Cybersecurity is a vast sector incorporating countless aspects of offline and online vulnerabilities. More than that, it affects everyone, from businesses and not-for-profit organisations to individuals in their everyday lives.

From the outside, it can seem like an overly complex topic, especially for those who aren’t tech-savvy. One of the biggest barriers to entry is the sheer amount of jargon, acronyms and terminology that can overcomplicate cybersecurity and make people switch off towards the subject.

That’s why we’ve put together this helpful guide to help you break down cybersecurity terminology into something easy for you and your staff to understand.

Let’s get started.

Cybersecurity jargon buster

What is an Acceptable Use Policy (AUP)?

In most organisations, an acceptable use policy is a set of guidelines outlined by an organisation that states how employees are supposed to use its resources and equipment.

What are Access Controls?

Access controls are a security method that manages and controls who or what is allowed to access a computer system or restricted area. It identifies who should have access and verifies details to decide whether to grant or deny access.

What is an Antivirus?

An antivirus is a type of software program that scans for and removes malware from devices.

What is a Botnet?

A Botnet is a network of compromised computers or computer systems, sometimes called a ‘Zombie Network’.

To create a malicious botnet, a cybercriminal will simultaneously compromise several computers and instruct them to run automated systems on the systems.

This can then be used to spread viruses, launch phishing campaigns or crash web servers.

What is a Bring-Your-Own-Device (BYOD) policy?

A policy that allows employees to use personal devices instead of company devices to connect to an organisation’s network and access business applications and data.

What is a Clear Desk Policy?

A Clear Desk Policy directs all staff members to maintain a clean working space throughout the day and file everything appropriately.

A clear desk policy can include more than just making sure your physical desk is clear; it can also include your computer, requesting that all files are locked away in secure folders within your PC subsystem and that your computer is locked when you leave it unattended.

What is a Data Breach?

A Data Breach is a security incident in which your sensitive, private and often valuable data is stolen, viewed or used by an unauthorised individual. Breaches can involve anything from financial records to corporate intellectual property and represent one of the biggest threats to organisations.

What is a Data Subject?

A data subject is any individual whose personal data is being collected, held or processed.

What is the Dark Web?

Encrypted web content which isn’t indexed by search engines or accessible through standard web browsers. Users need specialised software to access the dark web, like the Invisible Internet Project (I2P) or Tor browser. These browsers route user web page requests through third-party servers, hiding their IP address.

What is a DDOS Attack?

A DDOS Attack, or Distributed Denial of Service Attack, is when many computers are used to flood a targeted system. These are typically delivered by botnets and are usually global in nature, used to take down larger targets and cause widespread disruption.

What is a Digital Footprint?

A digital footprint is a unique trail of personal data every internet user leaves behind when engaging in digital activities. This data is typically publicly available and can be used to impersonate you. To learn more, why not check out our Digital Footprint course?

What is a DOS Attack?

A DOS Attack, or Denial of Service Attack, is when a single computer is used to flood a targeted system, rendering it unable to function for a period.

What is Encryption?

In computing terms, Encryption is the process of encoding data so that only authorised parties with the right decryption access can view or edit the data. This is widely used for security purposes but is also used by designers of Ransomware to lock users out of their own data.

What is a Firewall?

A network security device that filters all network traffic (incoming and outgoing) to prevent unauthorised access based on predetermined security rules. It’s important to note, however, that Firewalls must be continually updated in order to maintain effectiveness.

What is Information Confidentiality?

Certain information must be protected so only authorised individuals can access and view it. This process is known as maintaining information confidentiality.

What is the Internet of Things?

A network of physical objects with embedded sensors that connect to and exchange data over the internet in real time.

What is ISO 27001?

ISO (International Organization for Standardization) 27001 is a part of the ISO 27000 family, a group of international standards for Information Security Management Systems (ISMS). It helps organisations to follow best practices to mitigate cyber threats. Learn more about ISO 27001 here.

What is a Keylogger?

In its basic form, a Keylogger can either be a physical piece of hardware or software that intercepts signals from your keyboard and records every keystroke you make.

