With the development of cybersecurity risk management regulation the responsibility of board and executive teams for the oversight and assurance of€¦

← Back to Blog

With the development of cybersecurity risk management regulation the responsibility of board and executive teams for the oversight and assurance of cybersecuirty risks will change. Cyber will become a regulatory, compliance and legal risk, as it is driven left on to the financial statements of covered entities and risk is transferred away from cyber insurance.

Cybersecurity risk management is not cybersecurity. Cybersecurity risk management is an enterprise wide people, process and technology capability, requiring boards to attest their management of cyber risks. To meet regulatory demands organisation culture will have to change to accommodate the necessary governance framework, oversight and assurance of cybersecurity risks, ahead of board attestation.

We and the NACD (National Association of Corporate Directors) recommend adopting a 3 Line of Defense approach to demonstrate ‘reasonable’ management of cyber risk (https://lnkd.in/eVgsGpyx), a risk culture, risk management framework and security program. Ahead of board attestation.

Ted Dziekanowski

#cybersecurity #cyberriskmanagement #riskculture #3lod #nacd

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7074635302979391488