Horizon Media: Spinning Up a Cyber Risk Program from Square One

Horizon Media: Building a Risk Program from the Ground Up

Headquartered in New York City, Horizon Media is the largest and fastest-growing privately held media services agency in the world. Horizon had become an industry leader, in part, by using technology to gather business intelligence, measure channel connections, and employ data analytics.

With data and technology increasingly integral to Horizon’s business, its risk infrastructure needed to evolve too. Horizon was operating in a highly virtual environment with a global client base, cloud-based operations, and multiple physical offices. With breaches and cyberattacks constantly in the headlines, Horizon needed a system to capture and monitor cyber risks (including those from third parties) and a cyber awareness training program to give clients the confidence that their data would be safeguarded.

Enter Praj Prayag, a technology risk executive with 18 years of IT Audit, risk, and compliance experience at Big Four and top-tier financial services companies. Praj was hired by Horizon’s CISO to build their technology risk program from the ground up. Recognizing the enormity of the task ahead of her, Praj knew that getting the resources and people she needed would require business support.

Before she came on board, risks were compiled in spreadsheets and not always considered when making strategic decisions. With risk operating independently from the rest of the firm, Praj knew she needed to educate stakeholders on the value of a risk program before she could build a shared culture of risk.

Setting Relevant Objectives

To design an effective technology risk program that met the firm’s needs, Praj and her team needed to understand Horizon’s broader objectives. Exploring why Horizon needed a technology risk program would help Praj socialize the idea and get the structure right.

Besides the standard objectives of protecting data and information assets and reducing organizational and cyber risk, conversations with business, technology, and executive leadership helped Praj understand that customer confidence hinged on strict levels of compliance. Clients needed assurance their data would be protected from unauthorized access, breaches, and cyberattacks. This would become a critical differentiator for Horizon’s clients.

With that, Praj positioned the technology risk program as a key input to growth. Setting the program objectives in line with Horizon’s business strategy smoothed the way for getting buy-in from business and resources for planning and implementation.

“Building a program that provides business value moves away from technology risk and audit being a cost center,” says Praj. “We enable businesses to grow by helping them achieve their objectives while keeping their data safe.”

Aligning People with Process

With support in hand, Praj used the people, process, and tools methodology to define what the technology risk program should look like and build efficiency and alignment across the organization.

The team agreed on four key pillars for their program: information risk management, third-party risk management, cybersecurity, and compliance and controls.

Praj and her team analyzed sources of risk in each area to understand the firm’s critical risks and better prioritize their time and resources. Eventually, they defined discrete priorities and processes for each pillar.

• • Information Risk Management - Define an iterative, clear process that captures all the risk information and workflow.
  • Third-Party Risk Management - Define a process to get vendor information and provide each vendor a risk questionnaire
  • Compliance and Controls - Create an annual plan for controls self assessment based on the annual risk assessment and compliance requirements
  • Cybersecurity - Centrally capture cyber risks and provide consistent cybersecurity training

  Now that the vision and goals of their risk program were clear, they could move ahead with designing the appropriate structure.

  Praj and her team recognized effective risk management was a firmwide responsibility. Identifying the right people to help with implementation was a key part of the process, people, and tools methodology. After designing the process for managing each pillar, they brainstormed about who they’d need to collaborate with and the resources required to manage those risks.