Keyloggers intercept the communication between your keyboard and computer before transmitting that information to a third party.

What is Malvertising?

Malvertising is a blend of malicious advertising. Malvertising is the practice of incorporating malware in online advertisements.

What is Malware?

Malware (a contraction of malicious software) is a term used to describe any software that does unwanted things on your computer or device.

These nasties can include slowing your CPU, performing tasks of their own or locking your computer down and demanding a ransom. Some can also track your activities and steal sensitive data, such as passwords and files. Click here for our article breaking down the types of malware.

What is Multi-factor Authentication (MFA)?

An authentication method where users must prove their identity using at least two different credential types before receiving access. This is increasingly standardised online, but may be called two-factor authentication (2FA).

What is the NIST Cybersecurity Framework?

A set of cybersecurity best practices that organisations can use to manage their security risks. The framework is voluntary guidance.

What is PCI DSS?

PCI DSS is an information security standard set out by the Payment Card Industry Security Standards Council to reduce fraud and increase the security around cardholder data.

The standard sets out requirements for how businesses should securely process, store, accept and transmit cardholder data during credit card transactions. To learn more about PCI DSS, click here.

What is Penetration Testing?

Known colloquially as pen testing. A simulated cyber-attack against a web application, computer system, or network. The goal of penetration testing is to find any vulnerabilities that could be exploited by threat actors and test defenders’ security posture.

What is Phishing?

Phishing is the most common tactic cybercriminals use to steal your data. At its most basic, it’s the act of creating realistic-seeming emails designed to get you to hand over your personal information.

These emails can mimic big companies, resemble an internal source or make an emotional plea. Awareness and vigilance against phishing are essential to protect your personal data and your organisation’s data.

What is Ransomware?

Ransomware is a specific subsect of malware which holds your data to ransom by encrypting all the data on your device or system and demanding payment to return it to an unencrypted state.

Many ransomware attacks feature a countdown timer and will delete your data unless you make a payment.

What is Remote Working?

Remote working is, quite simply, the act of doing your job away from the office. Whether it’s editing information on the train or accessing your work emails at the coffee shop.

Working on the go can leave you open to dangerous threats, like social engineering and shoulder surfing.

What is a Risk Register?

A risk register is used to document all known risks and helps to keep track of them. Risk registers should include the risk impact and likelihood, response taken, and who is responsible for monitoring the risk.

What is Shoulder Surfing?

Shoulder surfing is the practice of physically spying on another user’s electronic device to obtain their personal identification number, password and any other sensitive information.

What is Smishing?

Smishing is using SMS messages that social engineers use to commit phishing attacks.

What is Social Engineering?

Social engineering covers techniques cybercriminals use to access sensitive business and personal information.

Cybercriminals can and will use a variety of methods to exploit people, from sending an email designed to make them panic to pretending that they are a new employee that has lost their pass to access unauthorised areas.

What is Spear Phishing?

Standard phishing attacks are designed to be sent to a broad range of individuals to increase the chances of landing a hit. However, some cybercriminals are interested in attacking a single client.

For this, a technique called Spear Phishing is used.

This more targeted type of phishing utilises specific details gleaned from research to create truly effective and realistic phishing emails. Sometimes the term ‘Whaling’ is used when spear-phishing targets top-level management.

What is an SSL Certificate?

SSL, or Security Socket Layer, is a widely used website security protocol that encrypts data sent between you and a website. With an SSL Certificate in place, the connection is encrypted when your web browser connects to the secured and certificated website. This protocol has replaced the TLS, or Transport Layer Security.

You can tell whether a website has an SSL certificate by checking if there’s a closed padlock icon at the left of a website’s URL.

What is Stalkerware?

Stalkerware is a class of software designed for smartphones that record your location, the websites you visit, the apps you use and virtually any other data that comes through your smartphone. It then passes that information onto an individual.

What is Tethering?

Tethering is the sharing of your phone or mobile network-capable device’s internet with your computer. This can be done wirelessly or through a wired connection. This is typically more secure than using an open public WiFi.

What is Vishing?

