companies’ operating models.

In this complex scenario, European businesses, including Swiss firms, must balance two opposing needs: maintaining historical ties with the United States while pursuing greater strategic autonomy.

US pressure: tariffs and technological influence

The economic and political alliance between Europe and the United States has long been a cornerstone. However, in recent years, protectionist policies have strained this relationship.

The U.S. has imposed tariffs not only to protect its industries but also as a geopolitical lever, creating uncertainty for companies operating across the Atlantic. This pressure also extends to the tech sector, where U.S. regulations exert significant control, often at the expense of European interests.

The European response: the «Latombe's case» as a sign of change

In response to these dynamics, Europe is seeking to assert its strategic independence.

A significant example is the initiative of French MEP Philippe Latombe, who questioned the legitimacy of data transfers to the United States by criticizing the Data Privacy Framework (DPF). This move is not just a technical dispute but a strong political signal reflecting the will to strengthen European digital sovereignty.

Latombe’s position highlights growing dissatisfaction with agreements that fail to adequately protect European data from external interference, despite regulations such as LPD/GDPR.

Companies at the centre of tension: a delicate balance

In this clash between geopolitical blocs, companies find themselves in a vulnerable position.

On the one hand, they must comply with strict European regulations, risking sanctions in the event of violations. On the other hand, they are heavily dependent on American technologies and services, such as cloud providers and essential software.

This creates a dilemma: adopt alternative solutions to comply with regulations, often at higher costs, or maintain existing dependencies, exposing themselves to legal and operational risks.

The most at-risk sectors and strategies for the future

The most vulnerable companies are those managing large volumes of sensitive data belonging to European citizens or relying on U.S. technological infrastructures. For these businesses, the challenge is not only compliance but also operational continuity. Possible solutions focus on three main directions:

Diversifying technological partnerships: reducing reliance on a single provider by exploring global alternatives.
Investing in European technologies: favouring cloud and software providers based in Europe, fully compliant with local regulations such as LPD/GDPR.
Advanced data management: implementing strategies to map and control data flows, minimizing extra-European transfers.

Strategic alignment between CEO and CIO: solutions in an uncertain context

In a landscape of extreme uncertainty, it is difficult for companies to directly influence political activities or anticipate geopolitical moves.

However, strategic alignment between CEOs and CIOs can guide concrete actions to mitigate risks. Business leaders can focus on diversifying markets and investing in EU-based digital solutions that are fully GDPR compliant. This approach not only reduces vulnerability but also strengthens operational resilience.

If the DPF were annulled in the future — a possibility that remains despite the court’s recent confirmation — there would no longer be a solid legal basis for transatlantic data transfers, leading to service disruptions, operational issues, and potential sanctions. In such a scenario, companies should prepare contingency plans, including:

Immediate assessment of data flows: identifying and quantifying transfers to the U.S. to prioritize interventions.
Accelerated transition to European providers: speeding up migration to EU-compliant alternatives such as sovereign clouds or hybrid solutions.
Development of data localization strategies: implementing data residency policies to keep both sensitive and non-sensitive data within European borders.
Training and internal governance: aligning IT teams and executives on risk protocols, with scenario-based disruption simulations.

This alignment between strategic vision (CEO) and technological implementation (CIO) transforms uncertainty into opportunity, promoting a «Europe-first» approach that balances innovation and compliance.

Conclusion: an opportunity for new European leadership

Geopolitical tensions, while creating uncertainty, may represent a unique opportunity for Europe. Current challenges push companies torethink their technological dependence and invest in a more autonomous digital ecosystem.

This shift toward greater sovereignty could foster the emergence of European leadership not only in regulation but also in technology. Companies that anticipate this trend by embracing digital sovereignty will not only protect themselves from future instability but also position themselves as key players in a new era, guided by values of autonomy and innovation.

Author: Angela Pedàlina

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

DORA Regulation and ISO Management Systems: a GRC approach

Wed, 06 Aug 2025 07:00:00 +0200

Reading time: ~ 2 min.

The Digital Operation Resilience Act (DORA) Regulation

The Regulation (EU) 2022/2554 of the European Parliament and the Council of 14 December 2022 on digital operational resilience for the financial sector entered into force on 16 January 2023 and it applies to EU financial service providers.

The Digital Operation Resilience Act (commonly known as DORA) amends all these regulations:

(EC) N. 1060/2009, commonly known as «Credit Rating Agencies»;
(EU) N. 648/2012, commonly known as «EMIR», OTC derivatives;
(EU) N. 600/2014, commonly known as «MIFIR», Markets in Financial Instruments;
(EU) N. 909/2014, commonly known as «CSDR»;
(EU) 2016/1011, commonly known as «Benchmark Regulation».

The requirements of digital resilience and security set by DORA

The Digital Operational Resilience Act (DORA) defines a set of requirements to ensure both digital resilience and security especially in the following chapters:

📘 I. General Provisions
📘 II. ICT Risk Management
📘 III. ICT Related Incident Management Process
📘 IV. Digital operational resilience test
📘 V. Managing of ICT third party risk
📘 VI. Information sharing arrengement

To manage these requirements, we can adopt – as usual – our GRC approach. These are the relevant ISO standards we can rely on:

ISO 38500 (Governance)
ISO 31000 (Risk Management)
ISO 37301 (Compliance)

The GRC approach provides a useful basis for addressing and integrating the main aspects of:

ISO 22301 (Resilience and business continuity)
ISO 27001 (Information security)
ISO 20000-1 (ICT services; such as: asset and configuration, management, threats and vulnerabilities)
ISO 27035 (incident and problem management)
backup and disaster recovery, etc.

