Cybersecurity leadership begins at the top, with the chief information officer (CIO) and chief information security officer (CISO). That is the simple part. While leadership is never easy, it is fairly uncomplicated to grasp nonetheless.

The complicated part of IT leadership is understanding the security threats that organizations face and where they come from. Leading means setting an example, but of what and to whom?

In the connected ecosystem of the IT world, third-party risks are growing. Given the popularity of cloud and mobile apps and the emergence of the Internet of Things (IoT), organizations are navigating a sea of relations with external entities. That means dealing with the vulnerabilities and risks of interconnectivity.

Cybersecurity Leadership Lags

As CIO Insight reported, IT professionals are aware of these third-party risks, but organizations are lagging in holding leaders responsible for managing these risks. Three-quarters of respondents to a Ponemon Institute survey, “Tone at the Top and Third-Party Risk,” agreed that third-party risk was a serious concern, and 70 percent said they believed the risk was growing.

Another three-fifths of respondents named the IoT as a growing source of third-party risk, while 68 percent cited cloud migration. Assessment of significant risk, as opposed to growing risk, found a similar pattern. More than two-thirds of respondents identified cloud computing and mobility as significant threats, and more than three-quarters tagged the IoT as such. Just over half placed big data analytics in this category.

Despite these worries, third-party risk is not often a prime focus of risk management strategies. These are typically directed at minimizing downtime and business disruptions. Only 29 percent of survey respondents said their organizations had a formal third-party risk management program.

Managing Third-Party Risks

In short, cybersecurity leadership is lagging when it comes to third-party risks, even though the risks themselves are growing. Only 37 percent of respondents were confident that the C-suite understood its ultimate responsibility for managing third-party risks, while half felt that risk management was not aligned with enterprise goals. Confidence in the board of directors is also low, according to the survey.

The risks, however, are very big and very real. On average, respondents reported having spent $10 million in the past year in responding to “security incidents because of negligent or malicious third parties.”

For CIOs and CISOs, the message is clear: Someone needs to push the enterprise’s top leadership toward awareness of — and effective responses to — third-party risks. The CIO and CISO are best positioned to advocate for this strategy.

Organizations and their IT networks are interconnected to a degree that makes security a shared responsibility. A positive tone at the top can help organizations avoid working with untrustworthy third parties and build the ethical partner relationships in which responsibility for cybersecurity leadership is shared, productive and effective.