Hyperproof surveyed 1,029 IT security and security GRC professionals in December 2020. We used industry research to identify a set of controls, or practices and procedures, to manage IT risks and asked respondents to rate how well they’re doing in implementing each of the following items. It turns out that companies have lots of room to improve.
44% of respondents admit they need improvement in identifying existing controls built to address certain risks
One entire half of respondents admit they need improvement in validating controls against standard controls in compliance frameworks (e.g. NIST, ISO).
One half admit they need improvement in aligning controls with risks
44% said they need improvement in monitoring controls and automated controls testing
48% they need improvement in activities related to flagging exceptions, reviews, and remediation
44% need improvement in assessing their controls’ effectiveness
42% need improvement in capturing, tracking and reporting deficiencies