I've seen scenarios in which organizations don't invest enough in cybersecurity, are short-handed, and thus have a difficult time meeting the policy requirements defined within their Security Programs. I would assume that many companies don't properly invest in cybersecurity and that this scenario is fairly common.
My question is related to measuring risk of not meeting policy requirements. Measuring risk by performing a standard risk assessment is well defined: identify threats/vulnerabilities and assess the impact and likelihood of exploitation. But what about the situation where you don't know the likelihood/impact of vulnerabilities because you literally just don't have the manpower to perform a risk assessment across all of your systems?
In basic terms: how can you assess and properly communicate the risk associated with not following policy? For example, the risk associated with not performing risk assessments across each of your systems?
Any ideas? I find that communicating risk up the chain of command is the best way to get resources to tackle problems. Am I framing this incorrectly by thinking about it in terms of risk?