“Increasingly, cybersecurity is becoming a top-of-mind issue for most CEOs and boards, and they are becoming more preemptive in evaluating cybersecurity risk exposure as an enterprisewide risk management issue, not limiting it to an IT concern.” – Deloitte’s “Cybersecurity: The changing role of audit committee and internal audit

As mentioned in a previous article, boards are feeling increased pressure from government regulators and shareholders regarding their role in the oversight of cyber risks. This article looks at the questions a CISO is likely to face when presenting to the board, as well as what directors are advised to ask CISOs about when it comes to cybersecurity.

Board Questions Regarding Oversight

Boards have only recently taken on cyber risks in the boardroom. They are still looking to find the right fit for cyber risks within the board and its environment, as evidenced by ongoing arguments such as whether cyber risks should be a full-board issue or delegated to an audit or risk committee, and what amount of time boards should give to cyber issues.

According to KPMG’s latest report, “Connecting the dots: A proactive approach to cybersecurity oversight in the boardroom,” the questions on directors’ minds are: “Am I asking the right questions? How do I get comfortable? Are we doing enough? How do I know we are doing the right things? Are we making the right decisions?”

The report goes on to list questions that boards are asking about cybersecurity oversight in general, including whether the CISO function is correctly positioned (i.e., not under the CIO), whether the CISO has direct reporting capability to the CEO, the frequency and quality of meetings and briefings where cyber risks are the primary topic.

In particular, boards are concerned about their responsibilities to shareholders when it comes to cybersecurity. Notably, this includes whether boards themselves are asking the right questions and receiving quality answers and, most importantly — from a director’s perspective, anyway — whether the board is being transparent enough in keeping shareholders informed about the organization’s handling of cyber risks.

Board Questions to Executive Management and CISOs

According to SpencerStuart, boards also know they have a duty to ensure top executives understand their own role in managing and overseeing risks, that management understands how cyber risks can impact the business and that management appropriately funds cybersecurity efforts.

Written from the perspective of cybersecurity program management, EY’s Cyber Program Management report has boards asking the organization’s security leadership questions such as:

  • Are profit-generating assets adequately secured?
  • How well-protected is high-value information?
  • Is the organization’s cybersecurity strategy aligned with its business objectives?
  • How is the effectiveness of the cybersecurity program measured?
  • Is the organization spending appropriately on security priorities?
  • Would the organization be able to detect a breach?
  • Does the cybersecurity area have access to adequate resources?
  • How does the organization’s security program compare to that of its peers?

As boards seek to better understand the nature of cyber risks, directors are also asking questions about the threats faced, the levels of cyber insurance and the nature of the coverage, the ways that an attack could unfold, how the organization would detect and respond to such a scenario and how/when the incident would be reported to the board. Boards are also asking CEOs to take a more proactive role in managing cyber risks, and they’re asking about the extent to which cybersecurity is a priority for leadership.

Boards Undergo a Mental Shift

Robyn Bew, director of research at the National Association of Corporate Directors (NACD), gave advice to boards of directors in a piece from Ethical Boardroom. She suggested boards ask management about the level of cyber risk tolerance for various assets and threats, how cybersecurity is factored into business decisions and business relationships (i.e., the security of third-party vendors) and the threshold level of a material breach requiring board notification.

This advice is part of a larger framework of knowledge for directors assembled by the NACD, compiled in the Cyber-Risk Oversight handbook, available in executive summary form and in full from the NACD website.

As boards internalize the mental shift — moving from an “our-layers-of-defense-make-us-secure” mindset to a “breach-is-inevitable-let’s-be-ready” mindset — directors are starting to ask more probing questions about the level of readiness to detect, respond to and handle the inevitable breach.

The Wall Street Journal article titled “Cybersecurity: Boards Must Ask Sharper, Smarter Questions” recommended that boards ask about the lessons learned and the revamped response process from recent cybersecurity incidents. They should inquire particularly about the overall evaluation of the security team’s response to the incident. More mature board discussions are likely to involve a review of the effectiveness of security controls and the overall security program, as well.

The Relevant Questions

Cybersecurity Docket had a good recap of an approach recommended to boards. When it comes to overseeing cyber risks, directors should address the subject of cyber risks “with a vigorous, skeptical, intelligent and methodical inquiry.” The article contains a detailed list of 10 cybersecurity concerns that boards should be asking about, ranging from policies to insurance to lessons learned.

Another CISO — who has asked to remain anonymous — was invited to present at a conference of board directors. There, the executive was asked about:

  • Issues that stem from organizational structure, such as where the CISO function should be housed and what dotted line reporting paths should exist;
  • Attributes that boards could use to determine how effective the CISO was at performing his/her job;
  • Best practices for cyber risk management and how best to measure and communicate risks; and
  • The rising cost of cybersecurity programs and the difficulty in evaluating their effectiveness. Directors asked if there is a threshold point at which throwing more money at cybersecurity does not provide enough of a return.

Understanding and anticipating these questions can help security professionals and CISOs communicate more clearly with executives, implement cybersecurity initiatives and better position the organization for success.

More from Risk Management

The Evolution of Antivirus Software to Face Modern Threats

Over the years, endpoint security has evolved from primitive antivirus software to more sophisticated next-generation platforms employing advanced technology and better endpoint detection and response.  Because of the increased threat that modern cyberattacks pose, experts are exploring more elegant ways of keeping data safe from threats.Signature-Based Antivirus SoftwareSignature-based detection is the use of footprints to identify malware. All programs, applications, software and files have a digital footprint. Buried within their code, these digital footprints or signatures are unique to the respective…

Contain Breaches and Gain Visibility With Microsegmentation

Organizations must grapple with challenges from various market forces. Digital transformation, cloud adoption, hybrid work environments and geopolitical and economic challenges all have a part to play. These forces have especially manifested in more significant security threats to expanding IT attack surfaces. Breach containment is essential, and zero trust security principles can be applied to curtail attacks across IT environments, minimizing business disruption proactively. Microsegmentation has emerged as a viable solution through its continuous visualization of workload and device communications…

How the Silk Road Affair Changed Law Enforcement

The Silk Road was the first modern dark web marketplace, an online place for anonymously buying and selling illegal products and services using Bitcoin. Ross Ulbricht created The Silk Road in 2011 and operated it until 2013 when the FBI shut it down. Its creator was eventually arrested and sentenced to life in prison. But in a plot twist right out of a spy novel, a cyber attacker stole thousands of bitcoins from Silk Road and hid them away. It…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…