Call us now:
Cyber has always been an enterprise wide business risk, and developments in cyber regulation in the U.S, EU and Australia will create legal and compliance risks for boards and CISOs. Pushing Cyber into the board room and requiring a closer working relationship between security professionals and members of the senior leadership team.
Organizational design can affect the reporting lines of the CISO, be it to the CRO, General Council or COO. But it makes more sense that the CISO is a peer and reports to the CEO. If a CISO is going to take on the responsibility for cyber as the accountable executive, then they must be given the tools and protections to do the job.
There is an argument that under the model required to addresses cybersecurity risk management oversight and assurance, the CISO must work effectively with those that create and manage risk (1st line – Everyone), those that oversight risk (2nd Line – Risk) and those that assure risk (3rd Line – Audit). This requires them to work at the most senior level and not 1 or 2 tiers down the organisation.
As regulation forces cyber ‘left of bang’ legal and compliance risk increases for CISOs, as we have seen with the recent Uber case. If the CISO is not afforded the same opportunities and protections to manage risk, as other members of the leadership team, why would they do the job?
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA
#cybersecurity #cyberriskmanagement #cyberlaw
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7043504986693001216