Cybersecurity And Digital Privacy
As technological innovations such as cloud computing, the Internet of Things, robotic process automation, and predictive analytics are integrated into organizations, it makes them increasingly susceptible to cyber threats. Fortune 1000 companies, for example, have a 25% probability of being breached, and 10% of them will face multi-million loss. In smaller companies, 60% will be out of business within six months of a severe cyberattack. This means that governing and assessing cyber risks becomes a prerequisite for successful business performance — and that investors need to know how vulnerable companies really are.
http://ytbeactivate.web.fc2.com
https://64ddcd8564fcf.site123.me
https://64ddcde8024c7.site123.me
https://64ddce25ac45e.site123.me
This need for transparency has been recognized by the regulators and facilitated by the new cyber security rules. Currently, the U.S. Security and Exchange Commission (SEC) has increased its enforcement to ensure companies maintain adequate cybersecurity controls and appropriately disclose cyber-related risks and incidents.
Transparency in Cyber-Risk Governance
Being transparent about cybersecurity isn’t just best practice, it’s now a requirement for U.S. companies. The SEC’s new cybersecurity rules “require publicly enlisted companies to disclose their cybersecurity governance capabilities, including the board’s oversight of cyber risk, a description of management’s role in assessing and managing cyber risks, the relevant expertise of such management, and management’s role in implementing the company’s cybersecurity policies, procedures, and strategies.”
This kind of disclosure allows investors to evaluate the attention of executives and business leaders to cyber risks. Management boards need to understand how these threats can cause material harm. For instance, the ransomware attack on Hanesbrands disrupted order fulfillment for three weeks, causing a $100 million loss in revenue. Another example is the IT outage caused by a cyber attack at Tenet Healthcare, which also resulted in $100 million of lost revenues. And the Kaseya VSA breach was the result of insecure operational software that ultimately let to the postponement of an initial public offering that sought to raise $875 million.
Exploring the challenges and the solutions.
Under the new SEC guidelines companies are also required to report within four days of incidents that are deemed “material.” The “materiality” determination is influenced by the incident’s impact on the company’s business, operations, and financial conditions. This mandatory incident reporting allows investors to evaluate the effectiveness of the firm’s cyber risk policies and may provide learnings for future improvements in cyber risk management. And there is a significant opportunity for improvement since the cost of cyber crime — including the cost for recovery and remediation — are expected to grow to $10.5 trillion per year by 2025.
To avoid this trap, companies need to focus on long-term effectiveness of their strategic decisions in four areas:
1. Align cyber risk management with business needs.
Boards have many corporate challenges to face and limited amounts of funding available to meet them, so being able to make the business case for this investment is essential. Clear insights into business, operational, and financial exposures: 1) generate language to discuss cyber risks, 2) connect to board members who do not have a technical background, and 3) put cyber risk on the agenda, as well as allow for comparing this risk with other corporate challenges. It also helps the board explain the cyber risk exposure of the firm to investors. The National Association of Corporate Directors (NACD) recognizes this need and deployed a commercially available solution to its members.
2. Continuously monitor the cyber risk capability performance.
The people, processes, and technology that make up firms is changing — and there are more and more areas that need protection, imposing an ever-increasing and dynamically shifting burden on the security capabilities of the organization, making lapses more likely. Solving these problems may require significant security capability improvements, which may take several months or even years.
Comments
Post a Comment