Call us now:
Brian D. McCarthy, now and again there are presentations that are worth watching. This is one of them by the CEO of CrowdStrike, George Kurtz. It’s a well researched summary over the development of audit, risk management, governance and the importance of board oversight and assurance of cybersecurity. Supported by the CISO.Faisal Khan, Tom McLeod corporate governance is a relatively new field, driven significantly out of SoX back in the early 2000’s. The modern Audit committee was mandated by in the 1970s, driven ahead in the late 1990s and 2000s as SoX defined the foundations for stronger financial control, bringing audit and financial control closer together through materiality. SoX built the blue print for the Audit committee.We know the top three board risks are economic uncertainly, cybersecurity and data protection and regulatory risk. But the evolution of audit from the 1970s, through SoX in the 2000’s, the evolution of board risks including data, cloud, cyber and AI, and the necessity of board to govern these risks, requires boards to operate in a differently.As data breach driven regulation accelerates cyber regulation, and regulation drives change. Regulations such as EU NIS 2, DORA and the SEC final rule are and will continue to drive change, especially as the threat landscape continues to develop, exacerbated by digital transformation and the lack of governance over data, cyber, cloud and now AI risks. Like SoX in the 2000’s, cyber risk will drive the necessity for the board committees and the board to address cybersecurity risk.There is no question that all boards need a CISO. ‘As risk changes so does board room composition’. Cyber, data, cloud and AI are defining risks for every board. The ‘average market cap loss for public companies for a cyber breach is $5.4bn’, ‘Cyber is showing up on earning calls and shareholder letters, its a technical issue and business event’. ‘72% of boards seek cybersecurity experience, 29% of boards have cyber expertise.’ Demand outstrips supply for security professionals’.The question one has, ‘What is stopping boards from addressing cybersecuirty risk management?’ The bridge is burning yet we have seen little change in the adoption of cybersecurity governance. One has a theory, and it it comes from a recent meeting with a Chair, whose response the a similar question was, ‘its not my problem, I ask questions of my CEO and his team. In any case I’ll never be caught out or fined’.’To understand cyber risk, you must understand where business value is created’. Until you speak the same language as the board you will never get a seat on the board.Thoughts?@Thaddeus DziekanowskiVeritas GRC CrowdStrike @https://lnkd.in/epc6hX8T
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7323617362044231680