Cybersecurity perception is reality until facts intervene

Is our board adhering to its fiduciary governance responsibility or delegating it to management?

• Boards approve cybersecurity frameworks, policies, procedures and risk appetites recommended by management. The board directs management to deliver periodic progress updates on how cybersecurity risks are being mitigated, including potential barriers (e.g., funding).
• The board directly engages outside advisors to evaluate the efficacy of their cybersecurity organization at both the board and management level and to recommend changes accordingly.
• Ongoing educational programs are established for the board, management and employees to develop a common contextual understanding of cybersecurity and to instill a culture of enterprise-wide cybersecurity responsibility.

Are the board and management properly structured and organized to deal with cybersecurity risk?

• Management institutes a cybersecurity risk management process that establishes clear authority and responsibility to make operational cybersecurity recommendations and decisions. In upmarket organizations, this authority and responsibility are often delegated to a committee led by a senior executive who reports directly to a C-suite executive.
• The board follows evolving best practices, and the members, or a separately tasked committee, interact routinely with the digital risk management lead or committee. The board includes members with cybersecurity expertise but does not regard this as a “check-the-box” solution for the fiduciary responsibility of the entire board.

Has the enterprise adopted a robust cybersecurity framework? How does the framework fit into overall enterprise risk management?

• Management recommends and the board approves a cybersecurity framework. This includes developing and adhering to high-level and detailed policies and procedures approved by the board. Public disclosures of the framework match internal practice of the framework’s policies and procedures.
• The cybersecurity framework is integrated into the enterprise’s enterprise risk management policy.

What criteria are used to make changes to cybersecurity spending?

• Management recommends and the board approves changes to cybersecurity spending based on projected growth, IT strategic initiatives (e.g., digital transformation), capital rationing, and the expected return on investment (e.g., through risk mitigation), consistent with IT risk appetite. Capital allocations are made accordingly.

Do cybersecurity policies and procedures include customer, third-party, operational and software interfaces?

• The board and management recognize that cybersecurity threats to the enterprise go well beyond internal threats and encompass external threats posed by third parties.  Policies and procedures are implemented to deal with these relationships.

Do the board and management have a sufficient understanding of the enterprise’s business functions and interactions to contextualize cybersecurity risk?

• The board and management demonstrate a holistic view of cybersecurity risk as a systemic risk to their enterprise. They develop an understanding of the interaction of system components, both physical and digital, that constitute the “enterprise as a system” (EAS). A commitment is made by the board and management to maintain a continuous education process and reevaluate the EAS periodically and when major changes occur, e.g., acquisitions, divestitures, introduction of new systems, etc.
• Management is directed to produce a high-level business process map in layperson’s terms (with the help of outside advisors as necessary) describing the EAS as well as the relative importance of the components and how they interact with one another.

Does the board understand risk tolerance, and does it interact with management to develop a risk appetite?

• Management presents the scope of cybersecurity risks to the board and makes recommendations on how to deal with them. The board makes decisions to 1) mitigate, 2) transfer or 3) accept cybersecurity risk in concert with capital allocation budgets for cybersecurity.

Does the board understand cybersecurity presentations by management, or do presentations include too much tech jargon?

• The board requires management to present a holistic view of cybersecurity within the enterprise’s governance framework using business risk language understandable to both. • Sufficient time is provided for management to present and for the board/risk committee to ask questions.

How do cybersecurity compliance audits relate to governance?

• Management sets the expectation that cybersecurity compliance audits have clear linkage to overall corporate governance objectives. The board recognizes that compliance is an important but limited subset of good governance.
• The board has direct access to all cybersecurity compliance auditors and outside advisors to discuss audit findings and their implications for corporate governance.

What procedures are in place to respond to, report and recover from cybersecurity breaches?

• Management recommends and the board approves procedures to report, respond to and recover from cybersecurity incidents, and these procedures follow incident response leading practices.
• The board and management risk committees coordinate to establish procedures to identify and respond to cybersecurity incidents, to make materiality determinations and to report incidents accordingly.

Does the board participate in tabletop exercises to train for responses to cybersecurity incidents?

• Management recommends subject matter for exercises and the role of the participants, including outside advisors, and explains the rationale for their recommendations to the board.
• The board questions and approves management’s recommendations and actively participates in both the exercises and post-exercise reviews.