Our infographic on the applicable ISO standards

To better figure out the «big picture» about the DORA regulation and the ISO Management Systems according to the suggested GRC approach, take a look at this infographic:

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

La resilienza aziendale: esempi pratici di attività ricorrenti e manutenzioni essenziali

Mon, 03 Mar 2025 12:05:39 +0100

Tempo di lettura stimato: ~ 4 min.

L'implementazione del concetto di resilienza aziendale all'interno dell'organizzazione

Nel secondo post della nostra serie dedicata alla resilienza aziendale, abbiamo visto come costruirla sia dentro sia fuori dell'area ICT di un'organizzazione.

Il terzo (e conclusivo) contributo si sofferma sul tema delle «attività ricorrenti e pratiche di manutenzione essenziali», fornendo una serie di esempi concreti che sono utili a capire come un'organizzazione possa effettivamente implementare il concetto di resilienza aziendale.

Gli esempi di attività ricorrenti e pratiche di manutenzione essenziale nell'implementazione della resilienza aziendale

Di seguito, alcuni esempi di attività ricorrenti e pratiche di manutenzione essenziali tramite le quali si concretizza il concetto di resilienza aziendale all'interno di un'organizzazione:

A. Monitoraggio e aggiornamento della valutazione dei rischi

Revisione periodica dei rischi aziendali: è cruciale effettuare una valutazione regolare dei rischi non ICT per identificare nuove minacce e adattare il piano di continuità operativa (BCP). Ciò include l'analisi delle variabili esterne come i cambiamenti normativi, le fluttuazioni economiche e l'evoluzione della supply chain.
Test e simulazioni: simulare scenari di crisi non tecnologici, come interruzioni della catena di approvvigionamento o emergenze logistiche, per valutare l'efficacia del piano di risposta e apportare miglioramenti basati sui risultati ottenuti.

B. Manutenzione dei processi operativi

Ottimizzazione dei processi: conduzione di audit periodici dei processi aziendali per verificare che le pratiche operative siano aggiornate e flessibili. Implementare miglioramenti continui per garantire che i processi possano adattarsi rapidamente ai cambiamenti di mercato o interni.
Revisione della logistica e dell'approvvigionamento: aggiornare costantemente le strategie logistiche per affrontare potenziali interruzioni e garantire un approvvigionamento stabile e sicuro.

C. Aggiornamento delle competenze del capitale umano

Programmi di formazione ricorrenti: pianificare sessioni di formazione periodiche per i dipendenti, mirate allo sviluppo delle competenze chiave come la gestione dello stress, il problem-solving e la leadership in situazioni critiche.
Feedback e miglioramento continuo: implementare meccanismi di feedback per monitorare l'efficacia delle formazioni e apportare modifiche ai programmi in base alle esigenze emergenti e alle nuove sfide.

D. Manutenzione della comunicazione interna ed esterna

Verifica dei protocolli di comunicazione: effettuare controlli regolari dei protocolli di comunicazione per garantire che siano adeguati alle esigenze aziendali e alle aspettative delle parti interessate. Ciò include l'aggiornamento delle linee guida per la gestione delle crisi e delle emergenze.

Simulazioni di comunicazione: realizzare esercitazioni per testare la capacità del team di mantenere una comunicazione chiara e efficace durante situazioni stressanti o eventi imprevisti.

E. Manutenzione della cultura e della resilienza

Valutazione periodica della cultura aziendale: monitorare attraverso sondaggi interni e incontri la percezione dei dipendenti riguardo alla cultura della resilienza e all'adattabilità dell'azienda. Assicurarsi che ci sia un allineamento tra i valori aziendali e le pratiche quotidiane.

Sessioni di team-building: organizzare regolarmente attività di team-building che incoraggino la collaborazione, la proattività e il pensiero creativo, fondamentali per mantenere alta la motivazione e la capacità di problem-solving durante le sfide.

F. Pianificazione della manutenzione preventiva

Piano di manutenzione annuale: strutturare un piano annuale che includa scadenze specifiche per la manutenzione di tutti gli aspetti sopra elencati. Questo piano dovrebbe prevedere revisioni trimestrali e un aggiornamento completo almeno una volta l'anno.

Indicatori di prestazione chiave (KPI): definire e monitorare KPI specifici per misurare l'efficacia delle attività di manutenzione e dei processi operativi, come il tempo di risposta alle emergenze o la capacità di mantenere la produttività durante le crisi.

La tabella riepilogativa di rischi, responsabilità ed azioni per rafforzare la resilienza aziendale

Tramite questa semplice tabella possiamo visualizzare e confrontare efficacemente i rischi individuati, nonché definire le responsabilità e stabilire quali azioni devono essere intraprese per rafforzare la resilienza aziendale.

