A great Sunday read. A study published this week by Michelle Lowry, Anthony Vance, Marshall Vance examining how boards oversee cyber risk. This…

← Back to Blog

A great Sunday read. A study published this week by Michelle Lowry, Anthony Vance, Marshall Vance examining how boards oversee cyber risk.

This study examines how corporate boards—often lacking technical expertise—approach cybersecurity oversight. Drawing on interviews with directors, CISOs, and consultants, we find that nonexpert directors tend to be engaged and perform many of the expected oversight actions, but without cybersecurity expertise, their efforts often remain symbolic rather than substantive—a distinction not always recognized from within the boardroom.

A lack of corporate knowledge, skills and experience; Boards not engaged in technical oversight and not being inquisitive; A reliance on nonexpert directors performing oversight and symbolic oversight rather than bringing in technical experts what will peel back layers of cybersecurity risk management. Keeping the issue in house rather than seeking external expert counsel feels like a normal board practice.

https://lnkd.in/eMA_H7VZ

https://lnkd.in/e3fnC6E4

@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Bryan Foss

Veritas GRC

#cybersecurity #cyberriskmanagement #boardgovernacne

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7334885472655085568