• First Reference
  • About us
  • Contact us
  • Blog Signup 📨

First Reference Talks

Discussions on Human Resources, Employment Law, Payroll and Internal Controls

  • Home
  • About
  • Archives
  • Resources
  • Buy Policies
You are here: Home / Business / People still don’t know how to assess cyber risk!

By Norman D. Marks, CPA, CRMA | 3 Minutes Read January 7, 2019

People still don’t know how to assess cyber risk!

cyber risk
Image: www.mytechteam.net

Why do the consultants keep advising management and the boards to consider cyber risk as if it is separate from all other business risks? Managing any single source of risk in a silo is almost certainly going to lead you to make incorrect, uninformed decisions.

Cyber is only one of many sources of risk that can affect the achievement of an enterprise objective initiative, program, or project.

As I keep saying, it is not about managing risk – it’s about managing the organization and its success.

McKinsey published an article in November, Cyber risk measurement and the holistic cybersecurity approach. It’s an interesting piece, reflecting responses by some board members to a recent piece by them. For example, they quote people as saying:

  • “So far, we have not taken a big hit, but I can’t help feeling that we have been lucky. We really need to ramp up our defenses.”
  • “Digital resilience is one of our top priorities. But we haven’t agreed on what to do to achieve it.”

They also say, correctly:

  • Companies are rolling out a wide range of activities to counter cyber risk. They are investing in capability building, new roles, external advisers, and control systems. What they lack, however, is an effective, integrated approach to cyber risk management and reporting.
  • Boards and committees are swamped with reports, including dozens of key performance indicators and key risk indicators (KRIs). The reports are often poorly structured, however, with inconsistent and usually too-high levels of detail.
  • Most reporting fails to convey the implications of risk levels for business processes. Board members find these reports off-putting—poorly written and overloaded with acronyms and technical shorthand. They consequently struggle to get a sense of the overall risk status of the organization.

I especially like this:

At a recent cybersecurity event, a top executive said: “I wish I had a handheld translator, the kind they use in Star Trek, to translate what CIOs [chief information officers] and CISOs [chief information security officers] tell me into understandable English.”

But then they go down the silo path.

  • Working with top management and drawing on internal and external resources, the chief risk and information security officers create a list of critical assets, known risks, and potential new risks.
  • The chief measure of cyber-resilience is the security of the organization’s most valuable assets.

I know that this approach is consistent with guidance from ISO 27005: 2018 and NIST. But it focuses attention on information assets and not the achievement of organizational objectives and success.

Why can’t they ask a simple question:

If we had a cyber incident, how could it affect the business?

There’s going to be a range of potential consequences, each with a different likelihood. They could identify the level of harm that would be unacceptable and its likelihood.

But cyber is just one source of business risk!

It needs to be measured and discussed in a way that enables it to be considered alongside other business risks, including such as legal, market, compliance, safety, culture, third party, and other sources of risk.

When management and the board are setting objectives and making strategic and tactical decisions, they need to see the big picture, all the things that might happen (risk). Looking at cyber and then looking separately at other sources of risk is simply wrong.

I fail to see why people think cyber is risk #1 when they are not assessing how it could affect the achievement of key business objectives. What is the likelihood that a cyber incident would cause the organization to fail to achieve its EPS, market share, and other targets?

A new piece from PwC is no better. How your board can better oversee cyber risk doesn’t have a single question about what would happen to the business if there were a breach! Instead, there is a focus on data and other information assets.

Until we consider cyber the same way we consider other sources of business risk, in terms of how an incident might affect enterprise performance, value creation, and the achievement of objectives, management and the board will continue to make uninformed decisions.

I welcome your comments.

  • About
  • Latest Posts
Norman D. Marks, CPA, CRMA
Norman has led large and small internal audit departments, been the Chief Risk Officer and Chief Compliance Officer, and managed IT security and governance functions.

He retired in early 2013. However,he still blogs, writes, trains, and speaks – and mentors individuals and organizations when he can.
Latest posts by Norman D. Marks, CPA, CRMA (see all)
  • Twitter and risk - January 18, 2023
  • When the board insists on a list of the top risks - December 9, 2022
  • The greatest risk and the greatest asset - November 25, 2022

Article by Norman D. Marks, CPA, CRMA / Business, Information Technology, Privacy / cyber attack, cyber risk, cybersecurity, cybersecurity best practices, cybersecurity policies, cybersecurity risks, risk management policy

Share with a friend or colleague

Get the Latest Posts in your Inbox for Free!

Electronic monitoring

About Norman D. Marks, CPA, CRMA

Norman has led large and small internal audit departments, been the Chief Risk Officer and Chief Compliance Officer, and managed IT security and governance functions.

He retired in early 2013. However, he still blogs, writes, trains, and speaks – and mentors individuals and organizations when he can.

Footer

About us

Established in 1995, First Reference is the leading publisher of up to date, practical and authoritative HR compliance and policy databases that are essential to ensure organizations meet their due diligence and duty of care requirements.

First Reference Talks

  • Home
  • About
  • Archives
  • Resources
  • Buy Policies

Main Menu

  • About First Reference
  • Resources
  • Contact us
  • 1 800 750 8175

Stay Connected

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

We welcome your comments on our blog articles. However, we do not respond to specific legal questions in this space.
We do not provide any form of legal advice or legal opinion. Please consult a lawyer in your jurisdiction or try one of our products.


Copyright © 2009 - 2023 · First Reference Inc. · All Rights Reserved
Legal and Copyright Notices · Publisher's Disclaimer · Privacy Policy · Accessibility Policy