Call us now:
Cyber is and always has been a risk problem, not a technology issue. Demonstrated by recent cyber regulatory proposals and regulations from the EU and U.S, and the 3 Line of Defence governance framework adopted by covered financial services for compliance under Basel regimes or those covered by NYDFS.
So placing cyber under a Chief Risk Officer (CRO) in the case of North Carolina, is an important step forward in regulatory risk management compliance. All be it in FS a CRO can only oversight risk across an enterprise, and a CISO cannot be held accountable for risks other than cyber. Risk is owned by all executives, with oversight and assurance by the CRO to evaluate and assure compliance and a CISO to manage cyber risk.
In the case of NC, one hopes that the role of the CRO is to take an active enterprise wide view of cyber risk and offer appropriate solutions for risk mitigation. For third line assurance and board attestation. As we wrote in late 2022, board adoption of a 3 Line Model is important to cybersecurity risk management (https://lnkd.in/eVgsGpyx). With a strong second line under a CRO to oversight cybersecurity risk. A model adopted by the NACD through their 2023 directors handbook.
Ted Dziekanowski
#cyberriskmanagement #chiefriskofficer #cybersecurity
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7069381655567691776