Call us now:
A great, comprehensive article from the Harvard Law School forum on corporate governance, risk management, cybersecurity programs and cybersecurity disclosures from early 10-K filers. Highlighting early trends in corporate SEC reporting.
The report highlights tends in ones opining deserver comment, including
1 – Current filers identify their adoption of cybersecuirty Frameworks and standards such as NIST CSF and ISO 27001 and cybersecurity management programs. There appears to be little mention about the adoption of cybersecurity risk management programs.
2 – Where cybersecurity risk management is discussed it is integrated into the ERM program to provide a holistic enterprise wide view of cybersecurity.
3 – Executive management oversight of cybersecurity risks is not universal.
4 – The 3rd Line of Defense audit is active across many companies.
5 – In some companies the CISO reports into a senior executive.
6 – Few companies mention a dedicated cyber committee.
7 – The boards of all companies identified provide oversight of cybersecurity risks. With one company providing oversight from a joint audit and risk committee.
8 – Brian D. McCarthy, one company mentions boards holding cyber oversight certifications or key personal holding relevant qualifications.
9 – One firm mentions Awareness and Training programs and investing in human capital.
10 – All companies established a Cyber incident response plan, with table top incident response exercises being performed by several firms.
11 – Many firms reported cybersecurity to the board quarterly.
There appears to be no reporting of material cyber risks, outside of making statements there is a potential for risk. The report highlights the varying breadth and depth of cyber security oversight and assurance of covered entities. That may change due to industry sector, knowledge and experience. As these are significant companies out of the 10-K cyber reporting gate it will now be up to the other companies in the field to follow suit.
The proof of the pudding so to speak, comes when cybersecurity risk management is tested, as and when cyber attacks occur.
@Thaddeus Dziekanowski Rachel V. Rose, JD, MBA
Veritas GRC
#cybersecurity #cyberriskmanagement
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7169650989866696704