How boards can amp up their oversight of cybersecurity

Finding cyber expertise to add to the board

While the boards of larger organizations and those in regulated industries may already have board-level cyber expertise on a technology committee or sub-committee, most are not in that position yet.  Those organizations face decisions on board structure and how they can meet the intent of the new regulation.

“The SEC views cybersecurity is one of their top potential risk areas for organizations. So just as boards have members who specialize in financial risk, you want someone who has a specialization in cyber who can lend their expertise to understanding the unique risks involved and provide oversight of management,” said John Pearce, Principal for Cyber Risk Advisory Services for Grant Thornton LLP.

But since there are no precise guidelines in the proposed rules, there is some ambiguity regarding qualifications for board-level cyber expertise. Depending on their approach to board size, membership and composition, boards look to add former CIOs, CISOs, or people who have worked in the technology or cyber space. 

“There is now an entire generation of cybersecurity leaders available to join boards,” said Max Kovalsky, Managing Director, Cybersecurity and Privacy for Grant Thornton. “Interestingly, headhunters are now offering their services to former IT and cyber executives who might want to fill these seats.”

Evolution of board oversight

Taking action through best practices

Actions boards can take to provide effective governance related to cybersecurity include:

• Seek out opportunities to become more knowledgeable on cyber topics so they can ask informed questions. Engage an external independent adviser to educate the board and broaden members’ perspective beyond the company or the industry. Individual directors may want to obtain certification through the NACD’s cyber-risk oversight program.
• Participate in the company’s cyber event simulation exercises to gain insight into preparation and the organization’s ability to respond and recover. “The number of exercises has gone up dramatically,” Kovalsky said. “We are seeing more boards participate in these exercises, playing their role to be briefed, advise, and endorse management decisions.”
• Form a sub-committee to focus on cyber issues. Sub-committees create opportunity for members to take a deeper dive into the subject and inform the board in a valuable way, helping to ensure the company’s program fulfills the intent of regulations, and builds trust with customers, investors, employees, the community, and regulators.

Cyber threats are relentless, leading to ongoing risk to the enterprise. With the new rules on the horizon, now is the time for boards to renew their focus on cybersecurity.

Industry focus

Here’s what board members should know about cybersecurity in some key industries.

Asset Management: Cybersecurity can be a competitive differentiator for asset managers who are trying to distinguish themselves in a field of highly credentialed competitors. But “if you can tell clients, ‘Here’s how we’ve increased our controls, here’s the insurance policy we have with a well-known insurance company, and here’s how we test and document around the testing’…I think that is definitely going to be a differentiator,” said Michael Patanella, Grant Thornton’s National Managing Partner, Asset Management. To read more, see “Cybersecurity is a differentiator for asset management.”

Technology: Technology companies face cyber risk from many directions, as both providers and consumers. “The industry is taking a deeper look at the level of scrutiny — and the level of assurance — that they need to go through for the software they build and the software they buy,” said Steve Perkins, Grant Thornton’s National Managing Partner, Technology. To read more about cyber risk in the tech industry, see “How tech firms can form a cybersecurity tripod”.