RBA maturity

[ZachTheSplunker]

Question from "The Office" Hours meetup

I’ve got around 30ish RR that are going into the risk index, and I get some RIR come through. But as we are a smaller organization, I’m struggling to know when I have actually completed RBA/ when it is working how we want it to. Could you advise, please or does it matter what the organization's risk appetite is?

[ZachTheSplunker]

Answer from "The Office" Hours meetup

If you think you're done, you're not. You constantly tune your rules, add new rules. RBA is not a set it and forget it deal, it's a journey. New data sources, new threats, new business priorities bring new use cases.