Understanding your data, systems and dependencies helps you protect them more effectively. But can risk be eliminated entirely? Probably not.
Organizations must therefore do more than try to prevent incidents; they must also prepare to respond. That means limiting the impact, maintaining critical operations and learning from what happened. In other words, a strong cybersecurity posture is measured not only by an organization’s ability to prevent incidents, but also by its ability to recover from them.
Prepare to absorb the shock.
Can the risk of a cyberattack be eliminated entirely?
Certainly not.
Because threats and technologies are constantly evolving, zero risk remains virtually impossible to achieve. The real challenge is to limit the consequences of an incident and prevent a single failure from paralyzing the entire organization.
François Tremblay uses a particularly vivid analogy:
"The goal is to strengthen organizations so that a cyberattack is treated as a thunderstorm, not a hurricane."
A resilient organization can withstand a slowdown or temporary loss of efficiency without bringing operations to a complete halt. To achieve this, it must design its systems and processes to reduce the blast radius of an incident.
For example, sufficiently decoupled systems can prevent a failure from automatically spreading across the entire technology environment.
Resilience must therefore be considered from the design stage—not only after an incident. This applies to major platforms as well as smaller components and the application programming interfaces that enable systems to communicate.
A resilient organization must also be able to learn. Findings from an incident, exercise or assessment should not remain buried in a report reviewed once a year. They must be turned into concrete operational improvements.
Cybersecurity is not just an IT responsibility.
Who is responsible for protecting data? Cybersecurity teams? IT? Management? Employees?
The answer is probably everyone to some extent—but not in the same way.
Effective governance relies on several roles:
- Data owners are accountable for the business data in their domain;
- Data stewards oversee data quality, definitions and consistency;
- Cybersecurity teams define protection and risk-reduction mechanisms;
- Technology teams administer the platforms;
- Compliance and privacy professionals ensure that obligations are met;
- Senior management sets direction and supports the necessary investments.
Assigning these roles, however, is only the beginning.
In many organizations, data owner or data steward responsibilities are added to people’s regular duties. If those individuals are not given the training, tools and time to fulfil their role, governance risks remaining an attractive framework on paper and nothing more.
“Appointing a Data Owner or Data Steward is a first step; giving them the means to fulfil their role is what truly makes the difference.” —Nicolas Gidas
Data governance is therefore as much about people as it is about processes or technology.
And where does your data live?
Concerns extend beyond protection from cyberattacks. The geopolitical context is also prompting organizations to consider where their data is located and how dependent they are on certain foreign vendors.
In which jurisdiction is your data hosted? Which laws may apply? Who can access it? And can you maintain control as it moves across multiple platforms?
Welcome to the issue of digital sovereignty.
Sovereignty does not necessarily mean that every technology must be developed or hosted locally. Organizations must also consider solution quality, capacity for innovation and the investment required to maintain those solutions.
They must therefore strike a balance between the control they seek and the quality of the services they need.
These decisions cannot be made overnight. To borrow François Tremblay’s analogy:
“An ocean liner does not turn quickly.”
You can, however, start now by documenting where your data is located, which jurisdictions apply, your technology dependencies and the terms of use imposed by your vendors. You will then have a clearer sense of which waters your ocean liner is navigating.
Do you truly understand your security posture?
When an organization claims to have its cyber risk fully under control, François Tremblay becomes cautious.
And with good reason: the risk profile is constantly evolving. A new vulnerability may be discovered, a system may age, a vendor may change its services, or a new use of artificial intelligence may provide access to information that was previously difficult to find.
Being secure today does not guarantee that you will be secure tomorrow.
Leaders should prioritize understanding their organization’s actual cybersecurity and information technology posture. That assessment can then be considered alongside sector-specific risks and observed cybercriminal practices.
You can then invest where it matters most instead of trying to fix everything at once.
After all, your budget is probably not unlimited—and neither are your resources.
Where should you start?
You do not need to overhaul your entire technology environment tomorrow morning.
It is better to move forward gradually, focusing first on the risks that matter most to your mission and on use cases that can quickly demonstrate the value of the approach.
Start by asking yourself the following questions:
- Which activities are essential to our organization’s operations?
- What data supports these activities?
- Where is this data stored?
- Who can access it?
- Is any of this data sensitive, confidential or critical?
- Who is responsible for its quality and protection?
- Which systems and vendors do we depend on?
- What happens if one of these systems becomes unavailable?
- Do our AI initiatives use properly governed data?
- Which risks should be addressed first?
Your answers will help you determine whether to begin by classifying your data, clarifying roles, assessing your posture, reviewing an aging system or improving your business continuity plan.
Your first initiative does not need to be massive. Above all, it should address a genuine need and deliver a visible improvement.
These early successes will help engage stakeholders, demonstrate the value of governance and gradually build maturity.
Protecting your organization while keeping it moving forward.
Cybersecurity should not be viewed solely as a constraint, a cost centre or an issue reserved for technical teams.
When aligned with data governance, artificial intelligence, technology architecture and business continuity, it becomes a genuine business capability.
The best-prepared organizations will not necessarily be those with the greatest number of tools. They will be the ones that understand their data, systems, dependencies and actual risks.
They will know what they must protect, why it must be protected and who is responsible for it. They will also have planned how to continue fulfilling their mission when an incident occurs.
Because you cannot protect what you do not know—and in the age of artificial intelligence, what you do not know may become much more visible.
Bring the right people to the table.
Reassessing your cybersecurity posture, governing your data and preparing your organization for emerging risks can feel like a major undertaking.
But you do not have to do everything at once—or go it alone.
What matters is bringing the right expertise to the table: people who understand technology as well as your business reality, constraints and mission-critical activities.
Conclusion
At COFOMO, we help organizations assess their cybersecurity posture, govern and protect their data, and develop roadmaps aligned with their business priorities.
Because effective cybersecurity does not begin with buying a new tool. It begins with a clear understanding of what you are truly trying to protect.