Vishing is the use of phone calls to conduct phishing attacks. These calls will purport to be from a legitimate source, like the Royal Mail, Amazon or your bank, but will, in fact, be scammers looking to utilise psychological principles like fear to convince you to hand over your personal information.

What is a VPN?

A VPN, or Virtual Private Network, is a tool that makes web traffic anonymous by masking the location and encrypting traffic. VPNs are used in business to create secure channels to private servers and in the public sphere to secure browsing and access websites which are region-locked.

What is a Watering Hole Attack?

A watering hole is a website that has been infected with malware by a cybercriminal. The term comes from real-life watering holes, which are used by animals like hippos and alligators to hide in before launching attacks on unsuspecting creatures.

What is Whaling?

Whaling is a type of phishing attack that targets high-level executives. Whaling attacks typically involve complex and hard-to-spot social engineering efforts that use knowledge about an executive’s professional and personal network against them.

Don’t forget to bookmark this page in your browser so you can refer to it the next time you’re confused by some cybersecurity jargon!

No matter the scale of your organisation, compliance training is necessary to safeguard you and your organisation from legal issues further down the line.

You may have heard other organisations talk about it and even know that your company needs it, but you might need help understanding why.

Join us as we share precisely what compliance training is and answer some of your most pressing questions about compliance training.

What is compliance training?

Compliance training can cover a range of different topics, but its overall goal is to educate employees about the legal and internal policies which apply to their roles and daily activities in their position.

The main purpose of compliance training is to walk employees through ethics and regulatory issues that could arise in the workplace and train them on how to guard against them effectively.

What issues are covered by compliance training?

As we have already mentioned, compliance training can cover many essential issues in the workplace, depending on the sector you work in. In our case, for example, we offer compliance training which covers topics relating to information security, such as ISO 27001, and environmental standards, such as ISO 14001.

Other issues which often require compliance training include company policies, codes of conduct, diversity and inclusivity in the workplace, and business ethics. Certain industries, such as healthcare and finance, will have even more compliance training in place than other businesses due to the highly regulated nature of those sectors.

Why is compliance training so important?

Whilst the importance of compliance training might not be immediately apparent, we’ve all seen heavy fines levied on businesses charged with non-compliance or a breach of regulation. Avoiding those fines is the most important reason to undergo compliance training.

While no employee breaks the law knowingly – except for rare occasions – many times, a compliance issue can occur unknown to the responsible party out of lack of knowledge or understanding.

Of course, the reasons for undergoing compliance training continue beyond avoiding fines. Compliance training enables your entire organisation to work safely and efficiently from the same page, reducing confusion and friction within the business environment.

The right training ensures that your organisation remains compliant at all times and equips your employees with the knowledge needed to spot any non-compliance or potential issues they may come across in the business.

What is a compliance certification?

A compliance certification is a fully accredited document certifying that your business meets the standards demanded by the certification specifications.

What are the best practices for compliance training?

Set out clear objectives

Understanding why you must do something can often increase motivation as it’s easy to attribute results to your behaviour. Training can feel much more valuable to employees when they understand the importance of compliance training, and it can even feel like an internal competition for them.

Make training interesting

There’s no need to make your employees sit through tedious training packed with hard-to-understand jargon when there are so many good alternative methods.

eLearning can be beneficial in many ways to both you and your employees. Employees can take as many breaks as they need because the training is broken down into bite-sized modules that are easy to understand. eLearning also allows learners to finish their training whenever they are ready.

As a result, fewer people rush through because they believe their time and effort would be better spent on another project. Because only some employees learn in the same way or within the same time frame, your employees will appreciate it if you give them the option to complete their training whenever they want by a specific deadline.

Instead of handing each employee a stack of papers every year, invest in interactive scenarios and simulations that allow learners to test how they would respond in various situations via eLearning.

– Think of ways to incorporate interactive content – e.g. quizzes or games. This can be a good way to enhance learning and engage participants.

– Focus on practical applications – not the situations that are least likely to occur, but the situations in which employees are very likely to find themselves. These are the kind of scenarios that can make an impact.

– Encourage input and active discussion. To impact employee engagement, you need to engage them. Create an environment that is open, transparent and two-way.

