Analysts Concerned that Executive and BODs are Not Involved Enough in Cybersecurity

Some analysts and cybersecurity experts are worried. In this case, not about the risks and increasingly sophisticated threats coming our way, but about the lack of involvement and oversight by senior executives and company Boards of Directors (BOD) in their organizations' cybersecurity strategies. According to a survey of 600 corporate board directors and professionals by the National Association of Corporate Directors (NACD), a mere 19% believe that members of boards truly understand the cybersecurity risks to organizations. That is even an increase over the 11% from the previous year. Unfortunately, part of this could be because 59% of those surveyed reported that overseeing cyber risks is challenging.

In December of last year, Yahoo reported the largest ever data breach, which affected over 1 billion users. Unfortunately, because of incidents such as these, attacks are no longer limited to financial costs, but also pose a threat to an organization’s reputation. The costs of that are very difficult to quantify.

Therefore, the responsibility of a having a comprehensive cybersecurity strategy in place is no longer limited to the IT department. CEOs and BODs should be more involved. CEOs should ensure that not only does the strategy address the specific risks of their organizations, but they also need to ensure the risk management and governance flows appropriately and accurately to the BOD.

In addition, cybersecurity if often considered a compliance activity, rather than a real part of an overall operational strategy that goes beyond managing the numbers and implementing technology. It’s now time to include the consequences of an attack in that cybersecurity strategy.

Some believe that the risk of a cyberattack is so severe that there should be a national plan in place. After all, a hit to our power grid or water system would be a devastating occurrence. There is proposed legislation to address just this as Washington is moving "quickly" to ramp up our national cyber defense capabilities. States have different breach reporting requirements in place, but they are not uniform. And while helpful in pointing out the importance of having a cybersecurity plan in place, they don’t go far enough to prevent cyberattacks in the first place.