Rachelle Loyear

This book bridges the critical gap between Enterprise Security Risk Management (ESRM) theory and practical implementation. While ESRM principles have gained widespread acceptance—particularly following ASIS International's endorsement—security professionals in real-world implementations consistently struggle with translating concepts into actionable strategies. This practical guide introduces a simple, operational framework centered around three core questions that help security leaders map ESRM directly to business outcomes and strategic decision-making. This book addresses the persistent "how-to" questions that practitioners face when attempting to implement ESRM in complex organizations. The book includes actionable field lessons, case examples, and practical tools that transform theory into measurable security impact. It addresses today's most urgent security challenges: organizational resilience amid a fast-changing global risk landscape, accelerating technology adoption (including AI), and an increasingly complex business and operational environment. As security programs face mounting pressure to demonstrate value, integrate with enterprise risk management, and build trust with non-security stakeholders, this accessible guide equips professionals to move beyond theoretical understanding and confidently lead ESRM implementation. This book serves as an essential resource for security leaders ready to translate ESRM principles into measurable outcomes that align the security strategy with broader business objectives.

Is security management changing so fast that you can't keep up? Perhaps it seems like those traditional "best practices" in security no longer work? One answer might be that you need better best practices In their new book, The Manager's Guide to Enterprise Security Risk Management: Essentials of Risk-Based Security, two experienced professionals introduce ESRM. Their practical, organization-wide, integrated approach redefines the securing of an organization's people and assets from being task-based to being risk-based.In their careers, the authors, Brian Allen and Rachelle Loyear, have been instrumental in successfully reorganizing the way security is handled in major corporations. In this ground-breaking book, the authors begin by defining Enterprise Security Risk Management (ESRM): "Enterprise security risk management is the application of fundamental risk principles to manage all security risks ' whether information, cyber, physical security, asset management, or business continuity ' in a comprehensive, holistic, all-encompassing approach."In the face of a continually evolving and increasingly risky global security landscape, this book takes you through the steps of putting ESRM into practice enterprise-wide, and helps you to: Differentiate between traditional, task-based management and strategic, risk-based management. See how adopting ESRM can lead to a more successful security program overall and enhance your own career. Prepare your security organization to adopt an ESRM methodology. Analyze and communicate risks and their root causes to all appropriate parties. Identify what elements are necessary for long-term success of your ESRM program. Ensure the proper governance of the security function in your enterprise. Explain the value of security and ESRM to executives using useful metrics and reports.Throughout the book, the authors provide a wealth of real-world case studies from a wide range of businesses and industries to help you overcome any blocks to acceptance as you design and roll out a new ESRM-based security program for your own workplace.

In their long-awaited book, based on years of practical experience and research, Brian Allen and Rachelle Loyear show you step-by-step how Enterprise Security Risk Management (ESRM) applies fundamental risk principles to manage all security risks. Whether the risks are informational, cyber, physical security, asset management, or business continuity, all are included in the holistic, all-encompassing ESRM approach which will move you from task-based to risk-based security. How is ESRM familiar? As a security professional, you may already practice some of the components of ESRM. Many of the concepts - such as risk identification, risk transfer and acceptance, crisis management, and incident response - will be well known to you. How is ESRM new? While many of the principles are familiar, the authors have identified few organizations that apply them in the comprehensive, holistic way that ESRM represents - and even fewer that communicate these principles effectively to key decision-makers. How is ESRM practical? ESRM offers you a straightforward, realistic, actionable approach to deal effectively with all the distinct types of security risks facing you as a security practitioner. ESRM is performed in a life cycle of risk management including: Asset assessment and prioritization. Risk assessment and prioritization. Risk treatment (mitigation). Continuous improvement. Throughout Enterprise Security Risk Management: Concepts and Applications, the authors give you the tools and materials that will help you advance you in the security field, no matter if you are a student, a newcomer, or a seasoned professional. Included are realistic case studies, questions to help you assess your own security program, thought-provoking discussion questions, useful figures and tables, and references for your further reading. By redefining how everyone thinks about the role of security in the enterprise, your security organization can focus on working in partnership with business leaders and other key stakeholders to identify and mitigate security risks. As you begin to use ESRM, following the instructions in this book, you will experience greater personal and professional satisfaction as a security professional - and you'll become a recognized and trusted partner in the business-critical effort of protecting your enterprise and all its assets.