A great quote by the Chairman of Marks and Spencer when speaking to analysts, M&S had been “put on its backside” (sic – by the cyber attack).

← Back to Blog

A great quote by the Chairman of Marks and Spencer when speaking to analysts, M&S had been “put on its backside” (sic – by the cyber attack).

While little has been made public following the attack on M&S and the Coop, was it a ‘third party that done it?’ as Tata Consulting services looks to be a third party supplier used by both companies?

Interestingly this Financial Times article points out both the Chair and CEO attended all the meetings of the audit and risk committee, which oversees cybersecurity, with 3 non-executive directors. One has built and sat on 3 line executive committees including audit, operational risk and cybersecurity. No single committee can preside over cyber risk.

Firstly one asks is why is the audit and risk committee the committee responsible for cybersecurity? Any governance framework for cybersecurity risk management should be fed through several committees that includes audit and risk, but the main arbitrator should be a cybersecurity committee.

Secondly, what knowledge skills and experience did the chair, CEO, audit and risk committee members have to oversight a risk as complex and expensive risk as cybersecurity risk?

The final question is what was being presented to committee. What time was given to the oversight and assurance of cyber risk. The biggest risks boards face today? A typical organisational cyber standard can consists of over 100 cyber controls. The effectiveness of which is critical to managing cyber risk, that includes third party supplier risk.

The accountability and responsibility for risk cannot be transferred by the board to a third party. Board governance, oversight and assurance is critical to managing cybersecurity. Audit plays a pivotal role in the assurance of cyber risk. The closer this can be done to real time, the more effective cyber risk management is.

The hack on M&S has proven to be expensive and will last for years. Managing the 23 points above would have been a cheaper alternative. It’s what we do at Veritas GRC.

@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Bryan Foss Ryan Buckner Tom McLeod Dan Miles David Campbell Liz Sandwith CFIIA Alexander Rae

#cybersecurity #cyberriskmanagement #cyberresilience

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7331608901538242561