Call us now:
When one reads MGMs 2023 annual report you are struck by the oversight the company has paid to cybersecurity risk management. What is noticeable is the lens MGM has placed on cyber, following the 2023 cyber attack, oversight by State and Federal Regulators, availability of cyberinsurance proceeds, claims and litigation ahead in 2024 and forward looking statements.
While explicit about several material risk during in 2023 FY and going forward. There is an absence of explicit disclosure of the companies material cyber risk. Albeit there is disclosure that the Audit committee (3rd Line of Defense) is responsible for overseeing the companies cybersecurity risk, overseas the companies plans to mitigate cybersecurity risk and responds to data breaches. Reporting to the board as necessary to keep the board informed, as necessary, of issues or risks relating to the Company’s cybersecurity. The CISO continues to enhance the companies cybersecurity program and leads efforts to mitigate technology risks with business leaders.
While part of the companies charter, one wonders if this is an appropriate governance structure going forward, in light of the SEC final rule. Cyber is an enterprise wide business problem that requires at best a 3 Line of Defense governance structure to oversight, assure and attest cyber risk led by the board. The reported $100 million in lost revenue may not be a material loss, but the effect on brand, reputation, legal claims and regulatory oversight may be.
@Thaddeus Dziekanowski Brian D. McCarthy
Veritas GRC
#cybersecurity #cyberriskmanagement #mgm
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7167482674931032064