Call us now:
Talking a good game about digital and cyber is coming to an end for boards of covered entities. ‘Talking the Talk’ and ‘Walking the Walk’ is the order of the day as the U.S, EU and Australia all announce cyber regulations focused on board accountability and regulators ask important questions about what the board did to oversight and assure cyber risk.
Many boards have ignored cyber risk and if the MGM and Caesars board makes-up is a proxy, many do not have the experience around the table to challenge the risks or even ask the right questions. One is sure that in the case of both their board would have asked ‘We’re a multi $ billion tech dependent business, what does our risk register show are our biggest risks; Take me through the POAMs to mitigate those risks; I want to review the Cause, Event and Impact of a tech failure; Can I see the pen test; What’s the biggest possible threat we face to our tech? When did we run a BC test, take me through our BCM tests and plans in the event of a tech failure.’
All questions one has been asked by board members of several companies, when presenting the cyber, tech and BCM risk quarterly reports. Questions one has had to have answers for. Not difficult question, not questions you need training to ask, but questions that require training to interrogate the responses. One wonders if there are several boards who should have asked the questions sooner?
Unlike the SEC final rule, EU cyber regulation NIS 2 and DORA require boards to follow training to gain sufficient knowledge and skills to enable them management identify risks and assess cybersecurity risk-management practices. A requirement that is simple to adjudicate in the event of regulatory oversight.
Under the SEC final rule the CISO and Chief Audit Officer are likely to be named accountable executives, therefore one expects closer scrutiny of cyber by board subcommittees. It’s unlikely that investors or regulators are going to be happy to rely solely on an external view of cyber risk, when the risk is owned and managed by accountable execs with board sign off.
Ted Dziekanowski
#cyberriskmanagement #cybersecurity #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7110321447029354496