IT risk and security remains an ongoing business problem that demands vigilance. The following are 10 trends to watch for in the coming year.

Outsourcing in the IRM domain can help companies create a program that is more effective, more agile and cheaper. All IRM activities can be outsourced, and those firms that rely on full-time, domestic hires to reboot their programs will face higher costs going forward, which may prove unsustainable.

Over the next five years, ISMS (ISO 27000) certification will become a de facto best practice. The United States will soon catch up to its peers as American firms recognize that ISMS certification is essential to effective risk mitigation.

Signs point to an increasing frustration with the legal and regulatory impositions on enterprises amid growing concern that investment benefits will not be achieved by misdirected or vulnerable compliance efforts. At the risk of losing momentum and knowledge, many will look to reorganize and find staff able to address these challenges. A better alternative is to establish information security road maps that track progress and report results to senior management.