Request Demo

Integrated Risk Management

Integrated Risk Management Magic Quadrant 2019 - In Review

down-arrow

It has been roughly one year since Gartner released the 2018 Magic Quadrant for Integrated Risk Management, the first of its kind, and as of this week the second Integrated Risk Management MQ has finally been released. The purpose of integrated risk management (IRM) is to enable organizations to simplify, accelerate, and communicate risk and compliance seamlessly up and down the chain of command, and across business functions whether technical or otherwise. A strong IRM strategy supports organizations in making better business decisions that help lower existing, new, and unforeseen risks in our new, digital world.

It’s been a big year for the risk and compliance industry and, as we’ve seen, there are significant shifts in the way that enterprises approach cybersecurity risk management. As a result, the tools they use have shifted as well, and new players outside the quadrant are starting to replace or augment market leaders, amongst other trends.

A Shift In Use Cases

In analyst John Wheeler’s benchmarking post introducing integrated risk management as the future of risk and compliance, he illustrated the new approach using seven core functions: corporate compliance and oversight, audit management, digital risk management, operational risk management, vendor or supply-chain risk management, business continuity management and planning, enterprise legal management. Six of those seven (with operational risk management at its core) served as the use cases that Gartner used to analyze members of the 2018 Magic Quadrant for Integrated Risk Management.

This year, we’ve seen a change. With Jie Zhang at the helm of this year’s report, rather than broken down by function, she has brought a new lens to the table. We now directly link risk and compliance management to business outcomes. There are three use cases based on the lens through which the platforms help customers see their cybersecurity risk and compliance: business-outcome-centric, operation-centric, and compliance-centric. These centricities illustrate how respective users can view the overall risk and compliance data gathered within a central platform:

  • Business-outcome bridges the gap between technical and business-side stakeholders
  • Operation-centric focuses on quantifying, managing, and mitigating risk
  • Compliance-centric ensures that requirements are met to continue business operations

Simplifying these six use cases down to three indicates how enterprises are viewing risk, and more importantly, the shift that is occurring within cybersecurity organizations. Businesses are recognizing the need for a more integrated approach across all of Wheeler’s six areas. What the 2019 MQ use cases indicate is that these three use cases are the lenses that the market needs to be able to view their cybersecurity posture through.

Critical Capabilities

Where the IRM use uses saw a remarkable consolidation from six to three, the critical capabilities for integrated risk management solutions remained mostly unchanged. The primary focus on risk management over checkbox compliance remains a foundational theme in the Gartner literature and for good reason - Checkbox compliance should be the starting place for organizations, and risk and compliance management should be treated as a core business function. Compliance alone can’t be the primary focus for staying secure as digitization intensifies.

Shifts in IRM MQ Vendors Listed

The integrated risk management market saw many shifts itself since the release of the 2018 MQ. From the ACL acquisition of RSAM and the subsequent rebrand to Galvanize to the Reuters spinout of Refinitiv, the changes to the IRM market have come fast. The most significant shifts came from the Challenger and Visionary sections of the quadrant - from both mergers and acquisitions, specifically ACL/RSAM and the Nasdaq sale of BWise to SAI global. As the report notes, both of these shifts specifically indicate changes ahead for existing products and how the rest of the market will react.

Takeaways

This year we have the data points to see trends and shifts in the IRM market. From changes in use cases, to competitors, to shifts in assessment criteria, it indicates fundamental truth: cybersecurity compliance and risk management can no longer be a siloed function that exists in a vacuum, it must be seen as a business function and managed enterprise-wide. As we’ve spoken about before, it will be up to the IRM vendors to fundamentally change their modular, static approach to integrated risk management to meet market needs. We anticipate that these shifts are only the beginning, and are excited to be built on the integrated risk management vision from the beginning at CyberSaint.

You may also like

Why GRC Needs IRM
on August 7, 2019

Today, every organization strives to optimize the speed with which they access information. Data is being stored, processed, transmitted and utilized in almost every day-to-day ...

Alison Furneaux
SSP and POAM Guidance for DFARS ...
on July 24, 2019

Defense federal acquisition regulation supplement (DFARS) Compliance has been top of mind for Prime contractors as well as Department of Defense (DoD) suppliers since before the ...

Alison Furneaux
Integrated Risk Management Magic ...
on July 17, 2019

It has been roughly one year since Gartner released the 2018 Magic Quadrant for Integrated Risk Management, the first of its kind, and as of this week the second Integrated Risk ...

Alison Furneaux
"Glass-box" Solutions Are Critical ...
on July 11, 2019

With the likes of Equifax and Marriott, it is no secret that cybersecurity has made its way into the Boardroom. While many executives are experienced in managing myriad business ...

Reading Between the Lines of NIST ...
on July 9, 2019

On June 19th, the National Institute of Standards and Technology (NIST) released the much anticipated Rev 2 of SP 800-171 and the working draft of supplement SP 800-171B. As the ...

How We're Making DFARS Compliance ...
on July 2, 2019

With the Department of Defense (DoD) making DFARS compliance a requirement for all contractors doing business with the DoD, a great amount of stress has been put on DoD ...