Call us now:
Definitely a great read on a Saturday from James Dempsey, with Part 2 of his 3 part series on cybersecurity enforcement. Cyber enforcement that one can say is out of the starting gates and heading towards completing its first furlong and with the direction of regulatory travel has no sign of abating. The article discusses the role of periodic audits and the relationships between ‘1st, 2nd party audit and 3rd party’ audit and ‘assessments’.
One point is clear, that cybersecurity regulation sets baselines for compliance. Baselines that public and private sector organizations are required to demonstrate compliance to. In our own work we recommend organizations implement a Target Operating Model for Cybersecurity Risk Management that adopts the 3 Line of Defence (3 LoD) approach to risk management together with board governance, cybersecurity ‘systems’ and organizational design. An approach that binds the 3rd line of Audit (internal and external) into the process of assuring cybersecurity risk. A proven (Basel Accords) model for risk oversight and assurance, requiring all 3 LoD to ‘reasonably’ oversight and assure cyber regulatory compliance on behalf of the board, ahead of board attestation.
Reaffirmed by the NACD publication last week of their Cybersecurity Framework for board cyber compliance.
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA Jamie Foster
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AgroupPost%3A107434-7047861175098761216