About the Best Risk and Compliance Program category
What this award covers
This award is for a program, not a product or a single person: the way an organization identifies, measures and manages cyber risk and meets its regulatory and contractual obligations. Typical entries cover a risk framework put into practice, readiness for a standard or regulation such as ISO 27001, SOC 2, NIS2 or DORA, or a move from periodic audits to continuous compliance.
Software that supports these programs belongs in the product group, for example Governance, Risk and Compliance (GRC) or Compliance Automation. A firm that delivers compliance services to clients fits Cybersecurity Compliance Service Provider of the Year. A one-off certification effort with a defined end may fit Cybersecurity Project of the Year better.
Related categories to enter
Each category is judged separately, so you can enter a nominee in every category that fits their work, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the work more than one chance to be recognized.
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against peers in a similar setting and region. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the scope of the program: the regulations and frameworks it covers, the parts of the business it reaches, and how the team reports risk to executives and the board.
- Innovation — a better way of running the program, such as continuous control monitoring in place of point-in-time audits, risk expressed in financial terms, or governance for the organization's use of AI.
- Impact — what the program achieved: certifications gained, audit findings closed, time spent on evidence collection cut, risk reduced in measurable terms. Specific numbers and named outcomes carry more weight than adjectives.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
Anyone can submit a nomination: the nominee, a colleague or manager, the organization, or an agency entering a client. The nomination form has a confidential field for detail that is shared with the judges and not published, such as internal figures, customer names or incident details. Deadlines, pricing and entry steps are on the How it Works page.
