Six ways boards can step up support for cyber security

Security is an enterprise-wide risk management concern, not merely an IT issue

For organisations both large and small, cyber attacks are a constant concern, with a recent study revealing that 68% of business leaders feeling like their risks are increasing. Accountability for breaches and incidents now extends far beyond IT, and organisations are beginning to push cyber security responsibility into the hands of the executive team and board.

Advertisement - Article continues below

Business leaders don't want to be making headlines for being the latest victim of a data breach, and as a result, are actively trying to manage risk. Cyber threats represent the lion's share of potential harm, and strategies to deal with security need to be aligned with wider business priorities. A survey by the Enterprise Strategy Group showed that four in 10 executives and directors now want security status reports for cyber risk associated with end-to-end business processes.

So how can boards step up to the cyber security challenge and work effectively with CISOs?

Expand board expertise

Business leaders are beginning to understand that cyber security is an enterprise-wide risk management concern, not merely an IT issue. While the CISO role is evolving, the makeup of the board is evolving too.

Corporate boards are looking for increased technical literacy and are actively pursuing digital directors and advisors that can deliver high levels of both technical and business acumen.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

All board members need to fully understand the role they play in overseeing cybersecurity and push for board-specific reporting and cyber security transparency. This combination increases the board's availability to ask the right questions and provide the right communication opportunities for the CISO.

Build collaborative relationships with the CISO

Executive leaders and board members must be proactive about working hand-in-hand with CISOs to position their companies to withstand the incessant onslaught of attacks. All parties need to work together to ensure clear lines of communication and incident preparation.

Related Resource

Four cybersecurity essentials that your board of directors wants to know

The insights to help you deliver what they need

Download now

Nearly one-third of board members are dissatisfied with the quality of information they get regarding cyber security risk, so CISOs and board members must work together to have meaningful conversations with all parties involved by telling them what information they want and how often they need it.

An open dialogue about current threats, emerging attack patterns and incident response protocol leads to smarter decisions and better business outcomes.

Walk the walk

While many businesses have developed cyber security strategies and business continuity plans, the government's Cyber Governance Health Check showed that less than a fifth (16%) of the board had a comprehensive understanding of the impact of loss or disruption associated with cyber threats. That's despite 96% of them having a cyber security strategy in place.

In addition to showing support for a company's cyber security strategy and initiatives, boards should actively engage the CISO to work with them on other organisational approaches, such as incident response programmes, which need to be continuously reevaluated and updated to address increasing activity in cyber attacks.

Expect security reporting discipline

Security is now a key business function and should be treated that way. It is vital to ensure CISOs know what reporting metrics and benchmarks are valuable to the board by applying a reporting discipline with consistent benchmarks and actionable information.

Advertisement - Article continues below

Although approaches and formats may vary, board members look for regularity in reporting from CISOs. Some look for programme-level updates for defined benchmark presentations where any important changes are highlighted. Boards and CISOs, then, should work together to develop a functional reporting system which can be delivered regularly.

Be clear about your innovation needs

In an industry where every operational change is technology-driven, continual investment in new functions and capabilities to spark innovation is essential. At the same time, there is a balance to be struck between innovation and introducing technology that risks your business effectiveness, and this can create a state of constant security and compliance catch-up.

Business growth may be at the heart of most organisations, but the board is charged with helping to determine the trade-offs between risk and returns. Clearly communicated financial and operational risk tolerance prioritisation from the board and executive team will allow the CISO to effectively manage expectations.

More is better

Where CISOs were once asked to appear at meetings on specific occasions, CISO attendance at regular board meetings is now much more common. Boards should proactively allocate time at board meetings to hear from the CISO and examine future trends and risks as well as more immediate priorities.

Related Resource

Four cybersecurity essentials that your board of directors wants to know

The insights to help you deliver what they need

Download now

"Cyber security is a mainstream business risk, and board members need to understand it in the same way they understand financial or health and safety risks," said Ciaran Martin, CEO of the NCSC.

Advertisement - Article continues below

As cyber threats continue to evolve, it may not be possible to completely eliminate the possibility of falling victim to an attack. But with a proactive cybersecurity strategy in place that is supported by the board, research has shown that financial losses in the event of a successful attack are lower.

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement
Advertisement

Recommended

Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
University of California gets fleeced by hackers for $1.14 million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Australia announces $1.35 billion investment in cyber security
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
CSA and ISSA form cyber security partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

3 Aug 2020