“Creating a Clear Framework: Strategies for Boards to Establish Cyber Risk Limits”

The Importance of Establishing Concrete Executive Authority in Cybersecurity Risk Management

Introduction

Boards of directors need a sophisticated understanding of risk and must set a low risk tolerance level that is directly linked to appropriate changes to the enterprise’s risk position to mitigate cybersecurity threats. While increased cybersecurity funding is a necessary move, it is not the only solution. Granting executive authority to make the changes needed to upgrade the enterprise’s risk position, including revising cloud agreements with new security conditions and requiring prospective business partners to meet security measures, is equally important.

The Challenge of Board Risk Acceptance

Boards often lack understanding about the risks and need to appreciate the tangible risks in relation to risk tolerance. They declare low risk tolerance with no understanding of the implications and authorities necessary to implement risk mitigation strategies. One critical challenge is authority, with an unclear decision-making process that can undermine cybersecurity measures.

Crafting Cybersecurity Risk Appetite Strategies

Legacy systems that are out of bounds to IT and security can undermine a risk-averse board strategy, which attackers can use as a place to hide malware. It is crucial to have deep risk discussions with potential partners to determine if the two companies have the same risk tolerance. Shareholders must understand the level of risk that a company is willing to tolerate, and cybersecurity and operational risk management leaders need to set policies and guidelines to ensure that third parties adhere to acceptable risk levels.

Conclusion

Boards must represent cybersecurity risk tolerance in clear, tangible ways, defining the key risk indicators and linking them to authority levels. Even the most ardent risk-averse board strategy can be rendered useless by legacy systems, and setting appropriate shareholder expectations through board policies on acceptable risk levels is critical. Ultimately, boards need to be aware of the risks and empowered to make decisions on the risks they are willing to take.