If a company doesn’t manage strategic, financial or operational risk; if a companies IT network falls over because of under investment; if a company…

← Back to Blog

If a company doesn’t manage strategic, financial or operational risk; if a companies IT network falls over because of under investment; if a company doesn’t invest enough time or resources in its sales and marketing; if a company doesn’t manage product design or product development; if a company doesn’t investment enough in fraud prevention or health and safety………..who is held to account? The board.

Cyber is not a new risk, its’ been reported as a top 5 board risk for the bast 5 years by the World Economic Forum. Government agencies globally identify cyber as a significant risk, cyber is the closest national security risk boards will interact with and regulators have targeted cyber as a risk to be managed. The big red flares have been there for years, all the warning signs have been visible, and many reports have made it clear they have been ignored.

Whatever one thinks of the hackers, whatever you’d like to say to them, in the case of Marks and Spencer likely to be teenagers. Cyber is a well honed business and for investors the buck stops in the board room. It’s a board risk to carry and a cost of doing business. No amount of sole searching, I told you so or what ifs’ matter, the board got it wrong. Being contrite post event is all well and good, but what about the boards fiduciary responsibility. In the case of M&S there’s no cyber expertise sitting at the board table

There’s 4 very simple lessons for company boards today.
1. All companies are digitial, data businesses. Even if the customer journey ends with a sandwich, bra and nickers.
2. Cyber is a national security and increasingly regulated risk. Why is that?
3. Todays business models will not succeed without a very clear focus on data, cloud, AI and cybersecurity risk management.
4. Whose providing governance, oversight and assurance of cyber in the board room, and its not the CIO, risk and/ or audit committee.

@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan

Veritas GRC Co-op Harrods

#cybersecurity #cyberriskmanagement #cyberattack

https://lnkd.in/eRP3m2T5

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7332412062473621505

Categories

Cybersecurity, Governance & ESG, Regulation & Compliance

Tags