Two recent articles, discussed in this post, attempt to describe how to explain cyber risk to the board.
One of the key elements needed to ensure accountability is reporting the right statistics and metrics. Each user department is responsible for ensuring that its information technology needs are addressed, and the IT department is responsible for providing overall cost-effectiveness, quality and coordination. The IT department can play its role by ensuring that IT metrics are captured and disseminated. User departments and the IT department must both be involved; neither may be permitted to abdicate its responsibilities.
The two definitive studies by COSO identify monitoring as a critical component of internal control and risk management. Monitoring refers to both ongoing monitoring processes to ensure that a system functions as it is supposed to (including management and review aspects), as well as ad hoc special studies and audits to review the system...