Call us now:
A nice article from the US NACD (National Association of Corporate Directors) on Why Boards need Collective Cybersecurity Literacy.
Cybersecurity is, without doubt, the biggest risk boards face today, closely followed by AI. While it could be considered that geopolitical tensions pose a more significant risk to organisations, one only has to consider recent events against Stryker to understand that cyber is a significant risk in the good times and the bad.
Cyber is also a regulated risk. The SEC cyber rule, the United States Department of War CMMC program, EU NIS2, EU DORA, the NYDFS 500, and the Abu Dhabi Financial Services cyber regulation are examples of cyber regulations that introduce governance, oversight, and assurance obligations on the boards of covered entities. Compliance obligations that can result in civil or criminal penalties or loss of contracts.
Cyber attacks are changing the traditional risk transfer equation. Where once boards relied on insurers to cover cyber risk ‘Right of Bang’ , insurers are coming to terms with the fact that managing corporate and consequential losses created by cyber attacks is expensive (ask the board of Stryker). Cyber regulation is transferring cyber risk onto the balance sheets of covered organizations, forcing boards to demonstrate the management of cyber risk ‘Left of Bang’. Something the boards of Stryker, JLR, Marks and Spencer, or UnitedHealth Group no doubt wished they had done.
The management of cyber risk is the board’s responsibility, and effective cyber risk management is delivered through the 3-line model. Utilising risk management(2nd Line), internal audit(3rd Line), and the breadth of the 1st line to demonstrate oversight and assurance. Delivered through a governance framework that provided boards with the information necessary to make appropriate decisions on risk. Boards should also utilize their advisory boards and NEDs to provide the necessary knowledge and expertise in the management of cyber risk. All are adding to the collective cybersecurity literacy of the organization.
@Thaddeus Dziekanowski Liz Sandwith CFIIA
@Parava Security Solutions
#boardgovernance #cybersecurity #cyberriskmanagement
https://lnkd.in/efCAGVZ4
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7441089645532073985