Business Operations refers to the daily activities, systems, and processes a company uses to produce services, generate revenue, and run efficiently, transforming inputs (like labor, materials) into valuable outputs for customers. Essentially, it’s the “doing” part of the business. 

 

Breaking it down by OpEx category to mirror what investments can be seen in the P&L of a company, a huge portion of a SaaS business’ operations are attributed to the product. Where traditional operational risk management is applied to sales, success and G&A and is typically owned by the COO, the CISO should view risk management in a similar vein with the R&D category of the P&L. 

 

To reiterate: Product Security is a subcategory of Operational Risk Management. 

 

While Operational Risk Management has traditionally focused on tangible assets and processes, shaped by the well-established practices of finance and manufacturing, the digital age calls for a split approach: one that requires deep expertise in the unique risks and complexities of software product lifecycles. 

​

The Practice of Product Security

 

The term “product security” is a misnomer.

 

It’s like calling operational risk management “business security”. While technically true, it’s misleading. In reality, what we call product security is really product risk management: a disciplined approach to identifying, assessing, and mitigating the risks inherent in the 3 core components of operating or creating the product: 1) people, 2) process, and 3) systems. 

 

Product Security (or product risk management) is then delivered through a Product Security Assurance Program, a coordinated set of initiatives, practices and controls designed to identify, assess, and mitigate risks throughout the product lifecycle. The program’s objective should be to align security practices with the organization’s risk appetite. 

 

Product Security and, thus, the Product Security Assurance Program are owned by the CISO office. Since Product Security Risk Exposure lives in the R&D OpEx category, it becomes critical for the CISO office to fully understand and map the Software Development Lifecycle (SLDC) operations (people, processes, systems). This exercise then provides a critical and valuable output to enable the CISO office to explicitly define the security risk appetite that directly falls under the business’ general risk appetite. 

 

This empowers the organization to effectively manage any risks that could derail the business from meeting its objectives, typically defined by the board for both mid- and long-term goal posts.  And in effect, deliver on the promises of Product Security.