Board Level Cyber Risk Management Standard Needed

Calls for company boards to be active governance partners in “collaborative cyber defence” have been made in the Advanced Cyber Security Center's (ACSC)   effective practice report, “Leveraging Board Governance for Cybersecurity, The CISO / CIO Perspective." The report urges boards and their directors to adopt a dynamic understanding of their organisation’s cybersecurity responsibilities and to maintain regular direct access to CISOs and risk officers in conjunction with CIOs and other executives.


Importantly, the report seeks to create an initial benchmark and method of evaluation for the evolving role of corporate boards in cybersecurity governance, initially through the perspective of Chief Information Security Officers (CISOs), Chief Security Officers (CSOs) and Chief Information Officers (CIOs), the primary networks supported by the nonprofit, member-based Advanced Cyber Security Center (ACSC).


P{rimary recommendations of the report are:


The board’s strategic risk role: In most cases, the board partnership with management is still “at an early stage” or “maturing” phase in its ability to provide strategic guidance and help guide management’s strategic risk judgments.


Building board cyber expertise: Because most boards do not yet have sufficient expertise in technology or cybersecurity to serve as strategic thought partners on cyber risk, they should recruit board members with broad digital/technology expertise, develop an annual curriculum of cyber briefings, provide ongoing training, and use third-party assessments.


Aligning the board role and corporate structures: CISOs and CIOs should present jointly at board meetings to provide a holistic view of digital strategies and security.  Boards as a whole should review cybersecurity more consistently as a business risk; the risk or audit committee should be used for more frequent (at least quarterly) cyber reviews.


Overseeing cybersecurity and digital transformation budgets: Boards should present digital transformation budgets as a whole, with cybersecurity investments as an element of overall IT-related decisions about where to invest in growth and security.


Developing cyber risk metrics and measurement: Boards should prioritise and support senior management’s development of a new generation of outcome-based cyber risk management frameworks, and in the meantime, executives should use only a few operational metrics with boards.


The full report can be seen here

more news

Report outlines key business cybersecurity trends for 2020


A new report from Trend Micro gives businesses advanced warning of what they should do to protect their organisations in 2020.

read more

UK Government Calls For Cybersecurity Views


As part of the Government’s current review of cybersecurity incentives and regulations, Digital Minister Matt Warman has today launched a call for evidence to seek views from across the industry.

read more

Kaspersky Highlights Information Security In Loss Figures


To budget for information security, companies need to consider factors such as average potential losses, preferably by incident type, as well as other businesses’ average, outlays on security, Says the latest security report from Kaspersky.

read more

Half Of Global Organisations Not Prepared For Cyberattacks


It is believed that more than 4,000 cyberattacks occur daily worldwide, but half of organisations across the globe admit they are not prepared for such events.

read more