Every member of a digitally integrated enterprise has a role to play in keeping organizations safe across lines of business — up and down the organizational chart. Not every company has caught up to this line of thought, however. What’s more, those that have may not have a clear idea of what those roles should look like.

The National Institute of Standards and Technology (NIST) released a guidebook draft to help bridge this gap: “Cybersecurity is Everyone’s Job.” The NIST guidebook was created for business owners and leaders, but it’s also helpful for those serving functional roles in human resources (HR), IT, legal — and even sales and marketing.

The Importance of a Cybersecurity Culture

The NIST guidebook stresses the importance of a culture of cybersecurity in safeguarding the data that enables organizations to compete and thrive in the digital age.

The reality: Employees represent the “largest attack surface” of most organizations. Common business activities — such as product and service delivery, payroll, accounts payable, communicating with customers and suppliers and resource management — frequently expose organizations to cyber risk, which is why a cybersecurity culture is so critical.

Tone and close involvement from the organization’s leaders dictate whether efforts to impact culture are successful or short-lived experiments. Mindset is also a key driver of human behavior — so proper attention must be paid to evaluating and addressing employees’ mindsets as part of a broader security-awareness campaign. Additionally, due to the rise in attacks leveraging social engineering, organizations should seek to “harden” their employees to such attacks.

Listen to the podcast: What’s the Best Defense Against Cyberattacks? You Are

Leadership, Planning and Governance Are Key

The NIST guidebook directly addresses directors, chairmen and chairwomen, presidents, partners, founders and the like: “You matter to the organization because, without you, the organization lacks direction and cohesion. You are the hub of the wheel — connecting to, coordinating and driving the many parts of the business.”

This includes managing all cyber-related business risks, prioritizing and ensuring proper funding for cybersecurity projects, building a culture of security and ensuring proper governance controls are in place.

The NIST’s recommendations for action include:

• Understanding cybersecurity well enough to enable sound decision making;

• Including cyber risks in the enterprise risk management (ERM) process;

• Developing and maintaining organizational information security policies and standards;

• Promoting the development of effective cross-functional teams to accomplish cybersecurity goals for the organization; and

• Protecting sensitive strategic, financial, legal and risk information.

People in these roles might often find themselves with the difficult responsibility of making decisions about a subject with which they are neither comfortable nor familiar. From the summit of a businesses’ accountability, leaders are encouraged to ask questions and access timely and relevant information that will allow them to make sound cyber risk decisions.

The Role of Finance and Administration

As players who “are responsible for ensuring that each part of the organization has the ability to pay for goods and services, operate within a budget, track revenues and expenditure and conduct business with external entities,” as well as handling massive banks of proprietary data, finance and administration departments function with a particular connection to cybersecurity.

This area often includes ERM, and possibly internal audit and compliance functions. “You matter to the organization because nothing can happen without the ability to maintain financial health, perform essential transactions, manage business risks and support the planning and governance function,” the guidebook stresses. There are many systems and sources of data people in this function own, manage or use, including Internal Revenue Service (IRS) data, balance sheets, budgets, Securities and Exchange Commission (SEC) filing data, ERM tools, audit reports, contracts and more.

Regarding cybersecurity specifically, the guidebook reminds professionals in finance and administration of their responsibility to “ensure that cyber risks are integrated into the enterprise risk management process” — including the ability to identify cyber risks early when initiating new projects or strategies, as well as the need to properly gauge the range of threats to which the business is subject.

Another major responsibility of people in this role is to “provide sufficient funding to enable the success of the organization’s cybersecurity strategy” and to ensure alignment of resources with strategy and risk appetite.

The bottom line: A holistic, broadly integrated (and deeply ingrained) approach to cybersecurity is the best way to fortify against risk and respond informedly and timely to incidents when they occur.

Listen to the podcast: What’s the Best Defense Against Cyberattacks? You Are