Info-Tech warns connected retail increases cyber risk in new blueprint
Info-Tech Research Group says retail systems are becoming more connected while security ownership remains split across teams, and it has issued a blueprint to help leaders set priorities.
Info-Tech Research Group says retail technology is becoming more interconnected, and it has published a blueprint to help companies sort cyber risk across stores, platforms and vendors.
The research firm said in a Sept. 3 PR Newswire release that retail environments now include legacy point-of-sale systems, IoT devices, cloud platforms, e-commerce applications and third-party services. It said security decisions are still split across different teams, leaving no single function with full end-to-end authority over cyber risk.
The company said that matters because a weak spot in one system can affect day-to-day operations in different ways. Donnafay MacDonald, research director at Info-Tech Research Group, said the breakdown happens when no one can “make, enforce, and explain” decisions across stores, platforms and vendors. She said cyber resilience improves when organizations clearly define decision-making responsibilities and accountable owners.
Info-Tech said the blueprint, titled Build Cyber Resilience in Connected Retail, uses a three-phase method and a supporting threat and risk assessment tool. The release said the aim is to help CIOs and security leaders define decision boundaries, identify assets, map threats and vulnerabilities, evaluate business impact and prioritize action.
The company said its approach centers on five decision areas: visibility, control boundaries, decision ownership, risk prioritization and response coordination. In the first phase, leaders are told to define what risk matters by setting data classifications, risk tolerance and severity scales, then documenting assets across software, hardware, networks and physical sites.
In the second phase, Info-Tech said organizations should determine where exposure exists by identifying vulnerabilities, evaluating threats and building risk scenarios tied to operational and business consequences. The release said generative AI can help with scenario development, but only if subject matter experts review and validate the output.
In the third phase, the blueprint says leaders should decide which risks justify action by assessing controls, likelihood, impact and alignment with risk tolerance. It says they should then prioritize treatment decisions, assign owners and set timelines.
MacDonald said the difference between risks can be large. She said a problem with a payment system could stop sales, while a problem with a digital sign may be only an inconvenience. The release uses that contrast to show why retailers need to separate critical issues from minor ones before they spend money or assign staff.
Info-Tech said the assessment tool maps exposures to affected systems and owners, evaluates likelihood and impact, and produces a prioritized risk register. The company said that can help strengthen accountability across IT, store operations and vendors, contain incident spread and direct resources to the exposures most likely to disrupt business or damage customer trust.
The release was published from Arlington, Va., and the company did not say when the blueprint would be updated or whether it is tied to a specific retail client or incident.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
View the Web StoryA visual, tap-through version of this reportThis is the AMP version of the article. Read the full article on Atlas Watchline.