The Cyber Risk Handbook

Chapter 2 Board Cyber Risk Oversight: What Needs to Change?

Tim J. Leech, Risk Oversight Solutions Inc., Canada Lauren C. Hanlon, Risk Oversight Solutions Inc., Canada

The introduction to this book opens with a succinct statement from Tara to Tom, the CEO who has attempted to delegate accountability for responding to the board’s request for a cybersecurity road map to his chief information security officer. Tara told Tom: “No, you own cybersecurity; we oversee it alongside the board . . . I don’t mean our IT approach, I mean our whole-of-organization capability to manage cyber threats.” This type of clarity and direction to CEOs is relatively new, but one that is gaining traction globally.

From a pragmatic perspective, the key question well-intending boards need to be asking is “what specifically do we and the organization’s CEO need to do differently to meet these new cybersecurity expectations?” The problem they will immediately confront is a veritable ocean of advice on how to do this. This chapter focuses on the following three questions: (1) what are boards expected to do now?; (2) what barriers to action will well-intending boards face?; and (3) what practical steps should boards and organizations take now to respond? Be warned, however; the steps proposed in this paper are a radical departure from status quo thinking.

What Are Boards Expected to Do Now?

The first short answer is the frustrating and quite common “It depends.” It depends on what country your organization ...