Area di Resilienza	Tipo di Rischio	Impatto Potenziale	Probabilità di Occorrenza	Misure di Mitigazione	Responsabile	Priorità
Tecnologia (ICT)	Attacchi informatici	Alto	Alta	Sistemi di sicurezza avanzati, backup regolari	IT Manager	Alta
Software (ICT)	Malfunziona-menti software	Medio	Media	Test periodici e aggiornamenti	Responsabile QA	Media
Infrastruttu- ra (ICT)	Guasti hardware	Medio	Bassa	Contratti di manutenzione, hardware ridondante	Tecnico IT	Media
Supply Chain (NON ICT)	Ritardi nella fornitura	Alto	Media	Diversificazione fornitori	Responsabile Logistica	Alta
Risorse Umane (NON ICT)	Assenza di personale critico	Medio	Bassa	Piano di successione e formazione incrociata	HR Manager	Media
Ambiente (NON ICT)	Disastri naturali	Alto	Bassa	Assicurazioni e piani di evacuazione	Facility Manager	Alta

Ecco come leggere e utilizzare la tabella:

Area di Resilienza: Differenzia se l'elemento in questione è legato all'ICT o a fattori non ICT.
Tipo di Rischio: Identifica il rischio specifico per l'area indicata.
Impatto Potenziale: Valuta l'entità del danno in caso di manifestazione del rischio (es. basso, medio, alto).
Probabilità di Occorrenza: Stima la frequenza con cui il rischio potrebbe verificarsi (es. bassa, media, alta).
Misure di Mitigazione: Specifica le azioni da intraprendere per ridurre il rischio o gestirne l'impatto.
Responsabile: Indica la figura o il reparto responsabile dell'attuazione delle misure.
Priorità: Determina l'urgenza dell'intervento, basata sulla combinazione di impatto e probabilità (es. bassa, media, alta).

Autore: Aurelio Stefanoni

Senior Manager, iuXta Management Consulting

Per non perdere i prossimi aggiornamenti sul tema della resilienza aziendale, iscriviti subito alla nostra newsletter: ti proponiamo contenuti esclusivi, aggiornamenti costanti sulle nostre attività e benefici riservati alla nostra community.

ISCRIVITI ALLA NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Come costruire la resilienza aziendale fuori e dentro l'area ICT

Wed, 05 Feb 2025 07:00:00 +0100

Tempo di lettura stimato: ~ 5 min.

La resilienza aziendale: una sfida oltre l'area ICT

Nel precedente post abbiamo introdotto il tema della resilienza aziendale, soffermandoci sulla definizione della stessa, nonché su un confronto con la continuità operativa e, infine, le ragioni per le quali è diventata una necessitàper tutte le organizzazioni.

Oggi scopriamo come implementare la resilienza aziendale fuori e dentro l'area ICT: il nostro focus si concentrerà dapprima sull'ambito ICT, per poi spostarsi sulle altre aree dell'organizzazione che non rientrano nell'ICT.

Come costruire la resilienza aziendale nell'area ICT

Per costruire e potenziare la resilienza di un'azienda, è necessario adottare un approccio strutturato che includa strategie, processi e cultura aziendale orientata al cambiamento e all'adattamento. Di seguito sono riportate alcune delle pratiche chiave da considerare.

1. Valutazione dei rischi e pianificazione della continuità operativa

Il primo passo per costruire resilienza è comprendere i rischi a cui l’azienda è esposta.

Questo processo di valutazione dei rischi deve essere sistematico e coinvolgere tutte le aree aziendali, dalla sicurezza informatica alla gestione delle risorse umane, dalla supply chain alla sostenibilità ambientale.

Una volta identificati i rischi principali, è essenziale sviluppare un piano di continuità operativa che preveda azioni concrete per mantenere attive le funzioni critiche, anche in caso di eventi avversi.

2. Adattabilità e flessibilità nei processi

Un'azienda resiliente è in grado di adattare rapidamente i propri processi in risposta ai cambiamenti esterni.

Questo implica una cultura aziendale, in cui le persone sono incoraggiate a innovare, sperimentare e modificare approcci obsoleti.

La flessibilità organizzativa permette di riorientare risorse, implementare nuove tecnologie e cambiare direzione rapidamente quando necessario.

3. Formazione e sviluppo del capitale umano

Le persone sono la risorsa più importante di ogni azienda, e la resilienza di un’organizzazione dipende molto dalla resilienza dei suoi dipendenti.

Investire in formazione continua e in programmi di sviluppo professionale aiuta a creare una forza lavoro capace di affrontare le sfide con creatività e problem solving.

Inoltre, la costruzione di un ambiente di lavoro positivo, che supporti il benessere psicologico dei dipendenti, aumenta la loro capacità di affrontare lo stress e le difficoltà.

4. Comunicazione efficace

Una comunicazione chiara e tempestiva è cruciale.

Le aziende resilienti stabiliscono protocolli di comunicazione che assicurano che tutte le parti interessate (dipendenti, clienti, fornitori, investitori) siano informate in tempo reale sugli sviluppi e sulle azioni intraprese.

Una buona comunicazione evita malintesi e disinformazione, che potrebbero, ad esempio, alimentare il caos durante una crisi.

5. Tecnologie e infrastrutture robuste

In un mondo sempre più digitale, le infrastrutture tecnologiche sono un elemento chiave per garantire la resilienza.

