Call us now:
A great video from Standard and Poors, well worth watching if you want to know why cyber is an ESG risk. A why ECG will add to the cyber challenges faced by the DoDs public DIB. S&P is a company which assesses the credit ratings and impacts a firms access to capital and their debt rating.
In cyber security we often forget that we are trying to manage an enterprise wide business risk. A risk which requires more than frameworks and standards describing appropriate controls. That is just one part of the complex picture. A picture which is getting more complex if you are a US covered public defence contractor.
I’ve published a few articles on ESG reporting recently and the drive by the SEC to adopt cybersecurity oversight over public firms. With the cybersecurity direction of travel in the US pointing in one direction, more regulation. Defence contractors will have to contend with both ESG reporting and NIST SP 800 – 171 (CMMC). Both of which require enterprise wide cyber risk management and both will hit the balance sheet significantly. The challenge with NIST SP 800-171 and CMMC is that they focuses on a specific data class (FCI/CUI) and do not require governance, strategy, business environment, robust risk management or supply chain oversight. ESG will impact liquidity through the cost of credit and investor relations. With the DoDs drive to embed cybersecurity oversight and assurance addressing the DIBs failings to manage cyber security, ESG may be equally as important to the public DIB as CMMC is to the DoD?
Is there one framework to rule them all?
Brian McCarthy, Jason Spezzano, Ted Dziekanowski
#cybersecurity‚Â #SupplyChainRiskManagement‚Â #CyberRiskManagement‚Â #riskmanagement‚Â #compliance‚Â #insurance‚Â #cyberinsurance‚Â #insurance‚Â #regulatorycompliance‚Â #regulatoryoversight‚Â #esgrisk‚Â #cyberregulation #esgreporting
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6811249348773462016