How can boards oversee cyber security effectively?

Understanding how the board can support an effective cyber program can be hard, not least as it can be well outside the expertise of board members. I recently teamed up with the Institute of Directors to provide this essential guidance for boards and non-executive directors.

Image for post
Image for post
Cyber can be challenge in the board room. Photo by Scott Walsh on Unsplash

In just a few years, cyber has transformed from the nerd in the corner into the Kim Kardashian of risk. Everyone, it seems, has an opinion on the issue. That’s because it’s serious — businesses can be built on, and destroyed by, cyber risk.

The World Economic Forum’s Global Risks Report 2019 ranks cyber attacks among the top seven risks facing the planet in terms of likelihood and impact, while high-profile CEOs including Warren Buffett of Berkshire Hathaway and Jamie Dimon of JPMorgan Chase see them as the number-one threat to business.

Despite this, a poll of 1,300 large international organisations has found that only 11 per cent of boards have taken direct responsibility for their firms’ cyber security.

Although the private sector’s investment in protective tech and compliance has increased, few business leaders have a clear understanding of cyber risk and confidence that the necessary safeguards are in place at their firms.

Practical advice for directors on this issue is still hard to come by, so here are some straightforward ways to improve your board’s grip on cyber risk.

1. Lead from the front

Effective cyber security requires leadership, which should come first from the board and then from the executive responsible for this aspect of the business. This is the other way round in many companies, with boards looking to their security leaders for guidance and objectives. Ask your cyber exec to explain the threats facing the organisation. Then give them clear guidance on how quickly you want these addressed and what level of risk you can live with.

2. Talk to your CISO

Few chief information security officers (CISOs) have a close relationship with the board in their organisations — many do not report to it directly. Meanwhile, the chief information officer, who has a very different mandate, often covers cyber security at the most senior level, yet IT operations and security priorities frequently conflict. Boards can learn a lot from how security and technology leaders work together, but the best way to do this is to consult both of them.

3. Ask all the right questions

To understand your firm’s level of resilience, ask your security leader to tell you: what data systems and assets you have, where they are and which are important (most aren’t); what scenarios are most worrying and how your controls will prevent them; how you will find out — and how quickly — when something goes wrong; and how the organisation will respond if the worst happens, plus its chances of recovery. Use their answers to guide your incident response plan.

4. Demand clarity in reporting

Research by Willis Towers Watson has found that 96 per cent of board members want to invest more in cyber security. What’s stopping them? Security reporting can often be qualitative (terms such as “high”, “medium” and “low” risk can be interpreted differently) or unrelated to business goals. Insist on risk assessments that quantify the likelihood and impact of a cyber security breach. How does the potential cost of an incident compare with the investment you are being asked for?

5. Get more from your non-execs

Not every company needs a “Cyber Ned”, but it is crucial to have someone on the board who has enough experience and knowledge to ask the right questions of the specialists. That person could have led an executive-level response in the past or observed how other firms’ boards approached a cyber incident. The challenge here is to get the appropriate skills on your board. Don’t assume that your most technically literate board member, such as a former chief information officer, will automatically fulfil this role. Instead, assess the capabilities of the board and form a plan to address any gaps in knowledge.

6. Play your part in simulations

Our research indicates that only 13 per cent of board members feel they have learnt from the security mistakes their firms have made. A key contributor to this is a lack of understanding about how to handle a crisis. All companies should regularly test their readiness. This can be done as a desktop exercise, but it’s better if you make it as real as possible. For instance, the IBM X-Force Command Cyber Tactical Operation Center offers a training platform that can run full-scale simulations of cyber incidents. A board member should get actively involved in such exercises to practise how to respond.

7. Practise dealing with the media

Serious cyber incidents will hit the headlines, so you need to have a media management strategy ready to limit any reputational damage. Baroness Dido Harding, TalkTalk’s CEO in 2010–17, sought to do the right thing by making a prompt public announcement when a cyber attack in 2015 compromised the details of millions of customers, yet she still had to handle intense criticism. Bring in a public relations specialist or crisis management adviser, choose scenarios that most concern you and then stand in front of a camera and, with their help, practise how to handle a grilling from the media.

8 Focus on the human aspects

Cyber risk is seen as an IT issue, but research shows that some 90 per cent of incidents leading to cyber insurance claims resulted at least partly from human behaviour. Your HR, IT and security teams should work together on this — discuss how your company’s culture supports cyber security and risk management, and make sure your board messaging encourages staff to take risk seriously.

About the author

Matt Palmer is a technology and cyber risk leader. He has led global technology and cyber security functions across banking, insurance and capital markets — often through innovation, change, and M&A. He is director of cyber strategy and risk advisory firm Cyberclaria, a board advisor to several fintech startups, and a board member of a financial services regulator. Both an accountant and a technologist, Matt has presented at many international conferences and was awarded Security Leader of the Year in 2018.

Connect with Matt on Medium, Linkedin and Twitter

Written by

Making change happen with technology, people and data. CISO | CIO | NED. Say hi at

Sign up for Digital Director

By Cyber Strategy & Leadership

Cyber Strategy and Leadership for board members and business executives Take a look

By signing up, you will create a Medium account if you don’t already have one. Review our Privacy Policy for more information about our privacy practices.

Check your inbox
Medium sent you an email at to complete your subscription.

Cyber Strategy & Leadership is published to support business leaders from board level to operational management with the challenge of leading and directing enterprise cyber security. Our mission is to simplify, clarify, and inform.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store