Le aziende devono adottare tecnologie scalabili e sicure che possano sopportare eventi imprevisti senza compromettere la sicurezza dei dati e la continuità dei servizi.

Le soluzioni cloud, i backup sicuri e la cybersecurity sono componenti essenziali per prepararsi a possibili attacchi informatici o guasti tecnologici.

6. Cultura della resilienza

Infine, la resilienza deve diventare parte integrante della cultura aziendale.

Questo significa incoraggiare un atteggiamento positivo verso il cambiamento, premiare la proattività e la capacità di affrontare le sfide, e costruire un ambiente in cui il fallimento non è visto come una fine, ma come un'opportunità di apprendimento e crescita.

Le aziende resilienti sono quelle che riescono a trasformare le difficoltà in nuove opportunità di business.

Come costruire la resilienza aziendale fuori dell'area ICT

La resilienza aziendale richiede una comprensione completa di tutti i tipi di rischi che potrebbero minacciare l'operatività e la crescita, anche quelli che non riguardano direttamente la tecnologia (ad esempio, interruzioni nelle forniture, problemi logistici o cambiamenti nelle normative).

Di seguito, ecco le macroaree considerate:

La gestione dei rischi non tecnologici (supply chain, risorse umane, cambiamenti normativi, ecc.).
La flessibilità nei processi aziendali, inclusa l'adattabilità dei modelli di business.
La formazione del capitale umano, con un focus sullo sviluppo delle competenze, sul benessere psicologico e sulla gestione dello stress.
La comunicazione efficace, che riguarda la gestione delle crisi e il mantenimento di una comunicazione chiara con tutte le parti interessate.
La cultura della resilienza, che implica promuovere una mentalità positiva verso il cambiamento, l'innovazione e il fallimento come opportunità di crescita.
La manutenzione e le attività ricorrenti sono essenziali per garantire la resilienza aziendale nel tempo. Oltre a implementare strategie e processi iniziali, è importante investire in una manutenzione regolare, in una valutazione continua e in un miglioramento costante delle aree non ICT. Questi sforzi garantiscono che l'azienda sia sempre pronta ad affrontare sfide e cambiamenti, mantenendo una posizione competitiva e una crescita sostenibile.

1. Valutazione dei rischi e pianificazione della continuità operativa

Gestione dei rischi aziendali non tecnologici: questo include rischi legati alla supply chain, al capitale umano, alle risorse finanziarie e ai cambiamenti normativi.
Piano di continuità operativa (BusinessContinuityPlan): deve includere anche le aree non tecnologiche, come la gestione delle risorse umane, l'approvvigionamento e la logistica, per garantire che tutte le funzioni aziendali critiche possano continuare in caso di crisi, non solo quelle digitali.

2. Adattabilità e flessibilità nei processi

Flessibilità organizzativa e dei processi aziendali: le aziende resilienti devono essere in grado di adattare non solo le loro tecnologie, ma anche i loro processi operativi, come la gestione dei progetti, la logistica e la distribuzione. La capacità di riorientare le risorse umane e modificare rapidamente le pratiche operative è cruciale per rispondere a cambiamenti esterni (ad esempio, cambiamenti nei mercati, nuovi competitor o cambiamenti nelle normative).
Innovazione nei modelli di business: la flessibilità include la capacità di innovare e cambiare il modello di business per affrontare nuove opportunità o minacce, come la digitalizzazione dei processi aziendali o l'ingresso in nuovi mercati.

3. Formazione e sviluppo del capitale umano

Sviluppo delle competenze del personale: la resilienza di un'azienda dipende molto dalla resilienza delle sue persone. Investire nella formazione continua per sviluppare competenze di problem-solving, leadership e gestione dello stress aiuta a creare un ambiente di lavoro preparato ad affrontare situazioni difficili. La formazione deve essere orientata a gestire il cambiamento, ad affrontare le sfide con creatività e a mantenere la calma in situazioni di stress.
Benessere psicologico e supporto ai dipendenti: creare un ambiente di lavoro che promuove il benessere psicologico, che supporta la gestione dello stress e che offre supporto durante le crisi è essenziale per garantire che i dipendenti siano in grado di affrontare le difficoltà in modo positivo.

4. Comunicazione efficace

Comunicazione interna e con le parti interessate: la capacità di mantenere una comunicazione chiara, tempestiva e trasparente è fondamentale. Le aziende resilienti stabiliscono protocolli di comunicazione non solo con i dipendenti, ma anche con clienti, fornitori, investitori e altre parti interessate. Una buona comunicazione aiuta a prevenire il caos e a mantenere l'orientamento durante i periodi difficili.
Gestione delle crisi e dei conflitti: la resilienza aziendale richiede una gestione efficace dei conflitti e delle crisi interne. Essere in grado di comunicare chiaramente e di prendere decisioni rapide può ridurre l'incertezza e migliorare la risposta aziendale durante eventi imprevedibili.

5. Cultura della resilienza

Cultura aziendale orientata al cambiamento: la resilienza deve diventare parte integrante della cultura aziendale. Questo significa sviluppare una mentalità che non vede il fallimento come una fine, ma come un'opportunità di apprendimento. Le aziende devono promuovere una cultura in cui il cambiamento e l'incertezza sono affrontati in modo positivo, con un focus sull'agilità e sull'adattamento continuo.
Incoraggiare proattività e problem-solving: una cultura resiliente premia le persone che anticipano i problemi, che sono in grado di adattarsi rapidamente e che sono motivate a trovare soluzioni creative anche in tempi difficili.

