Call us now:
Capital, equity markets and insurers rely on an independent assessment of an organisation’s performance. Provided through, amongst other things credit rating agencies, financial updates and market reports, and Q&A of control performance. To price-in cyber risk and for insurers to underwrite policies. The challenge with ‘Outside-in’ is that as this article rightly points out, it provides an inherent lagging view of corporate cyber risk, and in the case of insurance a reliance on insurers asking the right questions about risk and control maturity.
The ‘inside out’ view of cyber risk oversight and assurance is equally difficult. It relies on a companies understanding of cyber risk, managing its internal control environment and associated measures and metrics. To oversight and assure cyber risk over time, demonstrating that measures actively support the company manage the risk, repeatably.
To evaluate cyber risk appropriately both ‘Outside-In’ and ‘Inside-out’ evaluations are required. But will be difficult to achieve until there are globally agreed cyber standards or regulations, creating a level, standardised playing field. Applying the same language and oversight for those in and those who observe markets. This does not exist for cyber risk management.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6666606394440994816