Make compliance issues relevant to your employees

Making an employee go through a lengthy cybersecurity awareness training programme that is unrelated to their work or day-to-day responsibilities is the fastest way to lose interest and stop learning. Since your employees must receive compliance training, you must ensure that the material is relevant to keep their interest.

Ask for feedback on the training experience

Your staff want to feel like their thoughts and opinions are respected. Their excitement and motivation will decline, and you’ll probably have a higher staff turnover rate if you don’t pay attention to their suggestions and worries. Not just compliance training but entire corporate culture is affected by this.

Inquire about their opinions of the training, any changes they would make, and the overall experience. Their input enables you to continuously enhance your compliance training process and guarantee that employees benefit the most from it, which benefits the entire business.

So, how can our compliance training help your business?

We believe in making training as simple, relatable and effective as possible, and our compliance training is no different. Through our gamified training, employees never feel as though it’s a tick-box exercise that they need to get done.

Bob’s Business is your first port of call regarding cybersecurity compliance training. Offering comprehensive online training, our compliance courses can be tailored to suit both the public and private sector and can be scaled to suit businesses of any size, from small enterprises to large organisations.

To make compliance easier for staff to digest, our compliance training courses are bite-sized for a more efficient learning experience.

For more information about how we can help your business achieve compliance, get in touch with a member of our team today.

Have you ever received an email that didn’t feel right? Like a receipt for an online order you didn’t place or a poorly worded email saying you’ve got money back from an annual tax return?

Don’t be fooled by their quirkiness; these are phishing emails, and they are a genuine concern, particularly those unaware of the threats they pose.

In a recent report, it was found that phishing and pretexting (a form of social engineering) represent 98% of social incidents and 93% of breaches, with organisations nearly three times more likely to be breached by social attacks than via technical vulnerabilities.

Recent reports have found that an astonishing 3.4 billion phishing emails are sent per day. Now that’s a lot of emails to avoid!

Spam filters are designed to do what their name suggests and block spam messages! However, according to research from Plymouth’s Centre for Security, Communications and Network (CSCAN), 75% of phishing emails without links and 64% of those with links made their way past spam filters and into the target inboxes. Even worse, only 6% of those emails were marked as malicious by email clients.

As we approach the end of 2022, 39% of UK businesses who have identified cyber attacks identified phishing attempts as their most common vector – A massive rise from 72% in 2017, to 83% to date.

Then it comes down to the person receiving the phishing email. They are the next and in most cases the last filter stopping unwanted intruders from breaking into your data.

So, what can you do to prevent you or anyone in your organisation from taking the bait? Here’s how to spot a phishing email, and how you can reduce organisational risk too.

How can you spot a phishing email?

As humans, we’re not always the best when it comes to judging risk. Some of us receive hundreds of emails a week, with many perfectly legitimate, which can lull each of us into a false sense of security, assuming that every email that we receive is to be trusted.

Making small changes to your habits so that you treat every incoming email with suspicion can make a significant difference when it comes to preventing a potential breach

7 signs to look out for when spotting a phishing email 

The sender’s address doesn’t seem right

When you open an email, always check the email address of the sender first. If an email claims to be from a company you know, but the sender’s email address doesn’t match up, then that’s a sign something isn’t right.

Emails from addresses such as ‘1253628uwhdnwd@hotmail.co.uk’ or ‘info@amazen.co.uk’ are early telltale signs that the email is not to be trusted.

The email has poor spelling and grammar

When you’re reading an email, look out for any spelling or grammar errors, and also consider how well-written the email is. Official emails will usually contain no spelling or grammatical errors, typically because professionals wrote them. Criminals, however, tend to cut corners.

So, for example, if you receive an email trying to pass off as legitimate but it reads like this:
“Dear {{.FirstName}}

Someone has sent your an email uing Mail Lock the UK’s most scure email platform.
To see your mail, please, click here

This email link will expier 24 hours after you have redd this notification emai.
After this time the link message will be held securely until you get a replacement link messgae sent securly from the sender

Regards,

The Maillock Team”

Then you need to start asking questions!

The email has an odd use of imagery

Some phishing emails will often use attractive imagery and graphics such as photographs or company logos to make them look more like emails you’d get from a marketing team.
Remember to bare in mind, that just because the email contains nice pictures and looks like it’s laid out professionally doesn’t mean it might not be a phishing email.

Check the logos and images, if they’re blurry, of poor quality or look stretched out, that’s a dead giveaway that somebody has taken it from a quick Google search.

The email is designed to make you panic or make a hasty decision

Many phishing emails are designed to create a sense of urgency or make you panic, such as time-sensitive offers and situations that prompt you to act immediately and make impulsive decisions without thinking.

You might receive an email claiming to be from one of the systems that you use telling you that your account will be deleted if you don’t confirm your email address within an hour. This is a tactic designed to make you panic and throw caution to the wind.

Our research has found that combining a sense of danger with the appearance of an internal email can result in 94% click effectiveness, highlighting just how potent these psychological principles can be.

The email sounds too good to be true

“Good news. Having looked at your tax payments for 2018, you overpaid by £157. Click here to start processing your claim.”

At a glance, you’d probably think it was a nice quick win for your bank account.

Unfortunately, phishing emails usually offer attractive incentives like this so that you rush into getting your hands on it without a second thought. Whenever there’s an incentive in an email, always think twice. Remember, if it reads too good to be true, it probably is!

The URL you’re being linked to isn’t legit

Hiding a link in an email is easy. Some phishing emails will place links on bits of text or buttons so it doesn’t have to reveal a URL.

But you can check out where a link will take you by hovering your mouse over the text. Take note of the URL and ensure it matches the website you expect before clicking! If the URL doesn’t match, then it’s probably a phishing email.

For example:
Link Text: Click Here to Update Your Paypal Detail
URL: http://Paypals.com

Another good practice when checking the validity of a link is to look out for an SSL certificate at the beginning of the URL. This will show as https as opposed to just http. When installed on a web server, an SSL (Secure Sockets Layer) allows secure connections from a web server to a browser.

Check the company branding in the email

Phishing emails will try to mimic well-known brands to gain your trust and get you to let your guard down, whether you use those services or not.

If you receive an email from a company that you haven’t subscribed to, that’s probably because it’s a phishing email trying to impersonate that company.

You can easily catch these emails out by comparing them to ones you’ve received before from the company, do the logos match up? Are there glaring differences between the two?

What to do if you click on a phishing email

These are the steps that need to be taken after clicking a phishing link:

– Report the incident to your tech team as soon as possible

– Change login passwords

– Investigate the attack

– Inform the regulators and law authority

Take a look at some of our past blogs to learn more:

– What to do if you click a phishing link

– What are the different types of phishing?

– How to spot and prevent malicious emails

How does our phishing training help secure your organisation?

In a recent study, GOV UK found that cyber attacks were better avoided with gradual change within organisations, including communications via email, mock phishing exercises, conversations with specialist staff and informal and formal training. This means that staff are continuously kept interested in and alert to cyber threats.

Our award-winning Bob’s Phishing simulated phishing training is an effective way of teaching your employees about the dangers of phishing emails and how to avoid becoming a victim.

The simulated phishing campaigns allow you to evaluate the threat level phishing could pose to your organisation through the use of tailored phishing exercises and our engaging training courses and awareness materials that reinforce all the key learning points.
You can find out more about our phishing training here.

With Black Friday and Cyber Monday just around the corner and Christmas rapidly approaching, there’s no doubt it’s the season for lighter wallets.

But whilst riding the sales on Black Friday and Cyber Monday can land you a fantastic deal, they’re also a beacon that attracts scam artists, fraudsters, and crooks.

This is more prevalent than ever in the current cost-of-living crisis, with scammers preying on anxiety and fear of missing out – something we covered in our latest blog post.

That’s why we’re stepping up to help empower you to be vigilant online, here are our top tips.

Don’t get caught on dodgy domains.

Fake, quickly assembled websites are a classic tool of fraudsters and a vital tool for duping customers into handing over their details. However, they can be spotted. Here’s what to look out for.

