July 20, 2018 By Christophe Veltsos 3 min read

Every member of a digitally integrated enterprise has a role to play in keeping organizations safe across lines of business — up and down the organizational chart. Not every company has caught up to this line of thought, however. What’s more, those that have may not have a clear idea of what those roles should look like.

The National Institute of Standards and Technology (NIST) released a guidebook draft to help bridge this gap: “Cybersecurity is Everyone’s Job.” The NIST guidebook was created for business owners and leaders, but it’s also helpful for those serving functional roles in human resources (HR), IT, legal — and even sales and marketing.

The Importance of a Cybersecurity Culture

The NIST guidebook stresses the importance of a culture of cybersecurity in safeguarding the data that enables organizations to compete and thrive in the digital age.

The reality: Employees represent the “largest attack surface” of most organizations. Common business activities — such as product and service delivery, payroll, accounts payable, communicating with customers and suppliers and resource management — frequently expose organizations to cyber risk, which is why a cybersecurity culture is so critical.

Tone and close involvement from the organization’s leaders dictate whether efforts to impact culture are successful or short-lived experiments. Mindset is also a key driver of human behavior — so proper attention must be paid to evaluating and addressing employees’ mindsets as part of a broader security-awareness campaign. Additionally, due to the rise in attacks leveraging social engineering, organizations should seek to “harden” their employees to such attacks.

Listen to the podcast: What’s the Best Defense Against Cyberattacks? You Are

Leadership, Planning and Governance Are Key

The NIST guidebook directly addresses directors, chairmen and chairwomen, presidents, partners, founders and the like: “You matter to the organization because, without you, the organization lacks direction and cohesion. You are the hub of the wheel — connecting to, coordinating and driving the many parts of the business.”

This includes managing all cyber-related business risks, prioritizing and ensuring proper funding for cybersecurity projects, building a culture of security and ensuring proper governance controls are in place.

The NIST’s recommendations for action include:

  • Understanding cybersecurity well enough to enable sound decision making;

  • Including cyber risks in the enterprise risk management (ERM) process;

  • Developing and maintaining organizational information security policies and standards;

  • Promoting the development of effective cross-functional teams to accomplish cybersecurity goals for the organization; and

  • Protecting sensitive strategic, financial, legal and risk information.

People in these roles might often find themselves with the difficult responsibility of making decisions about a subject with which they are neither comfortable nor familiar. From the summit of a businesses’ accountability, leaders are encouraged to ask questions and access timely and relevant information that will allow them to make sound cyber risk decisions.

The Role of Finance and Administration

As players who “are responsible for ensuring that each part of the organization has the ability to pay for goods and services, operate within a budget, track revenues and expenditure and conduct business with external entities,” as well as handling massive banks of proprietary data, finance and administration departments function with a particular connection to cybersecurity.

This area often includes ERM, and possibly internal audit and compliance functions. “You matter to the organization because nothing can happen without the ability to maintain financial health, perform essential transactions, manage business risks and support the planning and governance function,” the guidebook stresses. There are many systems and sources of data people in this function own, manage or use, including Internal Revenue Service (IRS) data, balance sheets, budgets, Securities and Exchange Commission (SEC) filing data, ERM tools, audit reports, contracts and more.

Regarding cybersecurity specifically, the guidebook reminds professionals in finance and administration of their responsibility to “ensure that cyber risks are integrated into the enterprise risk management process” — including the ability to identify cyber risks early when initiating new projects or strategies, as well as the need to properly gauge the range of threats to which the business is subject.

Another major responsibility of people in this role is to “provide sufficient funding to enable the success of the organization’s cybersecurity strategy” and to ensure alignment of resources with strategy and risk appetite.

The bottom line: A holistic, broadly integrated (and deeply ingrained) approach to cybersecurity is the best way to fortify against risk and respond informedly and timely to incidents when they occur.

Listen to the podcast: What’s the Best Defense Against Cyberattacks? You Are

More from CISO

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Boardroom cyber expertise comes under scrutiny

3 min read - Why are companies concerned about cybersecurity? Some of the main drivers are data protection, compliance, risk management and ensuring business continuity. None of these are minor issues. Then why do board members frequently keep their distance when it comes to cyber concerns?A report released last year showed that just 5% of CISOs reported directly to the CEO. This was actually down from 8% in 2022 and 11% in 2021. But even if board members don’t want to get too close…

The CISO’s guide to accelerating quantum-safe readiness

3 min read - Quantum computing presents both opportunities and challenges for the modern enterprise. While quantum computers are expected to help solve some of the world’s most complex problems, they also pose a risk to traditional cryptographic systems, particularly public-key encryption. To ensure their organization’s data remains secure now and in the future, chief information security officers (CISOs) should educate themselves about quantum computing, proactively address the coming quantum risks to cybersecurity and work to establish cryptographic agility in their enterprise.A future cryptographically…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today