As cyber attacks become more costly, disruptive, and a threat for businesses cybersecurity governance is fast becoming a priority for boards. Some boards include cybersecurity expertise as a new director’s title to their board rosters. Others rely on contractors and third party service providers to bring cyber-risk expertise to the boardroom. Some boards are employing a controversial method: hiring hackers from red teams to test their systems to determine which areas they are at risk.
There is a gap between the priorities boards set and the this article actions they do to meet these goals. Our research has found that only 69% of board members report they regularly meet with their CISOs and a large percentage of them only communicate with their CISOs during board presentations. These gaps must be plugged to ensure that the boardroom has sufficient visibility and dialogue about cybersecurity risks.
To bridge the cybersecurity gap, it is essential to include cybersecurity as an integral component of every board’s agenda and engage directors in meaningful discussions regarding the threats they confront. This means changing the way conversations take place in the boardroom, including having a dedicated cybersecurity agenda item and introducing pre-read materials that can be used to facilitate deeper discussions about cybersecurity concerns during meetings. It is also necessary to make cybersecurity a top priority for the board, and also to establish a security-minded business culture through the tone of voice from the top, and reward for those who are able to raise awareness about risk.