6. Manutenzione e attività ricorrenti

Per garantire che le aree non ICT siano efficacemente gestite e migliorate nel tempo, è fondamentale implementare un programma di manutenzione e attività ricorrenti. Questi interventi servono a mantenere un alto livello di operatività, prevenire problemi e facilitare una risposta rapida alle emergenze.

Autore: Aurelio Stefanoni

Senior Manager, iuXta Management Consulting

Nel prossimo post, prenderemo visione di alcuni esempi pratici di attività ricorrenti e di manutenzioni essenziali per l'implementazione della resilienza aziendale..

ISCRIVITI ALLA NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

La resilienza aziendale: che cos'è, perché è indispensabile e come implementarla

Wed, 08 Jan 2025 06:00:00 +0100

Tempo di lettura stimato: ~ 4 min.

Che cos'è la resilienza aziendale?

Per comprendere il significato di resilienza aziendale possiamo prendere in prestito le accezioni di «resiliente» che troviamo nell'ambito industriale.

Un metallo è resiliente poiché oppone una certa resistenza a rottura per sollecitazione dinamica. Allo stesso modo, un tessuto è resiliente poiché riprende, dopo la deformazione, il suo aspetto originale.

La resilienza aziendale è la capacità di affrontare e gestire il rischio in modo strategico, trasformando le sfide in opportunità per garantire stabilità, adattabilità e crescita anche nei momenti contraddistinti da incertezza.

La differenza tra resilienza aziendale e continuità operativa

Per comprendere la differenza tra i concetti di resilienza aziendale e continuità operativa (o business continuity) – che sono comunque correlati tra di loro – possiamo riferirci alle definizioni contenuti negli standard ISO 22316:2017 eISO 22300:2018.

Secondo lo standard ISO22316:2017 la resilienza aziendale è «la capacità di un'organizzazione di ammortizzare e adattarsi in un ambiente in continua evoluzione per raggiungere i suoi obiettivi, sopravvivere e prosperare».

Secondo lo standard ISO22300:2018 la continuità operativa è «la capacità di un'organizzazione di continuare a fornire prodotti o servizi a livelli predefiniti accettabili dopo un'interruzione».

In estrema sintesi, nel concetto di «resilienza aziendale »possiamo intravvedere una connotazione di livello strategico e una visione di lungo termine; mentre in quello di «continuità operativa» c'è una chiara componente di contingenza.

Perché la resilienza aziendale è indispensabile?

Nel contesto odierno di rapidi cambiamenti tecnologici, economici e sociali, le aziende si trovano ad affrontare sfide sempre più imprevedibili.

Crisi economiche, disastri naturali, pandemie, attacchi informatici, cambiamenti normativi e turbolenze politiche sono solo alcune tra le numerose e differenti incertezze che possono minacciare la continuità operativa e la crescita aziendale.

In questo scenario, la resilienza aziendale è diventata una competenza cruciale, non solo per superare le difficoltà, ma per prosperare in un ambiente incerto e complesso.

Le aziende devono quindi svolgere un'analisi su:

resilienza informatica ICT (Information and Communication Technology);
resilienza organizzativa (non ICT)

che, per diversi motivi cruciali, contribuiscono alla sostenibilità, sicurezza e competitività dell'azienda.

Come implementare la resilienza aziendale

A questo punto, sorge spontanea una domanda: come si può implementare la resilienza in azienda?

Per implementare efficacemente il concetto di resilienza aziendale, ecco la nostra guida suddivisa in 7 punti che permette alle organizzazioni di gestire la preparazione e l'adattamento ai cambiamenti:

1. Protezione delle operazioni e continuità del business

L'analisi della resilienza serve a garantire che l'azienda possa continuare a operare anche in situazioni di crisi, come guasti tecnici, attacchi informatici, interruzioni della catena di fornitura o disastri naturali. Identificare e mitigare questi rischi permette di mantenere la continuità operativa, proteggendo così i profitti e la reputazione aziendale.

2. Sicurezza e protezione dei dati

Le infrastrutture ICT sono sempre più bersagliate da minacce informatiche come attacchi ransomware, phishing e altre forme di cybercrime. Analizzare la resilienza ICT aiuta le aziende a implementare misure di sicurezza efficaci, garantendo la protezione di dati sensibili e il rispetto delle normative sulla privacy.

3. Adattabilità alle crisi e cambiamenti improvvisi

L'analisi della resilienza, sia ICT che non ICT, permette alle aziende di sviluppare strategie per adattarsi rapidamente ai cambiamenti imprevisti, come pandemie o sconvolgimenti economici. Questo tipo di preparazione aiuta a ridurre i tempi di reazione e a minimizzare l'impatto negativo sulle attività aziendali.

4. Compliance e conformità normativa

Le normative in molte giurisdizioni richiedono che le aziende adottino misure per garantire la sicurezza e la resilienza delle loro operazioni. Un'analisi dettagliata aiuta a conformarsi a queste leggi e regolamenti, evitando sanzioni e garantendo che l'azienda possa operare legalmente.

