At a time when the theft of customer information often leads to executive-level shake-ups, boards are taking a greater role in evaluating the adequacy of their organisations’ cybersecurity. But many boards have yet to apply the same level of scrutiny to their own security. This article provides an evaluation framework for directors and senior management. Focus is on three main factors: where data is stored, the strength of ‘locks’ that provide access, and the control of ‘keys’ for entry.
Leadership’s engagement with cybersecurity is not only internally driven. Regulators have also begun to raise expectations. For example, in the US, the Securities and Exchange Commission has affirmed the importance of including cybersecurity processes and events in a public company’s disclosure of risk factors and material events. And while these regulations may not apply to privately held companies and non-profits, they are nonetheless held to strict standards by their owners, business partners and donors.
