Cyber security threats are a chief concern for a growing number of corporate boards. Directors and senior management worry that data breaches and thefts could damage their company’s growth prospects, bottom line and brand reputation. Increasingly, boards seek to ensure that strong programs are in place to respond to any incident and that their chief information security officers (CISOs) brief them regularly on cyber security.
Talking the talk
Directors have a fiduciary responsibility to protect the company they serve but with cyber security-related litigation increasing, lawmakers and regulators seem primed to toughen their oversight.
While company boards recognise that it is both management’s and the CISO’s responsibility to protect a company’s data and applications, they must ensure that they communicate in the most effective way with their IT experts. Often, they don’t. A vast majority of directors are not tech-savvy and many CISOs don’t speak the language of business. Both boards and IT security professionals must discard their professional and technical lingo and speak plainly to one another.
In conversations with directors and IT leaders, it’s clear that this is a common occurrence: A CISO briefing the board will suddenly lapse into using IT jargon – an alphabet soup of terms from “asymmetric cryptography” to “zombie.” Directors, on the other hand, too often speak the language of an economist or an MBA.
What CISOs must realize is that directors want to know in plain terms the financial impact that a technology issue – whether a breach or an IT security expenditure – will have. They want to know what it will mean if the company doesn’t give IT more security personnel or budget to advance their cyber security portfolio. At the same time, CISOs must be able to follow a boardroom conversation.
Advice for both sides
There are a number of ways in which both sides can tackle the complexities of cyber security.
For Directors:
- Do homework on the basics of information breaches and cyber security. Gain enough knowledge to be able to grasp what IT leaders are saying and to ask pertinent questions. This background information can come from other board members who have more experience on the topic, from security-related websites or from news outlets that regularly cover the steady drumbeat of breaches.
- Find out the common ways cyber criminals, spies and hacktivists burrow into a target’s IT infrastructure and extract critical data, as they did in the high-profile breaches that compromised Anthem, Home Depot, Neiman Marcus, Sony and Target.
- Ask for and review what peers are doing in the company’s industry, and keep an eye on the company’s competitors and their security postures.
- Grasp the compliance issues that affect or could impact the company in the areas of security and privacy. A legal or government affairs resource in the company should be able to supply that.
- Refrain from asking a CISO a binary question such as “Are we secure?” It’s unrealistic to think that any company can ever achieve a zero-risk state. There’s no guarantee a data breach will never occur. Instead, ask “Can major cyber threats be mitigated? Do we align with industry security practices? Are we in compliance with regulations and industry standards? How did we do in our last cyber incident response simulation?”
For CISOs:
- Since a board presentation can trigger panic – and even kill a project or hurt a career if done poorly – look to experts such as industry analysts for guidance and download resources such as the Gartner Executive Briefing Toolkit for Security Strategy.
- Think strategically and focus on the business, which means forego tech speak and relate the value of, for example, a technology security purchase to risk mitigation, not ROI or TCO. For board members, risk tolerance, risk mitigation, brand reputation, business disruption and compliance are key.
In the end, much of the responsibility for effective communication rests with the CISO. But directors also have an obligation to ensure that a dialogue is open, honest and generates important and insightful knowledge.
The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.