Going Left of Bang has many applications, least of all in cybersecurity and cyber regulatory compliance.

← Back to Blog

Going Left of Bang has many applications, least of all in cybersecurity and cyber regulatory compliance. It means being proactive and preventing threats from becoming a significant risk further down the line.I’ve had a few conversations with board leaders this week and what struck me were the following statements.1. It’s the job of management to manage cyber, not the board?2. If Management doesn’t manage the risk we ask them to move on.3. Will I really be held accountable for regulatory compliance and the cybersecurity of my company?4. Don’t sell me regulation as a way make change, tell me about the dollars and cents.In ones opinion some of these points are realistic, other not so. They reiterate obvious challenges with cyber regulatory compliance. Dollars and cents is a realistic response, cyber risk management is about managing the transfer of cyber risks, that includes the economic cost of risk mitigation. Risk management is about ownership and where the buck stops, that is the board and management that manages value for shareholders.As cyber increasingly becomes a threat to national security, relying on the dollars and cents argument for CNI does not work on its own. As yesterdays Heathrow Airport incident demonstrates, we are in a world where managing resilience is what matters and managing resilience costs money. One wonders for example the global costs of the outage vs. the cost of resilience. Managing resilience requires boards take ownership of risk and go ‘Left of Bang’. Allocating reasonable amounts of capital to mitigate risk.The alternative is we’re all buggered when CNI falls over. The failure of the board to act could cost us all money. (Crowdstrike, United Health, CDK, SolarWinds, Uber, Synnovis, nation state threat actors compromising national infrastructure……..)Patrick Van Horne Jason A. Riley@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Rachel V. Rose, JD, MBAVeritas GRC#cybersecurity #cyberriskmanagement #cyberregulation

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7309182064828792832

Categories

Cyber Risk Management, Cybersecurity, Regulation & Compliance

Tags