Alignment of business strategy and risk appetite should minimize the firm’s exposure to large and unexpected losses. In addition, the firm’s risk management capabilities need to be commensurate with the risks it expects to take.
—Jerome Powell
Introduction
In today’s rapidly evolving digital landscape, the most critical cybersecurity decision an executive team and board of directors must make is determining HOW they will conduct Enterprise Cyber Risk Management (ECRM). This decision transcends technical considerations and dives into the strategic and governance aspects that can define an organization’s resilience against cyber threats and its ability to leverage cybersecurity as a competitive advantage.
The Importance of the HOW Decision
The decision on HOW your organization will conduct ECRM is not merely about selecting technologies or setting up firewalls. Instead, it involves a comprehensive approach that integrates with your organization’s mission, vision, strategy, and values. This strategic decision is crucial for establishing a robust cybersecurity framework that protects against risks and creates business value by identifying and exploiting cyber opportunities.
Boards and C-suite executives must recognize that their role is not to become cybersecurity experts but to enable effective ECRM by overseeing this critical decision. The execution of the program and strategy, including operational aspects, should be delegated to the relevant teams within the organization. However, the board’s involvement in deciding HOW to conduct ECRM is essential to ensure its cybersecurity efforts align with its broader business goals and set the tone for the entire organization.
Key Actions and Mini-Decisions to Facilitate the HOW Decision
To make an informed decision on HOW to conduct ECRM, the executive team and board must undertake several vital actions and make a series of minor but critical choices. These steps ensure that the ECRM approach is comprehensive, well-governed, and aligned with the organization’s strategic objectives.
- Establish Strong Governance: Governance is the foundation of any transformational program, including ECRM. It involves answering key questions such as who makes decisions, how and when those decisions are made, and what data is used to support them. Formalizing and communicating ECRM governance is crucial in setting the tone at the top and ensuring that the entire organization is aligned with the board’s vision for cybersecurity.
- Evaluate the Current ECRM Situation: The board must critically assess the organization’s current ECRM posture. Key questions include whether the current program would pass a regulatory audit, whether it could impact a merger or acquisition transaction, and how it would stand up to investor scrutiny under SEC cybersecurity reporting requirements. This evaluation helps identify gaps and opportunities for improvement in the existing ECRM program.
- Adopt a Principle-Based Approach: The organization’s ECRM approach should be guided by solid governance principles communicated throughout the organization. One recommended principle is viewing ECRM as a business value creator and a means to gain a competitive advantage. This mindset shift is crucial for treating cybersecurity as more than just a compliance issue but as a strategic business enabler.
- Clarify ECRM’s Role: The organization must decide whether to treat ECRM as an IT problem, a business risk management issue, or a pathway to competitive advantage. I strongly advocate for the latter, as this perspective allows the organization to assign ownership of information assets and their associated risks and opportunities to business managers rather than confining them to the IT department.
- Treat cybersecurity as an Existential Business Risk: Beyond compliance, cybersecurity should be treated as a fundamental business risk encompassing various aspects of the organization’s operations, including possibly patient safety and professional liability in healthcare. Boards must consider their fiduciary responsibilities and the personal liabilities that come with them when making decisions about ECRM.
- Become an ECRM Enabler: Board members and executives should focus on enabling ECRM rather than becoming experts. Seeking external advice from a cyber risk coach or board advisor can provide valuable insights and help the board fulfill its governance role effectively.
- Promote Cross-Functional Engagement: ECRM should be treated as a team sport, with accountability spread across various business units and functions. It is essential to avoid delegating ECRM responsibilities solely to one individual or department, such as the Chief Risk Officer or Chief Information Security Officer.
- Adopt Industry-Standard Methodologies: I recommend adopting globally recognized frameworks, such as the NIST Cybersecurity Framework, as the foundation for the organization’s ECRM program. This ensures that the organization’s approach is based on best practices and is aligned with international standards.
- Secure Funding for ECRM: Funding is critical to a successful ECRM program. I encourage boards to be creative in securing funding, considering sources such as cost of capital reductions, insurance premium savings, and grants. Given the existential nature of cyber risks, finding adequate funding for ECRM should be a priority.
- Focus on Unique Assets and Risks: The organization’s ECRM program should be tailored to its unique assets and exposures rather than following a generic controls checklist. A risk-based approach, focusing on assets, threats, vulnerabilities, likelihood, and impact, is essential for creating a robust and effective ECRM program.
Conclusion
The decision on HOW your organization will conduct ECRM is the most critical cybersecurity decision that the board must oversee. This decision lays the foundation for developing and documenting a comprehensive ECRM program and cybersecurity strategy that aligns with the organization’s strategic goals and enhances its competitive position. By following the key actions and mini-decisions outlined in this article, boards can ensure that their organizations are protected from cyber threats and positioned to leverage cybersecurity as a strategic asset.
This article provides some insight into the most critical decision a board of directors must oversee. To learn more, order your copy of Enterprise Cyber Risk Management as A Value Creator today.