Boards are now paying attention to the need to participate in cybersecurity oversight. Not only are the consequences sparking concern, but the new regulations are upping the ante and changing the game.
Our research indicates that most board members believe it’s not a matter of if, but when their company will experience a cyber event. The ultimate goal of a cyber-resilient organization would be zero disruption from a cyber breach. That makes the focus on resilience more important.In March 2022, the SEC issued a proposed rule titled.
the processes by which the board is informed about cyber risks, and the frequency of its discussions on this topic, However, our research also uncovered attitudes and beliefs that must change. Only 23% of board members think the risk of an attack on their organization is very likely. About 47% believe their organization is unprepared for a cyber attack, begging the question “what are they doing about this?” And about one third of board members say they interact with the CISO only when he/she is presenting to the board.
Another organization focused their board on the alignment of their cybersecurity program and operational risk. The CISO, in collaboration with the chief risk officer, leverage financial analytics to assist with bridging the gap between the cyber exposures to operational losses. The board was able to understand the exposure of the organization from a risk perspective, resulting in optimizing their cyber insurance policy as a way to mitigate the newly understood risk.
🤣🤣🤣🤣. Some still thinks a 4-digits passcode on their mobile device is safe.