New risk maturity index emerges from study.

• Position: INFO GOVERNANCE

A recent Pricewaterhouse-Coopers (PwC) study found that most organizations (almost 60%) in Europe and North America are aware of the importance of their information and its role in gaining competitive advantage. The challenge is protecting it from internal and external threats without sacrificing its access and value within the organization.

"The repeated emphasis from regulators, advisors, and risk-managers on data protection and information safeguarding has become the holy grail of data management," observed PwC analysts in the report. "Unfortunately, this company-wide focus on security has kept organizations and their boards from sharing and distributing data and information within the organization to maximize its value."

The study, commissioned by Iron Mountain, is in its third year, but this is the first year it presented the results in a risk maturity index. The index gauges the extent to which businesses implement and monitor a set of 34 measures to manage and protect information assets. These measures fall into four groupings: strategy, people, communications, and security. To receive a high individual index score, an organization must not only implement the measure but also monitor its effectiveness. The four levels of risk maturity are:

* Unprepared for Risk--Organization is severely exposed to information risk. It likely does not have an information risk strategy in place, and senior management is unaware of the potential impact to its business. (Score: 49 or under)

* Aware of Risk--Organization realizes it needs to manage risk but is uncertain about what to do or remains ill-equipped to tackle the threat. (Score: 50-79)

* Approaching Maturity Organization has established some measure and senior leaders are more aware. It has reduced its exposure but has not yet implemented a robust strategy. (Score: 80-99)

* Equipped for Risk--Organization has...