5. Prevenzione delle perdite economiche

Le interruzioni possono comportare gravi perdite economiche non solo a causa dell'interruzione diretta delle operazioni, ma anche per il danno alla reputazione e alla fiducia dei clienti. Un'analisi di resilienza permette di sviluppare piani di continuità e strategie per minimizzare i costi associati alle emergenze.

6. Vantaggio competitivo

Le aziende che dimostrano una forte resilienza possono posizionarsi meglio nel mercato rispetto ai concorrenti. Investire nella capacità di recuperare rapidamente da interruzioni o crisi contribuisce a rafforzare la fiducia degli stakeholder, rendendo l'azienda più attrattiva per partner commerciali, investitori e clienti.

7. Approccio integrato

Analizzare la resilienza sia ICT che non ICT è fondamentale per un approccio olistico. La resilienza ICT riguarda la robustezza dei sistemi informatici, dei software e delle reti. La resilienza non ICT, invece, comprende fattori come risorse umane, gestione delle strutture, supply chain (fornitori) e processi aziendali.

In definitiva, solo un'analisi congiunta tra ICT e non ICT assicura che l'azienda sia preparata a fronteggiare un'ampia gamma di rischi.

Autore: Aurelio Stefanoni

Senior Manager, iuXta Management Consulting

Nel prossimo post, analizzeremo in dettaglio come implementare la resilienza aziendale all'interno e all'esterno dell'area ICT.

ISCRIVITI ALLA NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Medical devices and health software: a closer look to the related ISO standards

Mon, 09 Dec 2024 22:35:01 +0100

Reading time: ~ 3 min.

Medical devices and health software: data protection and security and the main related ISO standards

The growing availability of technological solutions that can be implemented in the health industry products and services brings new challenges regarding the need of compliance to high levels of protection and security of (sensitive) data.

To manage these needs of data security and protection related to medical devices and health softwares, we can consider in particular the IEC 81001-5-12021.

In the next lines, we're going to understand how this standard can be relevant and its main correlations with the European Regulations and other ISO standards.

Medical devices and health software: IEC 81001-5-1:2021 standard

The IEC 81001-5-1:2021 on «Health software and health IT systems safety, effectiveness and security – Part 5-1: Security – Activities in the product life cycle» defines the life cycle requirements in health software development and maintenance.

This standard provides a common framework for secure health software life cycle processes, thanks to its set of processes, activities and tasks. These are the main sections of the documentation:

✅ 1 Scope

✅ 2 Normative references

✅ 3 Terms and definitions

✅ 4 General requirements

✅ 5 Software development process

✅ 6 Software maintenance process

✅ 7 Security risk management process

✅ 8 Software configuration management process
✅ 9 Software problem resolution process

✅Annex A (informative) Rationale
✅Annex B (informative) Guidance on implementation of security life cycle activities
✅Annex C (informative) Threat modelling

✅Annex D (informative) Relation to practices in IEC 62443-4-1:2018
✅ Annex E (informative) Documents specified in IEC 62443-4-1

✅Annex F (normative) Transitional health software
✅ Annex G (normative) Object identifiers

The purpose of IEC 81001-5-1:2021 standard is to increase the health software cybersecurity through activities and tasks in the health software life cycle processes as well as improving security in software life cycle processes themselves.

IEC 81001-5-1 standard and the relationship with European regulation and ISO standards

If we take a closer look at the IEC 81001-5-1 standard we can detect some natural correlations with the European regulation on Medical devices, the MDR 2017/745. The correlations are detectable both on software embedded into medical devices as well as for SaMD (Software as a Medical Device).

We can find also relevant correlations with ISO/IEC 20000-1:2018 standard on «Information technology — Service management Part 1: Service management system requirements», in this case regarding the common requirements in the software developement cycle.

If we take a glimpse in the future, we can imagine that there will be stronger correlations between the management of the software cycle and the security requirements in the development of AI solutions in medical device industry.

In this case, the correlation is between IEC 81001-5-1 and the ISO/IEC 42001:2023 standard on «Information technology — Artificial intelligence — Management system».

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us on our social media channels or subscribe to our newsletter: every month, you'll get valuable content from our experts.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Key features of an effective data assessment platform for compliance and flexibility

Wed, 13 Nov 2024 07:00:00 +0100

Reading time: ~ 4 min.

In our previous article, «Data Assessment in Cybersecurity: A Strategic Pillar for Compliance and Risk Management», we explored the essential role of Data Assessment in Cybersecurity and data privacy. We discussed how aligning a Data Assessment strategy with international standards – like NIST 2.0 and ISO 27001 – as well as privacy frameworks (e.g. GDPR; Swiss FADP aka LPD-DSG-LPD; Bahrain’s Data Protection Law), can help build a strong compliance foundation.

But in reality, even starting with the best methodological approach, many SMEs, and even larger enterprises, find the costs and effort of Data Assessment a barrier to implementing effective data management policies, despite recognizing the risks of non-compliance and low quality data assets.

Why not consider automated tools to streamline the initial data assessment phase?

From data chaos to compliance: retrospective assessment of unorganized data

Over time, many organizations accumulate data without a clear structure or strategy, making retrospective data assessment a complex and costly endeavor. Typically, this involves sorting through years of data across various systems and data format.

