Published: 07 April 2024
对于在互联数字环境中运营的企业机构，网络风险管理至关重要。安全和风险管理领导者可阅读本文，了解网络风险管理计划的基本构成。
成功的网络风险管理计划须贯彻“五D”原则：动态化（dynamic）、分布式（distributed）、依据充分（defensible）、数据驱动（data-driven）和赋能决策（decision enabling）。
如缺少情境信息，对于网络风险数据的分析将难以提供可执行的结果。
考虑到资源的有限性和运营成本，企业机构需要根据重要性和敏感性对资产进行分类，以提高网络风险管理适应变化的能力。
为比较网络风险与企业机构的其他风险，企业机构越来越多地要求安全和风险管理（SRM）领导者阐释网络风险的财务影响。
在风险登记单中记录网络风险并与利益相关者保持沟通，对于从业务角度综合阐释网络风险、进而实现数据驱动型决策至关重要。
负责管理网络风险的SRM领导者应：
利用Gartner的生命周期方法，确保网络风险管理遵循上述五D原则，确立企业机构的网络风险管理实践。
在已识别的风险与业务流程、目标和成果之间建立关联，以提供必要的情境信息，提高数据分析的洞察力。
开展影响分析，从环境、社会和治理（ESG）、隐私、运营经济性和技术角度，考察关键资产/流程的影响及其业务价值，从而对风险进行量化、明确风险责任的分配，并调整风险分析方法。
采用不同的风险评估方法（定性、定量或混合方法），以及不同类型的网络风险量化方法（即，信息风险因素分析[FAIR]、年化预期损失[ALE]、风险价值[VaR]、威胁模型、情景/决策树分析和定制模型），对风险进行分类。获取内置/预设的内部（统计）和外部（威胁情报）财务数据，以量化网络风险，并在必要时对量化方法进行调整。
采用专为目标受众设计的仪表板，及时向利益相关者传达风险信息，帮助风险负责人确定风险处置措施的优先级，做出明智的决策。
Clients can log in to view the entire document.
Analysts:
Michael Kranawetter, Sema Yuce
Gartner research, which includes in-depth proprietary studies, peer and industry best practices, trend analysis and quantitative modeling, enables us to offer innovative approaches that can help you drive stronger, more sustainable business performance.
Our independence as a research firm enables our experts to provide unbiased advice you can trust.
Not only is Gartner research unbiased, it also contains key take-aways and recommendations for impactful next steps.
Our research practices and procedures distill large volumes of data into clear, precise recommendations.
We provide actionable, objective insight to help organizations make smarter, faster decisions to stay ahead of disruption and accelerate growth.
We offer one-on-one guidance tailored to your mission-critical priorities.
We work with you to select the best-fit providers and tools, so you avoid the costly repercussions of a poor decision.
Connect directly with peers to discuss common issues and initiatives and accelerate, validate and solidify your strategy.
Gartner clients can log in to access the full library.
Attend a Conference
Experience Information Technology conferences
With exclusive insights from Gartner experts on the latest trends, sessions curated for your role and unmatched peer networking, Gartner conferences help you accelerate your priorities.
Gartner CIO & IT Executive Conference
São Paulo, Brasil
© 2026 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. and its affiliates. This publication may not be reproduced or distributed in any form without Gartner's prior written permission. It consists of the opinions of Gartner's business and technology insights organization, which should not be construed as statements of fact. While the information contained in this publication has been obtained from sources believed to be reliable, Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner business and technology insights may address legal and financial issues, Gartner does not provide legal or investment advice and its insights should not be construed or used as such. Your access and use of this publication are governed by Gartner’s Usage Policy. Gartner prides itself on its reputation for independence and objectivity. Its insights are produced independently by its business and technology insights organization without input or influence from any third party. For further information, see Guiding Principles on Independence and Objectivity. Gartner publications and other content may not be used as input into or for the training or development of generative artificial intelligence, machine learning, algorithms, software or related technologies.
