SEC places security on the board agenda

 

Comments by Securities and Exchange Commission official, Luis Aguilar, further fueled the debate about the role of the corporate board in addressing cybersecurity risk. The board already has a risk oversight responsibility, so in theory extending that responsibility to cybersecurity risk is an excellent idea, but what about in practice? In practice the idea is excellent too…..but how should that practice manifest itself?

It took a long time for the CISO role to emerge in corporate America (and maybe 25% of large enterprises have one), so it will be quite a while before it becomes a consistent board seat. In the meantime, corporate boards are made up of current and former CEOs, CIOs & CFOs, academia and distinguished public servants from civilian and military backgrounds. I believe they are all too aware of the implication of cybersecurity risk. Like many senior executives, boards have recently had a crash course in the impact of security breaches. Either because they have witnessed them first hand….or from ‘a safe distance’ as competitors and peers have struggled through cyber attacks and loss disclosures. But there is no existing framework for discussing cybersecurity risk among a corporate board, certainly nothing that equates to their existing framework for discussing growth, profitability, legal exposure, supply chain, M&A, HR best practices, geopolitical risk etc. For those perpetual board meeting topics there is a consistent push for internal data and instrumentation that can be compared and benchmarked with a peer group, an industry or a competitor.