An effective data assessment platform should identify, organize, and secure both structured data (like databases and spreadsheets) and unstructured data (such as emails, documents, and multimedia files).

Finding the best fit: core considerations for data assessment platforms

The diagram in Pic.1 illustrates how a well-integrated data governance framework, supported by a data assessment platform, enables comprehensive Data Management. At the center of this framework is a core repository that organizes metadata from various structured and unstructured sources, such as Databases, Emails, File Shares, SaaS Applications, and Cloud storage.

Following the NIST 2.0 RDaF model, data moves through each stage of its life cycle – planning, generating/acquiring, processing/analyzing, sharing/using, preserving/discarding, and envisioning – within a controlled environment (for more information, refer to our «Data Assessment»).

Surrounding this central repository are essential data management functions that a data assessment platform should support Data Management Policy, Data Discovery, Data Classification, Data Profiling, Data Risk Assessment, and Data Consolidation.

When integrating, data assessment platforms should be designed to offer direct APIs or, where necessary, customizable interfaces that facilitate integration with other data governance tools (note: data assessment platforms don’t always include some data governance features like Access Management).

As data management systems evolve, certain capabilities might become critical:

Data access governance: integrates with access control systems to enhance security;
Business intelligence tools: enables seamless data transfer for analytics purposes;
Data transformation tools: prepares data for application across various platforms;
Data cataloging: syncs with data inventories to maintain consistency;
Remediation tools: supports automated issue detection and resolution.

Essential criteria for a robust data discovery platform

To guide the selection of an effective data assessment platform, we’ve summarized the critical features that support comprehensive data assessment projects:

Multi-source scanning: as data often resides in various locations such as cloud storage, on-premises servers, network drives, emails, and numerous SaaS applications, an effective platform should be able to scan and gather data from both structured and unstructured sources across these diverse environments, ensuring cross-platform compatibility that suits a range of system setups.
Non-intrusive scanning: the platform should be capable to perform its tasks without disrupting the performances of the existing systems or, if requiring additional hardware, to be implementable without major changes to the existing infrastructure. For small and medium-sized businesses, this can be of strategic relevance.
Scalable Architecture: a robust data discovery platform should adapt to increasing data volumes, supporting everything from small networks to expansive multi-location setups. This flexibility ensures that the platform remains effective as your data needs evolve, enabling continued management of both structured and unstructured data.
Cloud data repository or on-prem data storage? The decision between cloud storage and on-premises storage depends largely on an organization’s security needs and budget. Both options have advantages and limitations, which can vary based on country, industry, or specific legal requirements. Since there isn’t a single best answer, managed service providers should ensure they have a flexible tool to support both setups. If you’re the end client, start by reviewing your company’s requirements to choose the option that best aligns with your regulatory and operational needs.
AI-powered data classification: an effective platform should classify data based on type, sensitivity, and compliance needs using advanced AI rather than simple keyword matching. This approach minimizes false positives and misplaced content or classification, allowing teams to concentrate on protecting sensitive data rather than manually sorting it.
Integration with other third parties solutions: Data Assessment is just one side of integrated data policy framework implementation, and not all the products the market offers have built in policies for data access, monitor data usage, internal workflows and comprehensive reporting.
Browser-based access: with a browser-based interface, your data discovery platform can be securely accessed from any device with an internet connection, eliminating the need for specialized software. This feature ensures that team members can manage and monitor data from virtually anywhere, on any device.
Managed service options functionalities: Companies with limited resources often seek to outsource services, such as CISO-as-a-service or even entrusting an external provider with the entire data assessment project. Platforms with Managed Service Provider (MSP) capabilities offer remote monitoring, automated updates, and dedicated support, all managed by a third-party team. This option is especially advantageous for smaller organizations, as it provides professional data management without the cost and effort of in-house support.
Open IT architecture: a robust platform should integrate smoothly into your existing infrastructure, avoiding the need for complex server setups or additional software licenses. Compatibility with open-source software is an advantage, especially for small businesses with simple IT configurations. Such flexibility allows even SMEs with modest IT setups to manage substantial amounts of data effectively, supporting compliance without excessive expense or complexity.

Data assessment project strategies: is there a standard approach across sizes and sectors?

Data assessment needs vary widely by business size. Small and medium-sized enterprises often handle significant volumes of unstructured data for compliance, while larger organizations benefit from structured systems and dedicated teams for data governance.

Larger firms also rely on complex infrastructures that support advanced platforms, organizing data across storage systems like SAP or digitization activities.

Sector-specific needs play a role too. Finance, manufacturing, and services face unique regulatory demands, but privacy frameworks are driving a transversal approach to data structuring across industries, regardless of sector.

So, how should we begin a data assessment project? Let’s break it down together...next time!

Author: Michele Roveda

Company: E-Venture Business Solutions (itSMF Advanced Sponsor)

If you want to keep you up-to-date with the most recent post on this topic, don't forget to become itSMF Switzerland member:

BECOME ITSMF SWITZERLAND MEMBER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Data Assessment in cybersecurity: a strategic pillar for compliance and risk management

Wed, 16 Oct 2024 07:00:00 +0200

Reading time: ~ 4 min.

