Board members with cybersecurity backgrounds increased by nine percent in 2021.

Cybersecurity experts have a growing impact on modern boards

Leadership

Cybersecurity has a growing impact on modern boards


Cybersecurity experts have a growing impact on modern boards


almost any company you talk to these days, if you think about what are the top risks to that company cybersecurity is usually in the top three, if not the number one risk to the company cybersecurity about 5 to 10 years ago was very reactive, right? Like an incident happens and then all of a sudden cybersecurity is right there and then they're in the forefront and then a lot of investments were being made. Companies have learned from those lessons now, a watershed moment for boards in particular was, in my eyes, the major cyber breach against target that attacked almost a decade ago was a wake up call for senior executives for boards because it has so many ripple effects. It wasn't just the technology challenge that caused business disruption. It involved the best of more than 40 million credit card records of customers, A major settlement with the government, I think almost $20 million, an estimated loss of $200 million dollars in revenue because of loss of customer trust. The biggest challenges you're running a business, right? And especially when you think about a company that's building a product or building a service, you're focused on that and then you're building, you're trying to make revenue and you're trying to make your customers happening and happy and all of a sudden you're products grown, your company's grown and you haven't security, not always on the forefront, right? And it's not the first thing a company thinking about the challenges aren't around. Hey, we need to make the investments, how do we prioritize and how do we balance that with the business. And I think that's the biggest thing is weighing that out. But you know, it's not, it's not like it used to be decades ago where it was an upward kind of battle to just get security prioritized, it's more, how do we balance these things? We know we have to do it. We identified 5 4 principles that I think has had major impacts in the American boardroom. Cyber is an enterprise risk. That's number one. Number two cybersecurity as a compliance issue. The board wants to make sure management put in the right controls and protection Around any legal risks. # three is every director on the board should be proficient, fluent and cyber security. # four is making sure that management itself as a framework and approach for targeting addressing this risk. Then the fifth issue is ensuring that the reporting that comes from management can translate that risk into financial terms. What does it mean to have x amount of exposure to cyber rescue terms of likelihood impact velocity, how does it translate into dollars and potential damages. Building trust takes a lot of effort and breaking it just happens with the snap of your fingers and dealing with a breach or an attack in the moment is so hard, I think very transparent and clear, communications around the facts of what's going on as you're getting them. I think determining the right way to communicate that to your customers is so, so important dealing with a breach or an attack in the moment is so hard going back to your plan, making sure that you're taking that moment to even getting your executives and folks together to make sure you have a consistent message and that you're handling this with the, you know, best care and not just kind of running around quickly because you feel all this pressure from that cybersecurity attack or incident. So you want to make sure there's very clear messages and communications to your customers. The sec is saying that, hey, board expertise is gonna have to improve cybersecurity. Um, I think that's gonna improve companies in the industry overall. Um, and we're gonna see more security expertise, tech expertise on board in a really meaningful way. I think beyond just hey, how can we forward our product strategy, but how do we make sure that our company is secure and how do we make sure that we have that diversity of the on the board that's bringing in that security kind of mindset, you're supposed to great transparency around what you do. You don't do. And I think for boards in particular, it will serve as a nudge to say, let's, let's reassess where we are. Do we have indeed the right expertise on our board? Maybe now is the time to recruit the next cyber director. We really believe this is a material strategic risk to our enterprise for the long term