Overseeing cyber risk: the board's role

Boards want to know whether management is focusing on the right cyber risks, how management is addressing those risks and whether it’s enough. This starts with understanding the company’s cyber risk management program and cyber risk appetite.

Next steps:

• Understand the key cyber risks to the organization and how the executive team is managing these risks.
• Take a fresh look at the board’s cyber reporting and get consistent and holistic information to help the board make decisions.
• Understand significant new laws and regulations in the cyber/privacy areas and their impact on the business, and get updates on how the company is staying up to date with and meeting those requirements.

…read more in the report.

Even with a robust risk management program, there still can be a successful breach and boards should focus their attention on resilience plans.

Next steps:

• Oversee documentation of the company’s incident response plan and understand how often it is tested by management.
• Make sure the CISO is included in the company’s disclosure controls and procedures process.
• Discuss lessons learned from other public security breaches with management and whether the incident response plan is updated for these learnings.

…read more in the report.

By now, all boards have allocated cyber risk oversight somewhere — either to a committee or the full board. But boards periodically should reassess their allocation to determine that it is effective.

Next steps:

• Reassess where cybersecurity oversight sits on your board and whether the board has cybersecurity skills/expertise, or has access to cybersecurity skills/expertise, to perform its oversight role.
• Evaluate how your board is continuing to get upskilled and educated on cybersecurity.
• Update the relevant charter with language that provides insight into the committee’s responsibility, under the direction of counsel.

…read more in the report.