The role of data assessment in cybersecurity according to NIST 2.0 and ISO 27001

In today's fast-paced digital world, data is everywhere. From the emails we send to the customer data we store, organizations generate and process massive amounts of information daily. But with all this data, how do we ensure that it's safe, secure, and compliant with regulations?Enter data assessment — a key process that helps businesses understand, classify, and protect their information assets.

Let’s break it down. Data assessment involves identifying what kind of data your company has, where it's stored, how it's used, and most importantly, how it's protected. This process isn’t just for large corporations. Even small and medium-sized enterprises (SMEs) can — and should — conduct thorough data assessments to ensure compliance with privacy regulations and safeguard their information.

You might be wondering «Where does data assessment fit into the bigger picture of cybersecurity?» It’s a crucial part of the puzzle, especially when following established frameworks like NIST 2.0 and ISO 27001.

Both NIST's Cybersecurity Framework (CSF) 2.0 and ISO 27001 emphasize the importance of knowing your data. It all starts with the Identify function in NIST 2.0. Before you can secure something, you need to know it exists. Data assessment helps organizations uncover all their data — whether it’s structured or unstructured — and evaluate its sensitivity and risk. RDaF 2.0 in NIST adds another layer, offering structured guidance on how to manage and classify data, reducing risks effectively.

Similarly, ISO 27001 requires organizations to have a clear understanding of their data in order to apply the right security measures. The standard’s Information Security Management System (ISMS) is built around knowing what data is sensitive, how it’s stored, and ensuring the right controls are in place.

In short, data assessment forms the foundation for protecting data under these frameworks, making it a crucial part of your cybersecurity strategy.

Why data assessment is essential

So, why is data Assessment so crucial? Let’s get straight to the core — there are three primary reasons.

First, compliance. Regulations like GDPR, Switzerland's FADP (LPD-DSG-LPD), and many others around the globe — including in regions such as the Gulf Cooperation Council — require organizationsto have a clear understanding of their data and how they are protecting it. Non-compliance can lead to hefty fines and damage to your reputation.

Second, it’s about risk mitigation. When you know which data is the most sensitive — whether it’s customer information, financial records, or intellectual property — you can prioritize your security measures where they will have the greatest impact.

And finally, data management. Conducting a proper data assessment helps keep your operations smooth by ensuring that your data is clean, organized, and easily accessible when needed.

Challenges in conducting data assessment for privacy regulations

Of course, data Assessment comes with its own set of challenges, especially when it comes to privacy regulations. One of the biggest hurdles organizations face is something we call data sprawl.Data isn’t always neatly stored in one place — it’s often scattered across different systems, devices, and locations. Tracking all of that down can feel like searching for a needle in a haystack.

Another major challenge is mapping data flows. Understanding how data moves through your organization — from collection to storage to processing — can be complex, particularly in companies with older or decentralized systems.

And let’s not forget the resource issue. Many SMEs simply don’t have the time, manpower, or expertise to carry out detailed data assessments. This can leave them vulnerable to compliance failures and security breaches.

How NIST RDaF 2.0 helps solve these challenges

Here’s where NIST RDaF 2.0 comes to the rescue. The risk data framework offers organizations a structured way to assess and classify data, making the process easier and more manageable.

With RDaF 2.0,companies can standardize how they classify sensitive data. This not only helps in staying compliant with regulations but also ensures that the right security controls are applied where they’re most needed. Additionally, the framework encourages a risk-based approach, helping you focus on protecting the most critical data first.

Automation and AI: the future of data assessment for SMEs

If you're running an SME, you might be thinking, «This sounds great, but where do I start?» The answer lies in modern software platforms that leverage integrated AI functionalities to make data assessment easier and more efficient. Instead of relying on manual methods —which are often time-consuming and prone to human error — these AI-powered tools can automate the entire process, from data discovery to classification.

With advanced AI algorithms, these platforms can scan both structured and unstructured data, identify sensitive information, and classify it according to your organization’s specific compliance requirements. This automation significantly reduces the risk of overlooking critical data and ensures that classification is done consistently across the board.

Moreover, platforms equipped with AI-driven solutions enable SMEs to stay up to date with evolving regulations like GDPR and FADP (LPD-DSG-LPD), even without a large in-house team dedicated to data governance. These tools can adapt as regulations change, ensuring continuous compliance without requiring constant manual intervention.

The benefits don’t stop there. By integrating AI functionalities into software platforms, SMEs gain access to a cost-effective solution for data assessment. This allows smaller organizations to focus on their core business activities while maintaining robust data security and compliance.

Final thoughts on data assessment

In today’s cybersecurity landscape, data assessment is no longer merely a best practice — it’s a necessity. Whether you're part of a large enterprise or a smaller organization, having a comprehensive understanding of your data and ensuring its protection is essential for both compliance and risk mitigation.

By leveraging frameworks such as NIST 2.0 and RDaF 2.0, along with the power of AI and automation, addressing data security challenges becomes not only achievable but also more streamlined and scalable.

In our next article, we’ll dive into the must-have features of a software platform designed to automate data assessment, ensuring scalability and flexibility as your business evolves. Stay tuned!

Author: Michele Roveda

Company: E-Venture Business Solutions (itSMF Advanced Sponsor)

If you want to keep you up-to-date with the most recent post on this topic, don't forget to follow us on our social media channels or subscribe to our newsletter.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors: