In the Boardish community, we have noticed a big spike of companies who are adding the threat of “Immobility” (not being able to work remotely).
I want to help and to show you a basic guide on how to use the Boardish platform* to understand the costs of immobility, for example with situations like the Coronavirus where many people have to self-isolate but are still able to work. So you can get quick approvals on solutions to solve this from decision-makers.
*You can do this with the free version of Boardish also.
Step 1 – Company information:
Fill your company information, all threat impact and solution mitigation are calculated based on the size, type and financial posture of the organization.
Step 2 – Threats:
Add a custom threat (Go to > Add Threat Type), you can call it “Immobility” or we’ve also seen variations of “Not being able to work remotely” and “no remote working option“.
Then we look at the critical operational information like how much the threat impacts the day-to-day. It’s different for each company, so we recommend involving your Operations, Sales, and Marketing teams.
In our example company below we have:
- Set the Chance of Losing Marketing position to Medium
- Included 25 Turnover Days Loss (days you are not selling because of a mass absence of staff and your company doesn’t have remote working capabilities in this case)
- 50% of Sales Loss in these days (because not all functions are impacted, some are automated etc.)
- 14 Workdays Loss is predicted for High, Medium and Low impact users. (for example, a self-quarantine period of two weeks.)
Step 3 – Solutions:
We will add 3 possible solutions that help us with the threat of “not being able to work remotely“
- Video conferencing tools – Note that many companies are now offering a free option as well (due to the Coronavirus outbreak). So for this example, I made the cost of video conferencing free.
- Advanced identity management tools – Tools that help you to protect remote identity, by adding “Device Identity”, MFA, Geographical restrictions and other abilities thathelp you to work remotely and securely, This is also very important for BYOD capabilities which are a big part of working remotely. For this example, I made the cost $7 per user.
- Cloud security solutions – When working remotely, tools like Dropbox, OneDrive, Box, Google Drive etc. will be used more. So we will need tools to secure them in the business. Particularly to make sure we can differentiate between sensitive and non-sensitive types of files being worked and shared remotely. So in this example, I made the cost $6 per user.
For the purpose of this example, I’m staying vendor-neutral but I will be using the solution type field.
Step 4 – Threat Protection Factor (the efficiency of solutions against threats)
In this section, we are setting the effectiveness of the 3 solutions against the same threat. The TPF section is where you can use your experience and knowledge of solution efficiency to have manual control.
Based on my experience, I have used the following info:
- Immobility and Video Conferencing – 80% on Prem, 0% Cloud
- Immobility and Advanced Identity Management – 0% on Prem , 75% Cloud
- Immobility and Cloud Security – 0% on Prem , 70% Cloud
Step 5 – Expert costs
This is section is very important when showing solutions to your decision-makers. Video conferencing solutions may be free to use but they will require resources from IT to train and support, these resource requirements and costs need to be quantified.
I have used the following info:
- Video Conferencing – Will require 100 hours yearly of 1st Level IT – mainly for support setups or connection issues.
- Advanced Identity Management – Will require 50 hours of your Cyber Staff to configure and 100 hours of your 2nd level IT to support
- Cloud Security will require the same as Advanced Identity Management ( for this example)
*Again you can use the figures for ongoing support if you know them for a solution you’ve used previously or are benchmarking.
Step 6 – Regulation
In this step, we will set the GDPR impact for this threat. Immobility doesn’t have a direct GDPR impact unless there is a security issue that is not taken into consideration, and this is likely to be caused by something specific other than lack of mobility.
So, in this case I have configured GDPR regulation impact as none.
Once completing the dashboard, you will get clear figures on the following:
- Cost of the Threat – $39.92M
- Cost of Solutions: $64K in total
This is “decision making” knowledge provided to your stakeholders. If your’s company information is as clear as in this example – you will get your budget request approved for solutions that combat an immobility threat. Particularly in cases of mass absence.