Call us now:
We’ve been saying for a very long time, cyber is more than just qualifications and solutions. Would you have open heart surgery if your surgeon specialised in hip replacements? No.
Cyber is the biggest risk we face today (WEF report), why do we not treat it as such? We’ve been saying for years that boards don’t get it and there are NO professional qualifications on the market for cyber. Yet we expect professionals like the CFO, lawyers, doctors, nurses, pilots, engineers, architects……to be professionally certified. But not the person (CISO) who manage the biggest board room risk we face.
Cyber is often the job of the IT department, when it’s an enterprise wide business risk. We expect them to spend $1.50 to manage a $multi-million enterprise wide risk, in an industry full of cyber solutions looking for problems to fix. Cyber is complex, NIST SP 800 – 171 applied by the DoD has 110 technical, cultural and organisational practices to comply with. It’s like taking a 3-year old wearing armbands, removing them, throwing them into the deep end of the pool and telling them to ‘stay afloat’. They can’t.
All practices and standards mean nothing, if you don’t have the resources, training and regulations to manage them. Start with the SEC make it a board problem, like SoX.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6800382827671146496