Call us now:
Victoria’s Secret & Co. is undergoing a cyber attack. Item 1C of their annual 10k submission becomes a focal point for investors and insurers alike. Albeit, as with most 10k submissions the content can be interpreted to mean many things. But the complexity of cybersecurity means its very to manage cyber risk, no matter how much money you spend.
Although as with most 10K submissions oversight of cyber risk by the board has been placed under the audit committee who overseas cyber risk reports every 6 months. It is not appropriate for the audit committee to oversight and assure cyber risk, as it is conflicted in its role as the 3rd line of defense.
Governance, oversight and assurance of cyber risk requires a broad church of committee oversight across the 3 lines. It requires at least quarterly review by the board, if not monthly review until there’s enough knowledge skills and experience in the board room to manage cyber.
As demonstrated by the recent Marks and Spencer hack, cyber is an expensive risk to manage. Market cap may rebound, but the effects on operational costs take time to filter through a companies financial statements. It’s fair to say that the cost of board governance, oversight and assurance of cyber is way less than that cost of managign a cyber incident.
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberregulation
https://lnkd.in/ere9d87c
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7333833203578765312