Cyber Risk Still Not Getting Adequate Attention From Boards, Senior Execs

The advanced findings from the latest 2012 Carnegie Mellon CyLab Governance survey of how corporate boards and executives are managing cyber risks reveals the issue is still not getting adequate attention at the top. The survey, sponsored by RSA, The Security Division of EMC, was the third survey conducted by CyLab Adjunct Distinguished Fellow, Jody Westby, and comparisons with the 2008 and 2010 data clearly show ongoing gaps in governance.

Using the Forbes Global 2000 list, the 2012 survey represents the first analysis of cyber governance postures of major corporations around the world. One of the most important advance findings is that boards and senior management still are not engaging in key oversight activities, such as setting top-level policies and reviews of privacy and security budgets to help protect against breaches and mitigate financial losses. Even though there are some improvements in key “regular” board governance practices, less than one-third of the respondents indicate their boards and senior executives are undertaking basic responsibilities for cyber governance.

Although improvements are shown in the formation of board Risk Committees and cross-organisational teams within their organisations, nearly half of the respondents indicated that their companies do not have full-time personnel in key privacy and security roles, and 58 percent of the respondents said their boards are not reviewing their companies’ insurance coverage for cyber-related risks.

Recommendations

To help company boards improve corporate governance of privacy and security, the advance findings of the research included recommendations for organisations to undertake key governance activities, such as:

• Establish the “tone from the top” for privacy and security through top-level policies.

• Review roles and responsibilities for privacy and security and ensure they are assigned to qualified full-time senior level professionals and that risk and accountability are shared throughout the organisation.

• Ensure regular information flows to senior management and boards on privacy and security risks, including cyber incidents and breaches.

• Review annual IT budgets for privacy and security, separate from the CIO’s budget.

• Conduct annual reviews of the enterprise security program and effectiveness of controls, review the findings, and ensure gaps and deficiencies are addressed.

• Evaluate the adequacy of cyber insurance coverage against the organisation’s risk profile.

“The models for creating, delivering and managing IT services are in a state of transformation driven by virtualisation, cloud computing, the hyper-connectivity of people and organisations, and the emergence of a new class of ‘big data’ applications. With the convergence of these trends amid an increasingly complex compliance and threat landscape, executives and boards must be actively engaged in ensuring their organisations are addressing these risks while reaping the benefits of next generation IT,” said Brian Fitzgerald, Vice President, Marketing, RSA.

“Privacy and security are competitiveness issues, and companies that set the tone of a ‘trusted workplace’ with their employees also convey the message of a ‘trusted business’ to the marketplace. Effective governance enhances profitability through the mitigation of liabilities and losses associated with compliance costs, operational downtime, cybercrime, and theft of intellectual property,” said Jody Westby, CEO of Global Risk & Adjunct Distinguished Fellow, Carnegie Mellon CyLab.