What kind of results are you seeing from CRQ (cyber risk quantification) so far?

CRQ has helped be more objective and share metrics with leaders in IT and the Business to clarify what the company is facing as the threat landscape evolves.  Top business leaders generally prefer when there is a clear methodology and process to ranking and prioritizing and this has helped communicate the risks we face.  It also helps deciding where to spend limited dollars and labor hours.

From the CRQ process we are assessing the potential financial impact of an individual cyber threat to our business, evaluate operational risk, efforts to reduce risk, risk exposure, and risk mitigation.
If we find out that a specific risk exposure is still high, we re-direct our investments to the relevant cyber control. This way, our cyber risk mitigation efforts become more proactive and productive.

It helps to drive easier cross organizational decisions without agenda debates and opinions.

Helps you represent the cyber risk with clear business terms i.e easier to explain to the board of directors or executives how the cyber risk (can/will) affects the revenue and profit. 

It allowed us to better understand and quantify the financial impact of cyber threats, make data-driven decisions, and prioritize our cybersecurity investments based on their most significant risks.