• Websites with familiar names, but unfamiliar domains, like .org, .biz or .co
• Blurry or pixelated images
• Unusual or incorrect site addresses, like amazong.com
• Poor spelling & grammar
• Unsecured connections

You can avoid shady websites by keeping an eye out for these elements.

If it looks too good to be true, then it probably is.

Cybercriminals like to play on our deal-hunting instincts, especially on Black Friday and Cyber Monday and in our current economic climate. Be aware that whilst crazy deals are tempting; they might not even be real!

You can use your common sense here; if an £8,000 TV has been reduced to £1,500, something may be afoot.

It’s important to do some research on the seller. If possible, check reviews from other buyers. Look up the company on the Better Business Bureau website, and check that site’s Scam Tracker for any reports.

However, if you didn’t find anything, that may be a red flag, too. Even the most trusted online stores have bad reviews.

Again if it seems too good to be true, it probably isn’t true. Researching the offer carefully lets you redeem the sweet Black Friday deals without getting fooled by fakes.

Stick with what you know.

Stick with big, reputable online retailers for the safest shopping experience. Although purchasing from Amazon may aid in their efforts for world domination, at least you’re safe in the knowledge that you aren’t putting yourself at risk.

More than merely relying on a proven name might be required, however.

Watch out for typos in URLs, because your ‘legitimate’ page might be built by a scammer to closely resemble the real thing. Think “ammazon.com”, rather than “amazon.co.uk. Although many big online stores try to buy up as many common typo domains and redirect them to the real site, such as Amazno.com, Amazzon.com, or Ammazon.com, they can’t catch them all.

Unsecure website? Run

There has been a global push to standardise the usage of secure HTTPS connections on every website in recent years. Undoubtedly, HTTPS has been a positive for commercial websites, highlighting those with a secure connection by showing a small padlock icon in the address bar.

This lock doesn’t ensure the page isn’t a scam site, however, it simply means your connection is secured, and nobody can snoop on your transaction.

Some browsers even go so far as to label sites without the lock as “not secure” such as Chrome. There is no point in risking it if you can’t see the lock!

Perfect your passwords.

We’re sure you’ve heard us talk about passwords many times before (after all, we’ve got a whole blog about how to make the perfect one) but creating a robust and unique password is the easiest way to protect yourself from cybercriminals.

If you don’t have time to read our full blog, here are some tips on creating a perfect password;

• Use a collection of random but memorable words.
• Never use a password that’s easy to guess, or based on keyboard patterns.
• Always use unique passwords for every service.
• Enable two-factor authentication if supported.
• Use a password manager to save your passwords automatically.

Be wary of social media scams.

As shopping through social media rises, so do social media scams. Cybercriminals leverage the popularity of social media to lull people into confidence regarding deals and offers which don’t stand up to scrutiny.

Be careful when clicking and following links on social media, as you may be directed to fake websites that will encourage you to enter personal details. From there, it’s easy for fraudsters to steal your money or commit identity fraud.

Another major social media threat you should look out for are posts that encourage users to like or share their posts (gaining a wider audience), as these lend legitimacy to fraudsters who later use the profiles to propagate scams.

Risks exist everywhere, and we face them every day. Whether taking on a new client, moving into a new office building or just crossing the road, risk must be managed appropriately to minimise potential issues and maximise gain.

In an ideal world, we’d make decisions with all facts available. However, life doesn’t often hand us those opportunities and decisions must always be made. The severity and likelihood of risks can vary, and so should your responses. Therefore, you must familiarise yourself with your organisation’s policies and procedures concerning risk management.

The following blog will take you through everything you need to know about risk management, including identification, assessment and response.

Identifying and assessing risks

You can’t fix something you don’t know is broken, meaning that the first thing to do when it comes to risks is to identify them.

For example, you may identify the risk of ‘teething problems’ when switching to a new Customer Relationship Management (CRM) system.

Once you’ve identified the risk, you should assess it based on likelihood and impact. Put simply, these two elements determine how likely a consequence of the risk is and how much of an impact the consequence could have. A common way of measuring this is on a scale of one to four.

