Report identifies ways that company boards need to be involved in cyber risk management
- Published: Wednesday, 09 January 2019 10:49
The Advanced Cyber Security Center (ACSC) has published findings from a new report, ‘Leveraging Board Governance for Cybersecurity, The CISO / CIO Perspective’, which calls for boards to be active governance partners in ‘collaborative cyber defense’.
Recognizing that defending against cyber attackers requires collaboration across organizational functions and between organizations, the ACSC report urges boards to adopt a holistic and dynamic understanding of their organization’s cyber security responsibilities and to maintain regular direct access to CISOs and risk officers in conjunction with CIOs and other executives.
Other key points in the report include:
The board’s strategic risk role: in most cases, the board partnership with management is still ‘at an early stage’ or ‘maturing’ phase in its ability to provide strategic guidance and help guide management’s strategic risk judgments.
Building board cyber expertise: because most boards do not yet have sufficient expertise in technology or cyber security to serve as strategic thought partners on cyber risk, they should recruit board members with broad digital/technology expertise, develop an annual curriculum of cyber briefings, provide ongoing training, and use third party assessments.
Aligning the board role and corporate structures: CISOs and CIOs should present jointly at board meetings to provide a holistic view of digital strategies and security. Boards as a whole should review cyber security more consistently as a business risk; the risk or audit committee should be used for more frequent (at least quarterly) cyber reviews.
Overseeing cyber security and digital transformation budgets: boards should present digital transformation budgets as a whole, with cyber security investments as an element of overall IT-related decisions about where to invest in growth and security.
Developing cyber risk metrics and measurement: boards should prioritize and support senior management’s development of a new generation of outcome-based cyber risk management frameworks, and in the meantime, executives should use only a few operational metrics with boards.
“The ACSC report, ‘Leveraging Board Governance for Cybersecurity,’ examines the reality that, for the most part, boards are not in a position to provide strategic guidance on cyber risk,” said Michael Figueroa, Executive Director of the ACSC. “In particular, the ACSC report has identified a need for a risk standard, much like those frameworks that financial and audit risk functions have refined over decades, that would help guide decision making and operations as they relate to cyber risk management.”