For example, the risk of ‘teething problems’ with a new CRM could have a likelihood score of ‘two’ but an impact score of ‘four’.

Simply formalising that process and being able to use your resources more wisely are the goals of developing a risk management plan. Identifying your risks is the first and most crucial stage in this approach.

You must compile a list of all the unique dangers that can affect your business. This can be a difficult task, especially for startup companies without a track record or years of expertise to draw from. Fortunately, there are certain methods you can use to help:

1: Break down the big picture

When beginning the risk management process, identifying risks can be overwhelming. Start with a broad analysis. What are the most obvious potential problems for your business or sector? These may be based on your daily routine and business strategy.

Risk comes in many forms. There are numerous categories, including financial, operational, technological, legal, political, safe, and reputational. Consider your organisation’s vulnerabilities in each of these categories when you break it down by department.

Asking yourself insightful questions can reveal weaknesses in your organisation that you may not have considered. Is your manufacturing process, for instance, completely secure? Are all of your staff members qualified? What would happen if your greatest client disappeared? Would you know what to do and who to blame if a catastrophic incident happened? If you can’t provide an answer to a query like this, it indicates a risk that needs to be addressed.

2. Try and take a glass-half-empty approach (momentarily)

What is the worst possible scenario for your company? What would the course of events be if there was a day when everything went wrong? Being extremely pessimistic may not be the ideal strategy for managing a company, but it’s quite useful for recognising hazards.

Avoiding arrogance and believing anything ‘can’t’ or ‘won’t’ happen at this point is crucial. Challenge every one of your beliefs regarding potential threats, and be ready for any or all of them to materialise.

3. Train your employees

Everyone will view the organisation and the hazards they face while doing their jobs differently, from the CEO to the front-line employees. Employees are, therefore, one of the most important resources for spotting dangers.

You can ask for anonymous input from employees, one-on-one interviews, or group discussions. While group talks may improve the amount of brainstorming and result in a higher number of identified hazards, allowing anonymous incident reporting may raise the possibility that employees who are concerned about the consequences from speaking up will respond.

Third-parties providers Bob’s Business can also offer compliance training solutions, so your employees know how to recognise and report risks when needed in your organisation. When deployed into your teams and appropriately reinforced, these courses can help increase policy adoption in your business by an average of 45%!

How to respond to risks

Your assessment will dictate the manner in which you respond to each risk. You can easily remember the different responses to risks by remembering the ‘four Ts’.

Tolerate

If a risk has a low likelihood and impact score, you may decide to tolerate the risk. This is not the same as ignoring it! Tolerating a risk is about acknowledging the potential consequences but deciding that they are not severe enough to warrant avoiding the risk entirely.

Transfer

There are a number of reasons why a risk might be transferred. Transferring a risk does not necessarily mean passing it over to someone else because of apathy. A colleague may simply be better placed to deal with the risk due to a greater level of experience or knowledge.

Treat

A medium-to-high score on the likelihood and impact scale may result in you treating the risk, or lowering its potential likelihood or impact. For example, if you identify a trip hazard that you cannot fix until a later date, then an acceptable response could be to treat the risk by cordoning off the area.

Terminate

If a risk has a high likelihood and impact, but cannot be treated, then the appropriate response would be to terminate it.

For example, if you research the new CRM you’re looking to implement only to find that they have several legal cases pending and scathing customer reviews in relation to information security, then you may decide to terminate the risk by not pursuing the new system.

Top tips for risk management in your organisation

We’ve amassed a number of simple, top tips that should help you remember the essentials of risk management.

• Identify risks as early as possible.
• View everything with a glass-half-empty mindset.
• Describe risks appropriately.
• Estimate and prioritise risk.
• Take responsibility and ownership.
• Learn from past mistakes.
• Use appropriate strategies to manage risk.
• Keep monitoring & reviewing.
• Make sure your employees are trained and kept up to date.
• Remember the four Ts of risk response: tolerate, transfer, treat and terminate.

Ready to start taking compliance seriously? Check out Bob’s Culture, our fully-managed compliance and cybersecurity training programme to reduce your risk of breach and noncompliance in one fell swoop.